Export control and defense cybersecurity: compliance guide for SMEs

ITAR regulates US defense exports — any French company using USML-listed components is subject to it, even as a Tier 3 subcontractor. Violations carry up to $1M per infraction. EAR covers dual-use goods on the CCL (Commerce Control List). EU Regulation 2021/821 governs dual-use exports in Europe, with the French SBDU issuing licenses. SMEs must classify products (USML/CCL/ML), screen end-users, and maintain compliance documentation.

IGI 1300 sets classified information protection rules for IT systems: system accreditation, ANSSI-approved encryption, access logging, network separation (air gap for TS), annual penetration testing. SecNumCloud is ANSSI's cloud security qualification — increasingly required for sensitive defense data hosting. The PSSI (IT Security Policy) is mandatory for any classified contract, covering risk analysis (EBIOS RM), technical measures, incident management, and cyber training.

Implement an ICP (Internal Compliance Program) covering: management-signed policy, compliance officer, screening procedures, product classification, license management, staff training, annual audit. For cybersecurity, develop a PSSI with asset mapping, EBIOS RM risk analysis, and obtain SI accreditation before contract execution (3-6 months lead time).