# Export-controlled evidence

URL: /security/export-control

Evidence marked EXPT opens only for people your identity provider asserts are US persons. Everyone else still sees the incident list, without the evidence. The status arrives as a SAML attribute named usPerson.



A role says what a person may do in Foxborne. It does not say whether they may receive export-controlled technical data. Foxborne takes that answer from your identity provider, so the people who make the determination keep it.

Evidence marked EXPT, the CUI Registry's category marking for Export Controlled, opens only for users whose identity provider asserts US person status. Foxborne does not decide who is a US person. Your organization does, and your identity provider asserts it.

## Before you start [#before-you-start]

* You can change the Foxborne SAML application in your identity provider.
* Your security office has determined which people using Foxborne are US persons.
* To check the result, you need the **Admin** role, which opens **Access**.

## How the control works [#how-the-control-works]

Go to **Access** and open the **Sign-in** tab. The **Export-controlled evidence** panel states the rule: **Evidence marked EXPT opens only for users whose identity provider asserts US person status. Everyone else sees the incident list without the evidence.**

<Fields>
  <Field name="Status">
    Enforced, or Off
  </Field>

  <Field name="Attribute">
    usPerson
  </Field>

  <Field name="Source">
    SAML attribute from the identity provider
  </Field>
</Fields>

The panel has nothing to edit. The **US person** column on **Members** shows what each person's identity provider asserts.

| US person column | Incident list | Evidence marked EXPT |
| ---------------- | ------------- | -------------------- |
| **Asserted**     | Shown         | Opens                |
| **Not asserted** | Shown         | Does not open        |

Roles still apply. All five roles hold **Inspect original evidence**, and US person status narrows that permission for evidence marked EXPT.

## Assert US person status [#assert-us-person-status]

<Steps>
  <Step title="Confirm the control is enforced">
    On **Access**, **Sign-in**, check that the **Export-controlled evidence** panel shows **Enforced**, the attribute `usPerson` and the source **SAML attribute from the identity provider**.
  </Step>

  <Step title="Keep the status in one profile field">
    Record each person's US person status in one field of their profile, in the directory your identity provider reads. Your security office owns the determination, and the field carries it.
  </Step>

  <Step title="Add the attribute to the Foxborne application">
    In your identity provider, open the SAML application for Foxborne and add an attribute statement named `usPerson`, filled from that profile field. SAML attribute names are exact strings, so match the name as the panel shows it.
  </Step>

  <Step title="Have people sign in again">
    The status travels in the SAML assertion, which your identity provider sends at sign-in. Ask the people concerned to sign out and sign in again.
  </Step>

  <Step title="Check the Members table">
    On **Members**, the **US person** column reads **Asserted** for everyone whose assertion carries the status, and **Not asserted** for everyone else.
  </Step>
</Steps>

## Check the result [#check-the-result]

* The **Export-controlled evidence** panel shows **Enforced**.
* The **US person** column on **Members** matches your security office's list.
* A person shown as **Asserted** opens the evidence on an incident, and the audit log records **Viewed evidence** for them.

## Troubleshoot [#troubleshoot]

**A US person sees the incident list but no evidence.** Their **US person** column reads **Not asserted**. Check that the Foxborne application sends an attribute named exactly `usPerson` and that their profile holds the status, then have them sign in again.

**Someone shows Asserted but is not a US person.** Correct their profile in your identity provider, because the status comes from there. To stop their access at once while you do, use **Remove access** on **Members**.

**A newly invited person shows Not asserted.** No assertion has arrived for them yet. In the example dataset, the invited member who has not signed in shows **Not asserted**.

## Related marks [#related-marks]

The designation indicator on every report and case file carries the CUI category you set, such as `EXPT`. [CUI marking](/security/cui-marking) sets it.

On a DoD program, export-controlled technical information also takes a distribution statement and an export control warning. Your security office decides both.

## Next [#next]

* [Single sign-on](/security/sso) connects the identity provider that sends the assertion.
* [Roles and permissions](/security/roles) lists what each role may do before US person status applies.
* [Invite, change and remove access](/security/manage-access) covers the **Members** table.