EXPORT CONTROL COMPLIANCE PROGRAM STANDARD OPERATING PROCEDURES The purpose of this document is to outline specific procedures for the University of Massachusetts Lowell (UML) Departments that are involved in export control compliance. Various departments work closely together to coordinate review and oversight of export-controlled activities. The Departments and processes involved are outlined here to identify responsibilities for each department, identify activities that must be reviewed, describe the information necessary for review, how reviews are conducted, how clearance is documented, and to insure the supporting documentation is on file for each action. The UML reporting structure is diagrammed below for the Departments involved in export control compliance at UML. It is the policy of UML to comply fully with the U.S. export control laws and regulations. The UML administration (Chancellor, Vice-Chancellors, Provost, Vice-Provosts, Deans, Chairs, and Center Directors) supports and provides oversight to the Office of Institutional Compliance, which is charged with implementing the Export Control Compliance Program at UML. Reporting Structure and Departments Involved in Export Compliance

Att 2 UML Export Control SOPs 7 29 10

1

Export Control Compliance Organizational Chart

Chancellor

Executive Vice Chancellor

Compliance Oversight Committee

Vice Chancellor Administration, Finance, Facilities,

Provost

Assoc. Vice Chancellor for Financial Services

Special Assistant, International Partnerships

Human Resources

Vice Provost for Research

International Students and Scholars Office

Institutional Compliance (Export Controls)

Grant Accounting

Pre-Award and Grants & Contracts (ORA)

Information Technology

Commercial Ventures and Intellectual

Facilities

EHS

Campus Police

Purchasing, Accounts Payable, Travel, Shipping &

Att 2 UML Export Control SOPs 7 29 10

2

Deans

Chairs

Faculty

Export Licensing Organizational Chart

University of Massachusetts President

Senior Vice President for Academic Affairs, Student Affairs and International Relations

UML Export Control Compliance Oversight Committee

Empowered Officials (Vice Provost for Research and Director of Institutional Compliance)

Att 2 UML Export Control SOPs 7 29 10

3

EXPORT CONTROL COMPLIANCE PRACTICES Vetting Processes Vetting transactions may be necessary for various activities including but not limited to research grants and contracts, research services agreements, international travel or collaborations, hiring foreign nationals, adding sponsors or vendors, making physical exports. To determine how the regulations may apply and to vet each transaction appropriately, specific information is required such as name of the person or entity and institution with which they are affiliated. The researcher should provide as much of this information as possible and provide it to the OIC to facilitate the vetting process. This information helps determine whether a request for jurisdiction and/or classification is necessary, export exceptions or exemptions apply, a license application needs to be filed, sanctions or embargoes apply, or whether a physical export can be made to the parties of the transaction. The OIC uses the Attus Technologies Watchdog Pro software for vetting. All parties to the transaction are checked against the lists (compiled by the software) from the Treasury, Commerce, and State Department. The process helps to identify whether a license is required. A license application may take up to six months. Record Keeping UML must comply with the various record keeping requirements of the EAR and ITAR and related laws and regulations. This is generally (and preferably) done by providing documents to the OIC, but in some instances includes keeping documents locally and providing copies to OIC. For example, the International Students and Scholars Office maintains all SEVIS program records, Purchasing maintains all records of vendor screens. The export control records that are retained and secured include any licenses, license applications, policies, manuals, forms and guidelines, memoranda, notes, correspondence, screens, contracts, invoices and other financial records, shipping documents including bills of lading and Shipper’s Export Declarations and Automated Export System (AES) records, records submitted to OIC for vetting including exclusion and exemption analyses, certificates, audit/review check sheets and reports, and the export control clearance form. Training records are also retained by OIC and include sign-in sheets signed by persons attending, date and location of training, speakers, and the subjects covered. Records are maintained for a period of five years from the expiration date of the authorization or date an exemption is claimed. Thereafter, the records shall be discarded consistent with the UML record retention policy. Technology Control Plans (TCP) The purpose of a TCP is to outline procedures used by UML for the protection of information and material identified under applicable federal directives governing the export of critical technology that may be received or developed in the course of performance of activities that are subject to export controls. Technology Control Plans (TCPs) must be developed and submitted for review and approval by OIC of any research that involves export controlled items, technology or data. The purpose is to identify authorized personnel and develop a physical and IT security plan to protect and control information from access by unauthorized persons. Once the TCP is in effect, no personnel can be added to that project or facility without the prior approval of the OIC.

