VCU branded angle-motif letterhead

Export Compliance and Research Security

  • Responsible Office: Export Compliance Program, Office of the Vice President for Research and Innovation , Research and Innovation
  • Current Approved Version: 11/03/2021
  • Policy Type: Administrative

Policy Statement and Purpose

VCU creates new knowledge every day and seeks to foster an environment that promotes research and learning that benefits our students and community. While the purpose of research, scholarship, and education at VCU is to ultimately share information and new knowledge, there are times when access to certain data or certain laboratory spaces must be restricted for confidentiality, export compliance, national security, safety, and/or other security reasons. To that end this policy establishes a framework for identifying certain activities, research, and/or research spaces that require additional security precautions.

This policy sets forth the elements of VCU’s export compliance, controlled unclassified information (CUI), and research/laboratory security programs, including classification and security requirements, and the VCU offices that provide support in these areas. This policy is designed to be supplemented by a series of Office of the Vice President for Research and Innovation compliance notices that will specify additional procedures related to this policy. These compliance notices must be followed in conjunction with this policy.  

Security concerns may also result in safety violations under the Safety and Risk Management policy, which outlines escalation and disciplinary outcomes.

Noncompliance with this policy may result in disciplinary action up to and including termination. VCU supports an environment free from retaliation. Retaliation against any employee who brings forth a good faith concern, asks a clarifying question, or participates in an investigation is prohibited

Who Should Know This Policy

All university employees (including faculty), postdoctoral fellows, students, and all other persons studying or working at the university (including visiting scholars and scientists) or with whom the university has contracted to teach, conduct research, or provide or receive service activities at, for, or on behalf of the university are responsible for knowing this policy and familiarizing themselves with its contents and provisions. 


Compliance Notice

The primary method by which the Office of the Vice President for Research and Innovation informs the VCU research community of research-related changes and of adjustments to research operations and requirements across the university.

Controlled Unclassified Information (CUI)

Controlled unclassified information (CUI) includes information that requires safeguarding or dissemination controls pursuant to and consistent with regulations and polices created by individual government agencies.

Empowered Official

An empowered official is someone directly employed by an organization who is legally empowered, in writing, to sign export license applications or other requests for approval of an export license on behalf of the organization.


An export occurs when an item is transferred physically from the U.S. to a foreign country, e.g., actual shipment of goods or goods carried during international travel, as well as when information is transmitted to a person or entity in a foreign country or a foreign person in the U.S., whether in writing, or via email, phone, fax, internet, or verbal conversations.

Export Control Laws and Regulations:

These include but are not limited to ITAR, EAR, and OFAC Regulations:

ITAR (International Traffic in Arms Regulations)

Regulations governing the exports and re-exports of items and services for military use, which include defense articles, including technical data, defense technologies, and defense services. These regulations are under the jurisdiction of the U.S. Department of State. (22 CFR Parts 120-130).  

EAR (Export Administration Regulations)

Regulations governing the export, including deemed export and re-export, of dual-use commercial items and technologies as well as other commercial items and technologies without an obvious military use. These regulations are under the jurisdiction of the U.S. Department of Commerce. (15 CFR Parts 730-774).

OFAC (Office of Foreign Assets Control) Regulations

OFAC is the federal government office responsible for administering and enforcing foreign asset control regulations. This includes economic and trade sanctions based on federal foreign policy and person security goals against targeted foreign countries, terrorists, international narcotics traffickers, and those engaged in activities related to the proliferation of weapons of mass destruction. The regulations administered by OFAC include controls with regard to specific individuals, specific organizations, and certain countries. OFAC is under the U.S. Department of the Treasury. (31 CFR Parts 500-598).

Technology Control Plan (TCP)

A technology control plan is the formalization of the processes and procedures the university project personnel will use to ensure that any subject items and information are not disclosed to unauthorized personnel or otherwise exported without the necessary U.S. government authorization. 


