Compliance Agreement
ITAR • EAR • OFAC • NIST 800-171 • Last Updated: October 12, 2025
Critical Legal Notice
This Compliance Agreement outlines regulatory responsibilities for ITAR, EAR, OFAC, and other export control compliance. Organizations must implement their own compliance programs and policies. Legal review is strongly recommended for all regulatory agreements.
Scope and Purpose
Regulatory Framework
This agreement establishes compliance responsibilities for organizations using SecurePoint USAVisitor Management System (VMS) in regulated industries, particularly defense contractors, aerospace companies, and organizations subject to export control regulations.
Primary Regulations
- International Traffic in Arms Regulations (ITAR)
- Export Administration Regulations (EAR)
- Office of Foreign Assets Control (OFAC)
- NIST 800-171 (Controlled Unclassified Information)
- DFARS 252.204-7012 (Cybersecurity)
Compliance Objectives
- Visitor screening against sanctions lists
- Audit-grade compliance documentation
- Data retention for regulatory requirements
- Secure handling of controlled information
- Incident reporting and breach notification
ITAR/EAR Compliance Requirements
ITAR Compliance (22 CFR 120-130)
EAR Compliance (15 CFR 730-774)
Critical Requirements
- All visitor screening results must be retained for audit purposes
- Organizations must implement their own compliance training programs
- Regular compliance audits and assessments are required
- Incident reporting to relevant authorities within required timeframes
- Data encryption and secure storage for all visitor information
OFAC Sanctions Screening
Screening Databases
Screening Process
NIST 800-171 Compliance
SecurePoint USA VMS implements NIST 800-171 controls for handling Controlled Unclassified Information (CUI) in visitor management and screening processes.
Security Controls Implemented
Data Protection Measures
- AES-256 encryption for data at rest
- TLS 1.3 encryption for data in transit
- Multi-factor authentication (MFA) required
- Role-based access controls (RBAC)
- Immutable audit logging
- Regular security assessments
- Incident response procedures
- Data backup and recovery systems
Audit and Documentation Requirements
Required Documentation
- Visitor screening records and results
- Access logs and authentication records
- Data processing and storage logs
- Incident reports and breach notifications
- Compliance training records
- System configuration and change logs
- Vendor security assessments
- Regular compliance audit reports
Retention Periods
Audit Access Rights
Authorized regulatory auditors, compliance officers, and legal counsel have the right to access all compliance documentation, audit logs, and system configurations during scheduled compliance audits or incident investigations. Advance notice of 5 business days is typically required for non-emergency audits.
Liability and Indemnification
Service Provider Limitations
SecurePoint USA provides screening tools and compliance infrastructure. Organizations remain solely responsible for:
- Implementing appropriate compliance policies
- Training personnel on regulatory requirements
- Interpreting screening results and taking action
- Maintaining required licenses and authorizations
- Reporting to regulatory authorities
Organization Responsibilities
Organizations must maintain their own compliance programs including:
- Regular compliance training and certification
- Internal audit and monitoring procedures
- Incident response and reporting protocols
- Legal review of compliance policies
- Regular updates to reflect regulatory changes
Important Notice
This agreement does not constitute legal advice. Organizations should consult with qualified legal counsel specializing in export control regulations to ensure full compliance with applicable laws.
Agreement Termination
Termination Procedures
- 30 days written notice required for voluntary termination
- Immediate termination possible for compliance violations
- Data retention requirements continue post-termination
- Audit access rights maintained for required periods
- Confidentiality obligations continue indefinitely
Post-Termination Requirements
Compliance Contact Information
Compliance Officer
Email: compliance@securepointusa.com
Phone: +1 (888) 301-5181
Response Time: Within 24 hours
Legal Department
Email: legal@securepointusa.com
Emergency: security@securepointusa.com
Response Time: Within 5 business days