Att 2 UML Export Control SOPs 7 29 10

4

TCPs are used to prevent deemed exports and to establish the security plan for projects subject to an export license. The TCP shall include a plan for carrying out the research in a controlled environment. A TCP template is available at www.uml.edu/ora/institutionalcompliance. There are six required elements of a TCP:  Commitment  Physical Security  Information Security  Personnel Screening  Training and Awareness  Self-Evaluation Additional information includes the researcher's contact information, the location covered by the TCP, personnel who will have access to the material, sponsor and contract agreement information. The OIC will assist researchers with completion of the TCP and both the PI and the Director of Institutional Compliance signs the TCP Certification form when it is finalized. The TCP will also establish what controls will continue upon completion of the project. Once a PI has a TCP in place for his/her office or laboratory, all immigration sponsor letters and all foreign visitors invited by that PI must be screened by the OIC. If it relates to a sponsored program, ORA is then notified that the TCP is completed and at that time resources are released to the researcher. OIC conducts periodic audits to evaluate the effectiveness of the TCP and make recommendations if necessary.

Att 2 UML Export Control SOPs 7 29 10

5

DEFENSE TRADE FUNCTIONS Consistent with its tax-exempt educational, research and service mission, UML strives to operate its activities under the fundamental research exclusion, the educational information exclusion and the publicly available/public domain exclusion. Exceptions from this primary focus arise in the course of Federal government contracting with United States military and defense agencies and subcontracts under such procurement contracts. In the context of these projects, UML conducts research and research services which result solely in fabrication of articles for experimental or scientific purposes, including research and development. In the course of these projects, at some time, an actual defense article may be manufactured by UML that would constitute a defense trade function. There are no projects at UML that fall in this category. Relatedly, there are no re-exports/retransfers of ITAR controlled items or technical data to monitor or track.

Att 2 UML Export Control SOPs 7 29 10

6

IDENTIFICATION, RECEIPT AND TRACKING OF ITAR CONTROLLED ITEMS AND PROJECTS Several groups are involved in the identification of and accounting for ITAR controlled items and technical data manufactured or received by UML. ITAR Controlled Items and Technical Data A TCP is required as a means for tracking and monitoring compliance when projects involving ITAR controlled items, including technical data, are identified. A TCP would be required to cover a U.S. origin defense articles and related technical data received by UML. Further, the Director of the OIC is responsible for record keeping of all projects in which defense articles are manufactured. A TCP would also be created to cover any chemical or biological agents covered under USML Category XIV. The TCP would also be used, if needed, to support a deemed export license application with the Department of State. The OIC relies on identification of these projects by the Office of Research Administration (ORA) as soon as ORA becomes aware of those projects during its review of research proposals and scopes of work. In particular, proposed Federal government contracts with United States military and defense agencies and subcontracts under such procurement contracts are closely scrutinized to identify any ITAR controlled items and technical data. UML has a policy against acceptance of projects involving actual receipt of defense articles. There are no projects currently at UML which involve the manufacture or export of defense articles. There is one project at UML covered under the National Industrial Security Program Operating Manual. The Director of OIC is the Facility Security Officer for this project.