The Export Compliance Program within the Office of the Vice President for Research and Innovation officially interprets this policy. The Export Compliance Program is responsible for obtaining approval for any revisions required by the policy Creating and Maintaining Policies and Procedures through the appropriate governance structures. Please direct policy questions to the export compliance officer.

Policy Specifics and Procedures

I. Export Control and Controlled Unclassified Information (CUI) Compliance Program

The Export Compliance Program is responsible for conveying, through this policy and compliance notices, detailed procedural requirements specific to activities that involve export-controlled items and/or controlled unclassified information. The compliance notices can be found here:

The vice president for research and innovation is vested with the authority to designate an empowered official to oversee compliance with and enforcement of this policy. According to the U.S. Department of State, an empowered official has “the independent authority to: 1) enquire into any aspect of a proposed export [by the organization;] 2) verify the legality of the transaction and the accuracy of the information [contained in the application;] and 3) refuse to sign any license application or other request for approval without prejudice or other adverse recourse.” (22 CFR Section 120.25(a)(4)). VCU’s empowered official is the senior associate vice president for research compliance.

An export license from the U.S. Department of Commerce or the U.S. Department of State may be required before a foreign person can be given access to an export-controlled item or before an export-controlled item may be transferred to a foreign country, depending on a variety of factors including the type of technology or data involved and the intended end use or end user of that technology or data.  

A. Export Controls in Sponsored Projects:

The Division of Sponsored Programs (DSP) assesses each new grant, contract, material transfer agreement, and data use agreement for potential export control concerns, and alerts the Export Compliance Program when potential export compliance issues arise. Investigators, schools/college, and departments must assist in addressing potential export control issues and in developing appropriate technology control plans or applying for licenses as needed. DSP will attempt to remove any publication or other dissemination restriction and will accept export-controlled work only after the project is approved by the Export Compliance Program.

B. Export Controls for International Travel

When planning a trip abroad, VCU travelers must comply with VCU’s policy on the use of Chrome River for pre-approvals and Christopherson for travel bookings. Individuals traveling internationally who do not use these systems must contact the Export Compliance Program before traveling.

Each individual must ensure that any information to be discussed while abroad or any items to be taken abroad are not controlled, or if controlled, a proper license or license exception is in place. 

 Biological samples must never be transferred without an official agreement in place and prior authorization from VCU’s Export Compliance Program.

Required Actions in Advance of International Travel - These requirements apply to all VCU employees (including faculty), students, and volunteers who travel internationally as part of VCU research, education, service, or employment. 

  1. Request Pre-Approval for International Travel through Chrome River. Be sure to check the “Travel Outside 48 contiguous States” box.
  2. Respond promptly to any request for additional information from the Export Compliance Program.
  3. All international travelers should review the “international travel” tab of VCU’s export compliance website.

 International travelers are also strongly encouraged to consult VCU’s International Travel website to review current travel warnings.  

C. Export Controls for International Employees and Visitors:

Federal regulations require VCU to review certain visa applications for possible export control concerns. All J-1 and H-1B visas processed through VCU’s Global Education Office must be sent to VCU’s Export Compliance Program for review.

 The required forms for an international visitor or employee can be found on VCU’s Global Education Office website ( Once the forms have been completed, the Global Education Office forwards the export review form to the Export Compliance Program. If no export restrictions are found during the review, the Global Education Office will continue the visa application process. If restrictions are found, the faculty or sponsor of the foreign person must meet with a representative from the Global Education Office and from the Export Compliance Program to discuss possible solutions.

D. Export Controls for International Shipping:

Shipping tangible items outside of the United States may require an export license. Please contact the Export Compliance Program prior to shipping internationally on behalf of VCU to determine whether a license is required.

E. Export Controls for Scientific Equipment Purchases:

All scientific equipment purchases must be processed in accordance with VCU purchasing policies.

