Export Controlled Information Governance
Understand your information. Establish its regulatory context. Connect that knowledge to the controls governing its use.
Export Controlled Information (ECI) resides across engineering applications, repositories, business systems, and collaboration environments. Governing it requires understanding what the information contains, where it resides, who can reach it, and which conditions govern the proposed activity.
TC Engine helps organizations establish the definitions, information models, workflows, and integrations needed to identify, classify, safeguard, and compliantly release ECI.
We work alongside your Export Controls, Legal, IT, Cybersecurity, Engineering, and Data Governance teams to develop capabilities within your environment.
What Is Export Controlled Information Governance?
ECI governance connects regulatory determinations to the operational management of information.
It establishes how information is assessed, how its status and classification are represented, who maintains those determinations, and how systems use them to govern location, access, transfer, and subsequent activity.
ECI provides a country- and jurisdiction-agnostic descriptor. The applicable regulatory definitions and requirements remain the basis for determining what is controlled and how it must be handled.
An engagement can begin with one repository, workflow, or information population and extend through discovery, classification, integration, and implementation.
Start with the Questions Your Teams Need to Answer
Common starting points include:
- Which repositories contain known or suspected ECI?
- Can broadly populated groups access controlled information?
- What evidence supports existing labels and classifications?
- Where is information stored, processed, replicated, or accessed?
- Which identity and authorization facts are needed to evaluate access?
- How should ECI governance apply to search, retrieval, and AI workflows?
- What happens when a classification, authorization, or user attribute changes?
We define the information population, relevant activities, available evidence, and intended outcomes before beginning the work.
Establish a Shared Definition of ECI
Consistent identification begins with an ECI Definition Standard.
We help your specialists establish an operational definition grounded in applicable regulations. The standard addresses scope, exclusions, evidence requirements, uncertainty, review responsibilities, and handling following identification.
It also distinguishes indicators from determinations.
A marking, document type, technical term, or product reference may warrant further assessment. Its presence or absence does not settle the information’s regulatory status.
The standard gives employees, reviewers, and automated systems a common basis for evaluating information and resolving ambiguous cases.
Make Determinations Usable Across Systems
An ECI Identification Standard establishes how assessment results and their regulatory context are represented and exchanged.
The model can address:
| Information element |
What it communicates |
| Assessment status |
Whether ECI is present, absent within the assessed scope, or unresolved. |
| Applicable authority and regime |
Which governing export requirements apply. |
| Export classification |
The supported control entry or designation under each applicable regime. |
| Object binding |
The information object, content version, or defined scope covered by the determination. |
| Evidence and approval |
The sources, reasoning, reviewer, and approval supporting the result. |
| Lifecycle |
Effective dates, review requirements, revisions, and superseded determinations. |
The model should accommodate multiple regulatory profiles where applicable and preserve uncertainty explicitly.
Coarse-grained identification can support initial safeguarding while finer classification remains under review. Compliant-release evaluation requires sufficient detail to assess the relevant authorization conditions.
Discover and Assess Information
We help design and implement discovery workflows suited to your repositories and information types.
Depending on scope, the work can include content extraction, marking detection, metadata analysis, product-reference association, and review of existing determinations.
Discovery results distinguish among confirmed findings, indicators requiring review, and content that could not be adequately assessed.
Representative validation helps establish performance, review workload, and limitations before expanding to larger populations. Qualified reviewers adjudicate unresolved cases, and their decisions become evidence for improving the process.
Connect Information to Product and Engineering Context
Information classification often depends on understanding the hardware, equipment, materials, or software to which it relates.
We help establish those relationships using product references, part numbers, program information, engineering records, and supported classifications.
A product classification supplies relevant context. The information’s content and applicable criteria still determine its own treatment.
Connecting these records reduces isolated tagging work and creates opportunities for reusable classification rules across supported information populations.
Bind the Determination to the Information
The identity of an information object and its regulatory determination serve different purposes.
For files, a content hash can associate a determination with a specific content version. The supporting record can maintain classification profiles, evidence, approval, and revision history. Repository location, custody, and access context remain separately managed information.
This supports externally maintained records alongside human-readable markings and embedded metadata where appropriate.
A classification can change while file content remains unchanged. The design should make the current approved determination available to consuming systems while retaining the history needed to explain earlier decisions.
Connect Governance to Operational Controls
Identification and classification supply facts that workflows and controls need.
Where included in scope, we connect approved ECI attributes to identity, location, authorization, and policy services. Those connections can support repository access, sharing workflows, review routing, and enforcement at supported application control points.
We assess the role of existing platforms—including Microsoft 365, SharePoint, Entra ID, and Purview—within the broader architecture. Their contribution depends on the available attributes, integrations, and required control behavior.
The objective is to support authorized activity while preventing unauthorized access or release.
Govern Search and AI Workflows
Search and AI capabilities can make information easier to find, combine, and communicate.
We help define governance requirements across source ingestion, indexing, retrieval, processing, and output delivery. The work examines how source classifications and authorization conditions remain associated with the information as it moves through those stages.
Depending on scope, implementation can include filtering, authorization checks, review workflows, and evidence capture.
The design accounts for both the requesting user or agent and the intended recipients of the result.
How We Work
1. Define the Population and Baseline
We agree on repositories, information types, activities, stakeholders, and success measures.
2. Establish Standards and Decision Inputs
We define or refine ECI determination criteria, identification attributes, ownership, and required connections to enterprise records.
3. Validate Representative Information
We test discovery and classification approaches against selected content, examine exceptions, and establish professional review processes.
4. Implement the Agreed Capability
We develop the scoped discovery workflows, records, integrations, policies, and enforcement connections.
5. Maintain and Improve
We establish reassessment triggers, reporting, ownership, and processes for handling changes and unresolved cases.
What You Receive
Deliverables are tailored to the engagement and can include:
- An ECI governance assessment identifying current capabilities, gaps, and dependencies.
- ECI Definition and Identification Standards suited to your regulatory and operating environment.
- Discovery and classification workflows with validation results and review procedures.
- Maintained determination records connecting information objects to evidence, classifications, and approvals.
- Integration designs or implementations connecting governance information to repositories, identity platforms, authorization services, and business workflows.
- A prioritized roadmap and maintenance plan defining responsibilities, next steps, and performance measures.
Measure Coverage and Business Value
Useful measures include assessed repository coverage, unresolved information populations, classification completeness, review effort, and the availability of decision evidence.
We also examine whether the capability reduces repeated research, manual handling, and unnecessary collaboration delays.
Assessment coverage and confirmed ECI findings remain distinct measures so teams can see both what is known and what remains unassessed.
Build Capability Your Team Can Maintain
We work within your environment using approved tools and infrastructure.
Definitions, data models, findings, policies, tests, and engineering work remain in your customer-owned engineering workspace. Your team retains the knowledge needed to maintain the capability and extend it to additional repositories and workflows.
Start with a Defined Information Challenge
Bring a repository with uncertain contents, a collaboration workflow with unclear access conditions, or an AI initiative that needs controlled-information governance.
Together, we will define the evidence, capabilities, and implementation effort needed to move forward.