Att 2 UML Export Control SOPs 7 29 10

7

STANDARD OPERATING PROCEDURES BY ACTIVITY Compliance Oversight Committee The Compliance Oversight Committee consists of the Provost, Vice Chancellor for Administration and Finance, Facilities, and Technology (VCAF), Vice Provost for Research (VPR), Director of OIC, Assistant Comptroller-Grants Accounting, Proposal Development Manager, Director EHS, and Office of General Counsel representative. This committee is responsible for administrative coordination and oversight of export control matters, including developing and implementing the export compliance program, including the UML guidelines and the Export Compliance Program Standard Operating Procedures. Also, the Committee is responsible for investigating and notifying the appropriate government agency of known violations. Export Control Compliance Program Management by OIC 1) Institutional oversight of OIC is provided by the Vice Provost for Research (VPR) at UML. 2) The Office of Institutional Compliance (OIC) develops and implements the Export Control Compliance program and coordinates additions, deletions or changes to the guidelines and procedures. 3) Identifies areas that are impacted by export control regulations and develops control procedures to ensure UML is in compliance 4) Proposes and recommends process and procedural for review and approval by the Compliance Oversight Committee. 5) Informs UML administration, faculty, and staff about export control regulations, responsibilities, regulatory changes, and UML procedures through training and outreach activities 6) Maintains records for export control training and exports 7) Assists PIs, researchers, and faculty when research or research results are export controlled and helps determine the jurisdiction and classification 8) Oversees all controlled projects and conducts periodic audits 9) Seeks legal or consulting assistance if uncertain about jurisdiction, classification, license exemptions or exceptions, or license applications 10) Evaluates activities that may invoke EAR and ITAR regulations 11) Works with other UML departments to develop and refine export-related procedures 12) Works closely with ORA and Commercial Ventures and Intellectual Property (CVIP) to evaluate export controlled activities in a timely manner 13) Works with PIs, researchers, and faculty to develop TCPs for export-controlled projects 14) Reviews requests for shipping items or materials outside of the U.S. and provides support for license applications as necessary. 15) Vets all international travel and shipments and foreign vendors, and sponsors for UML departments, faculty, and staff.

Att 2 UML Export Control SOPs 7 29 10

8

Sponsored Research Grants and Contracts Review The Office of Research Administration (ORA) is the UML office to receive agreements, grants, and contracts. ORA personnel conduct the initial reviews and have oversight and approval authority for all grants and solicitations, proposals, and awards. 1) An initial review of the terms and conditions of each agreement is conducted by the Proposal Development Manager to determine whether (a) a foreign sponsor is involved or any shipments are to be made outside of the U.S., (b) there are restrictions on participation of foreign nationals, (c) there are restrictions on publication and dissemination of research results, (d) the sponsor will be providing export controlled technology, information, or materials as part of the agreement, or (e) the proposed work is testing or manufacturing rather than research. ORA consults the various lists of “Troublesome Clauses” and other guides in making its assessments. 2) In particular, proposed Federal government contracts with United States military and defense agencies and subcontracts under such procurement contracts are closely scrutinized to identify any ITAR controlled items and technical data. For all STTRs and SBIRs awards sponsored by military and defense agencies, a copy of the prime contract flow downs are requested of all awardee companies. 3) If any restrictions are identified, the sponsor is contacted by the Proposal Development Manager to negotiate restrictions out of the agreement to preserve the Fundamental Research Exclusion. If the restrictions can be negotiated out, the review is complete and ORA accepts the award. 4) The Vice Provost for Research Office (VPRO) maintains a Proposal Tracking Sheet used to track and document all proposals, awards, grants, and contracts requiring compliance reviews. 5) If the restrictions cannot be negotiated out, that project is added by ORA to the VPRO Proposal Tracking spreadsheet to notify OIC that the project requires export control review. ORA also sends to OIC copies of all pertinent emails and other communications with the sponsor and any funding agency regarding language negotiations and any information regarding jurisdiction or classification of the items, materials or technology at issue. 6) OIC contacts the sponsor, the funding agency and/or PI, as needed. OIC may request that the PI complete the Export Control Checklist. 7) If it is determined that the project is export controlled and restrictions apply, the request is forwarded to the Vice Provost for Research (VPR) to consider whether the award can be approved in accordance with University policy on openness in research. 8) If the VPR does not approve the project with restrictions, then the award is declined. If the VPR approves accepting work with restrictions, ORA and OIC are notified. 9) OIC contacts the faculty member to develop a Technology Control Plan (TCP) or inform them of the need to apply for a deemed export license, if applicable. For TCP development, Information Technology (IT) is consulted for recommendations on IT security. For license applications, OIC prepares materials with the cooperation of the PI and submits the required information to the appropriate licensing agency.