VCU’s Office of Procurement Services will request the Export Control Classification Number/United States Munitions List classification from each vendor. If the classification for the equipment purchased is other than EAR99, the purchase order and specification information will be forwarded to the Export Compliance Program for further evaluation.  

 Technology control plans will be established when controlled technology is procured by VCU. 

F. Sponsored Project and Research Volunteers:

See VCU’s Sponsored Project and Research Volunteers compliance notice for additional requirements.

II. Laboratory Security Program

In addition to export and CUI concerns, certain labs at VCU conduct work that is restricted for confidential, national security, bio-security, bio-safety, chemical safety, radiation safety and other concerns. VCU’s Office of the Vice President for Research and Innovation and Environmental Health and Safety support various research projects with security concerns. This policy and the associated compliance notices are designed to address the safety and reputational issues associated with these projects.


  1. Visiting Nonemployee Scholar Agreement
  2. TMP Exception Form
  3. Research Self-Assessment Form
  4. International Agreements Pre-Screening Form

Related Documents

  1. Office of the Vice President for Research and Innovation Compliance Notices
  2. VCU Policy: Safety and Risk Management
  3. National Archives Controlled Unclassified Information (CUI)
  4. Sponsored Project and Research Volunteers Compliance Notice 
  5. Export Administration Regulations (EAR) - 15 CFR 730-774
  6. International Traffic in Arms Regulations (ITAR) – 22 CFR 120-130
  7. Office of Foreign Assets Control – 31 CFR 500-598
  8. CDC/APHIS Select Agent Program
  9. Department of Homeland Security – Chemical Facility Anti-Terrorism Standards

Revision History

This policy supersedes the following archived policies:

December 04, 2014 Compliance with United States Export Control Laws
November 3, 2021 Minor Revisions


1. What is an export?

An export is an actual shipment or transmission out of the United States of items, services, or technical data subject to either the EAR or ITAR, or a release of technology, software, or technical data subject to either the EAR or ITAR to a foreign person in the United States. Technology, software, or technical data could be "released" as an export through any of the following means:

  • Visual inspection by foreign person of U.S. equipment and facilities
  • Oral exchanges of information in the United States or abroad
  • Transfer or shipment via any means (physical or electronic) to a foreign entity
  • Providing a service, or the application to situations abroad of personal knowledge or technical experience acquired in the United States

2. How do I know if export controls apply to my grant/contract?

The Export Compliance Program assesses the potential for export control applicability to grants and contracts at the time of award. If concerns arise, the principal investigator will be contacted prior to acceptance of the award. If a sponsor raises the issue of export controls during the conduct of a project, contact the Export Compliance Program immediately.

3. What is involved in obtaining an export license?

A request must be submitted to the U.S. Department of Commerce for EAR-controlled items or the U.S. Department of State for ITAR-controlled items. Export licenses can take up to six months for review before a final determination is made. A request for an export license must be coordinated through the Office of the Vice President for Research and Innovation, Export Compliance Program.

4. Why should I be concerned about an export?

Access to restricted or export-controlled technology, commodities, defense articles, and defense services by unauthorized foreign person(s) could result in severe criminal or civil penalties for the university and the university employee making the export. Prosecution of an export violation may result in fines of up to $1M and/or a prison sentence of up to 20 years.

5. What is a "deemed" export?

Release of technology or source code subject to the EAR or ITAR to a foreign person in the United States is "deemed" to be an export to the home country of the foreign person.

6. What is a laboratory security risk?

Providing a secure location for the storage, use, and disposal of hazardous materials protects authorized users and the community. In some cases, regulations mandate enhanced security and the obtaining of certain permits or licenses. Particular concerns among others include: DEA-regulated drugs and precursors, DHS Chemicals of Interest, CDC/NIH select agents, dual-use research of concern materials or technologies, and select radioactive sources of the NRC theft control and diversion program list. All labs must have basic lock and key control. Additional security, monitoring, and response procedures will be outlined in compliance notices associated with this policy.