Skip to content
Docs
foxborne.comRequest a pilot

Export-controlled evidence

Evidence marked EXPT opens only for people your identity provider asserts are US persons. Everyone else still sees the incident list, without the evidence. The status arrives as a SAML attribute named usPerson.

How-toMarkdown
On this page7

A role says what a person may do in Foxborne. It does not say whether they may receive export-controlled technical data. Foxborne takes that answer from your identity provider, so the people who make the determination keep it.

Evidence marked EXPT, the CUI Registry's category marking for Export Controlled, opens only for users whose identity provider asserts US person status. Foxborne does not decide who is a US person. Your organization does, and your identity provider asserts it.

Before you start#

  • You can change the Foxborne SAML application in your identity provider.
  • Your security office has determined which people using Foxborne are US persons.
  • To check the result, you need the Admin role, which opens Access.

How the control works#

Go to Access and open the Sign-in tab. The Export-controlled evidence panel states the rule: Evidence marked EXPT opens only for users whose identity provider asserts US person status. Everyone else sees the incident list without the evidence.

Status
Enforced, or Off
Attribute
usPerson
Source
SAML attribute from the identity provider

The panel has nothing to edit. The US person column on Members shows what each person's identity provider asserts.

US person columnIncident listEvidence marked EXPT
AssertedShownOpens
Not assertedShownDoes not open

Roles still apply. All five roles hold Inspect original evidence, and US person status narrows that permission for evidence marked EXPT.

Assert US person status#

  1. Confirm the control is enforced

    On Access, Sign-in, check that the Export-controlled evidence panel shows Enforced, the attribute usPerson and the source SAML attribute from the identity provider.

  2. Keep the status in one profile field

    Record each person's US person status in one field of their profile, in the directory your identity provider reads. Your security office owns the determination, and the field carries it.

  3. Add the attribute to the Foxborne application

    In your identity provider, open the SAML application for Foxborne and add an attribute statement named usPerson, filled from that profile field. SAML attribute names are exact strings, so match the name as the panel shows it.

  4. Have people sign in again

    The status travels in the SAML assertion, which your identity provider sends at sign-in. Ask the people concerned to sign out and sign in again.

  5. Check the Members table

    On Members, the US person column reads Asserted for everyone whose assertion carries the status, and Not asserted for everyone else.

Check the result#

  • The Export-controlled evidence panel shows Enforced.
  • The US person column on Members matches your security office's list.
  • A person shown as Asserted opens the evidence on an incident, and the audit log records Viewed evidence for them.

Troubleshoot#

A US person sees the incident list but no evidence. Their US person column reads Not asserted. Check that the Foxborne application sends an attribute named exactly usPerson and that their profile holds the status, then have them sign in again.

Someone shows Asserted but is not a US person. Correct their profile in your identity provider, because the status comes from there. To stop their access at once while you do, use Remove access on Members.

A newly invited person shows Not asserted. No assertion has arrived for them yet. In the example dataset, the invited member who has not signed in shows Not asserted.

The designation indicator on every report and case file carries the CUI category you set, such as EXPT. CUI marking sets it.

On a DoD program, export-controlled technical information also takes a distribution statement and an export control warning. Your security office decides both.

Next#