Att 2 UML Export Control SOPs 7 29 10

9

10) OIC completes its Export Control Compliance Clearance Form indicating all of the actions taken. The completed form and all emails and other notes and communications relating to the OIC review is maintained as a record of the case, with numerical file number assigned to it which tracks the project proposal number. 11) ORA is notified upon either completion of the TCP or whether a license application will be filed. When the TCP is completed, ORA is notified that the agreement may be finalized. If a license application is filed, ORA is notified that there may be a time lag of up to 6 months before approval. 12) When all export control issues are identified and appropriate action completed, ORA then finalizes the contract/agreement and issues a notice of award to the PI. 13) The project identification field for export controlled projects is coded 'RES' after the project number so that financial managers can easily recognize that special terms and conditions apply to the award. The letter generated to notify the PI of the award also includes a statement to indicate that "Restrictions Apply," as a further reminder to the PI and the administrative staff. Once the TCP is in effect, no personnel can be added to that project or facility without the prior approval of the OIC. 14) While a PI has a TCP in place for his/her office or laboratory, all immigration sponsor letters and all foreign visitors invited by that PI must be screened by the OIC. The TCP will also establish what controls will continue upon completion of the project. 15) OIC maintains the records for all actions related to export control regulations for sponsored projects. Research Services Agreements Research service agreements are agreement for provision of research related analytical and similar services by UML to support research activities, including serving as a recharge center, consistent with its tax exempt research and educational activities. These agreements in many instances do not meet the fundamental research exclusion because they are typically specific projects conducted for companies with no intent to publish the results. Many projects, however, rely on the use of publicly available techniques and processes that are not export controlled. 1) Research services agreements are submitted to ORA with a statement of work and a purchase order. If there is any question as to the nature of the work and whether it is export controlled, ORA sends the information to OIC for review. 2) The VPRO Proposal Tracking spreadsheet is updated by ORA to notify OIC that a new project requires export control review. 3) For projects that use only standard testing methods, these have been determined to be in the public domain and are not subject to the EAR. The researcher must specify the standard used (for example, ASTM or ANSI) and the specific testing method followed to complete the work. If the project has been previously reviewed and approved by OIC, then ORA checks the spreadsheet of previously approved projects and can proceed with accepting the terms of the agreement if it follows the same methods. If the project is different and the same type of work

Att 2 UML Export Control SOPs 7 29 10

10

has not been previously approved by OIC, these projects are then forwarded to OIC for full review. 4) OIC contacts the PI and/or sponsor for more information. If useful for its analysis, PIs are asked to complete the PI Research Services Agreement Export Control Checklist. To avoid delays, PIs should include as much detail in the scope of work as possible including the purpose of the work conducted, methods used, a description of materials provided to UML to complete the work, and deliverables upon conclusion of the project. 5) If the PI does not have information about the materials to be used or provided, then OIC will contact the sponsor and request that they complete the Supplier Classification Request form. Clarification about the applicability of export control regulations will be discussed and documentation kept on file to verify the decision. 6) The VPRO Proposal Tracking spreadsheet is updated by OIC to indicate when the project may proceed or if there are any restrictions that apply. OIC notifies ORA by email of any change in status. No activities may begin until OIC clearance is acquired. In some cases, UML may decline to accept the project. 7) If the project is accepted but identified as being restricted, OIC completes an Export Compliance Clearance Form and completes a TCP or export license application process, as applicable. Materials Transfers and Confidentiality Agreements 1) CVIP is the UML technology transfer office. It is responsible for negotiating materials transfer agreements on behalf of faculty. All materials transfer agreements with foreign persons are referred to OIC for export control analysis, review and approval. 2) CVIP refers PIs to EHS for materials transfers that may involve a proposed transfer of biological agents, chemicals and other hazardous materials for approval and shipping instructions. 3) The Vice Provost for Research Office (VPRO) maintains a Proposal Tracking Sheet used to track and document all agreements requiring compliance reviews. CVIP notifies OIC of the need for review by adding the proposed foreign project to the Proposal Tracking Sheet. 4) From time to time, CVIP is asked to negotiate a confidentiality agreement on behalf of faculty and the agreement contains non-standard export control provisions or other “red flags.” In this instance, the proposed confidentiality agreement is referred to OIC for export control analysis, review and approval, using the Proposal Tracking Sheet process. Physical Exports 1) Members of the UML community and shipping and receiving personnel in the Purchasing Department forward requests for international shipments to OIC. 2) Once all of the information is provided to OIC on the 'Request to Ship Materials Outside of the U.S.' form, a determination can be made as to next steps.

Att 2 UML Export Control SOPs 7 29 10

11

3) OIC works with the researcher to get details as necessary and to determine the nature of the materials being shipped, purpose of the shipment, and if any exceptions apply. 4) After review and approval by OIC, an Export Control Clearance Form is sent to the Shipping and Receiving Office indicating whether the item is cleared for shipment, appropriate ECCN and license exception, or if a license is required. 5) When an item is cleared to ship, it is recommended that shipments are sent using a freight forwarder with a letter of engagement on file with UML. This is necessary to ensure that the forwarder is acting on behalf of UML and agrees to follow all U.S. export regulations. If any question arises about a shipment, they are instructed to hold the shipment until information is verified with the appropriate UML contact. Terms the freight forwarder must agree to include filing with the Census Bureau's Automated Export System (AES), providing an International Transport Association License number, compliance with customs regulations for destination countries, preparing and filing bills of lading, and other routing documents as appropriate. 6) If a license if required, the Director of OIC is authorized to submit the license application. New Hires The Human Resources (HR) Department provides a report to OIC with the names, title, and department of all new hires to support OIC’s efforts to contact new employees for export control training. Employee Contracts Contractual agreement forms (Teaching Assistantship/Research Assistantship and Temporary Employee Contract forms) include language to remind the hiring authority that if the person is to work on an export controlled project, then restrictions on who may work on it may apply. If the hiring authority indicates that restricted projects are involved, OIC is notified to screen the proposed personnel and confirm the hire is in accordance with the applicable TCP and/or export license. OIC must issue an Export Compliance Clearance Form before the proposed contract can be initiated. Citizenship Verifications The Assistant Director of HR or the HR Specialist provides citizenship and nationality information to the OIC when needed to authorize personnel to work on projects. OIC is authorized to have access to HR personnel files to support applications for security clearances. International Exchange Programs 1) International partnerships and collaborations are encouraged and developed to support the exchange of ideas between faculty and students and expand educational and research opportunities. These collaborations are formalized with foreign institutions through a Memorandum of Understanding between the interested parties.

Att 2 UML Export Control SOPs 7 29 10

12

2) The MOU template includes a statement to indicate that activities and exchange of information will meet all U.S. export control laws and regulations. Processing Sponsor Letters 1) The International Students and Scholars Office (ISSO) interfaces with international students, faculty, and visitors to UML and processes visa applications for international students and scholars. In doing so, ISSO works under the presumption that persons holding valid U.S. visas have been cleared by the U.S. Citizenship and Immigration Services (USCIS). ISSO also carries out UML’s obligations under the SEVIS program of the Department of Homeland Security. 2) For Principal Investigators who intend to issue a sponsor letter on behalf of a foreign person, the Dean of the College must approve any letters before they are sent. If the sponsor letter involves (1) a high risk discipline, or (2) anyone from Country Groups D or E, it must be forwarded to the Director of Institutional Compliance for vetting and approval. The Director will consult with the Dean, as needed, in making a determination. The sponsor letter must be accompanied by the foreign person’s resume and a copy of his/her recent publication abstracts. 3) ISSO personnel are provided with a list of the high risk disciplines and the list of Country Group D and E Countries. Before processing any Form A, ISSO reviews these lists to determine whether the Form A and sponsor letter should be accompanied by the OIC Export Compliance Clearance Form. If not, ISSO informs OIC to conduct such review. 4) Once the review is complete, OIC issues an Export Compliance Clearance Form to the ISSO, PI, and Dean indicating approval or denial or other conditions. 5) The PI is responsible to document activities of all sponsored foreign visitors and be able to provide records to verify such activities upon request. 6) The OIC approval is required for all sponsor letters for a PI working on a project which has a TCP in place. International Short-Term Visitors 1) The Special Assistant to International Partnerships is under the direction of the Provost and helps to coordinate speakers and other temporary visits as part of the UML international relations activities (short of activities requiring a sponsor letter or visa application). 2) Before their arrival at UML, the following information will be provided to the OIC by means of the Short-term International Visit Request Form for vetting and approval to bring visitors from country group D or E countries to UML: (i) legal name (as shown on legal credentials, e.g., passport, license, diploma); (ii) physical address (no post office boxes) and country; (iii) date of the visit and location (name of PI, department or center); (iv) purpose of the visit with a complete description of activities to be conducted at UML. 3) In addition, any persons hosting any foreign visitors to whom a payment may be due as a speaking fee or other reason, need to work with the Accounts Payable Office to screen for payment authorization.

Att 2 UML Export Control SOPs 7 29 10

13

International Travel 1) Travel Authorizations (TAs) for UML-related travel should be submitted for approval at least 10 business days before travel begins. This applies to all international travel that is sponsored by, funded in any part by, or involves the granting of degree credits by UML, including travel under sponsored programs. Some countries (Country Group D or E) may also have travel restrictions or sanctions and may require a license. Part B of the TA should clearly describe the persons and countries visited and the specific purpose of the trip. 2) Travelers that intend to take computers, equipment or software out of the U.S. should also complete a request for either Annual certification for Travel with UML Issued Computer or a Request to Ship Materials out of the U.S. form. 3) Annual certification letters are valid for one year and verify that the traveler understands that no technological data, controlled or sensitive information is on the computer, it does not contain any encryption source code or software, and it will be under the travelers control for the duration of the visit. 4) For travel to embargoed or sanctioned countries, additional restrictions and approvals may be necessary. 5) For TAs submitted directly to the Travel Accountant, he/she is instructed how to check the TA against the EAR Country Groups D and E list. If travel is indicated to one of those countries, and OIC has not issued a clearance form, then the information is forwarded to OIC for review. 6) After OIC has reviewed and vetted the information provided, the Export Control Clearance Forms are returned to the traveler and Travel Accountant to indicate the action taken and to either proceed with the travel request or deny it. OIC maintains the copy of the Clearance Forms as a record of the travel authorization. Environmental Health and Safety and Research with Controlled Chemical, Biological and Radiological Agents and Products Research with controlled chemicals and biological agents has been identified to be one of the high risk areas for concern and focus for export control compliance. The Environmental Health and Safety (EHS) Office and Radiation Safety oversee activities involving the use of controlled chemicals, biological agents, and radiological materials on campus. The EHS program is under the Environmental and Emergency Management Office who reports to the Executive Director of Facilities. The Radiation Safety Office reports to the Provost. EHS maintains a biological and chemical inventory database that identifies the name of products and materials, quantity of products and materials, purchaser, location where such products and materials are stored and used on campus. All chemical, biological and radiological purchase requisitions must be reviewed and approved by EHS and Radiation Safety staff members prior to purchase and delivery onto campus. All deliveries of such materials are received at the EHS Hazardous Materials Receiving Stockroom. Upon arrival, all inventory is bar coded by EHS for tracking purposes before the materials are distributed to the user. As an important

Att 2 UML Export Control SOPs 7 29 10

14

precautionary measure, no persons can purchase chemicals using UML procard and all chemical purchases and disposal is subject to EHS review and approval. Before any materials can be shipped outside of the U.S., the person intending to ship the materials must submit a Request to Export Materials Out of the U.S. form to the Office of Institutional Compliance (OIC). After review and approval, an Export Compliance Clearance form is issued by OIC to the requester and a copy of the clearance is sent to EHS. The export of any controlled material is coordinated with the EHS Hazardous Materials Receiving Stockroom, or through the Radiation Safety Department. EHS and Radiation Safety have developed guidance documents including Bio-Safety, Laboratory Safety, and Radiation Safety Manuals for additional information. EHS is represented on the Institutional Biosafety Committee, charged with overseeing the registration of all biological materials and controlled substances to insure that UML Staff are aware of activities involving controlled materials. EHS and Radiation Safety commonly assists faculty and staff in developing working procedures for BSL2 or 2+ commodities, chemicals and other hazardous materials used at UML. PIs and Lab Managers working with EAR or ITAR controlled materials and data, including those working under the exempt quantities exemption of the CDC and APHIS regulations, receive export control training from OIC. EHS is briefed by OIC as to controlled materials on the Commerce Control List and the U.S. Munitions List. EHS and OIC coordinate annual training to insure export control regulatory requirements are adhered to in regards to exports of any chemical, biological and radiological materials controlled for export under EAR (covered by ECCNs IC351354, IC360, IE351), ITAR (USML Category XIV) and IATA dangerous goods regulations. Large Equipment Purchases 1) In the procurement process, the Purchasing Department asks the vendor to provide the ECCN or USML category, if known, for equipment purchases above $75,000. This information is requested on the standard form of purchase order. 2) This information, if received, is communicated to the PI or manager initiating the procurement for record keeping and ensuring appropriate use and control of the purchased equipment. 3) The Purchasing Department consults with OIC if there are any unusual export control provisions or other “red flags” in any equipment purchase or lease agreement. Sponsors and Vendors 1) New sponsors are forwarded by ORA to OIC for vetting before being added to the PeopleSoft sponsor database. OIC vets the information using Attus Watchdog Pro for embargoed and sanctioned persons and countries using the OFAC, BXA and EPLS databases. Every calendar quarter the entire sponsor list is screened again to ensure there has been no change in sponsor status.

Att 2 UML Export Control SOPs 7 29 10

15

2) New vendors are entered by the Accounts Payable Office within the Purchasing Department. Proposed vendors are screened against the lists of embargoed and sanctioned persons and countries using the Attus Watchdog Pro OFAC, BXA and EPLS databases before being added to the PeopleSoft vendor database and maintains all records of vendor screens. Before a check is issued for payment by the University Treasurer’s Office, that vendor is screened again. If there is a potential match, the payment is put on hold until the vendor can be researched and cleared for payment. Information Technology (IT) 1) Provides oversight for UML data security, electronic mail and computer policies. 2) IT is responsible for developing and maintaining an effective information technology security plan for UML. 3) IT also provides technical assistance and guidance for IT security plans required for projects under a TCP. 4) Members of IT are members of the InfraGard organization and otherwise are well-versed and aware of best practices in information security. Cooperative Agreements 1) Cooperative agreements are implemented by the Career Services Office with the purpose of developing partnerships with companies in order to expand the educational experience for students and to place students with various types of industries for internships. 2) Export control language is included in the contract template so companies that enter into cooperative agreements with UML are notified that it is their responsibility to meet export control laws and regulations for activities conducted under the agreement on their premises.

Att 2 UML Export Control SOPs 7 29 10

16