HP Global Trade
Classification Compliance Supplier’s Declaration
Export Classification Data Collection Form
**** To be completed by the Manufacturer/Supplier of the 3
Party Product ****
Revision and Date
This questionnaire provides information about third
that HP intends to export. This information assists HP’s Global Trade
Classification team to determin
e the proper export classification.
This questionnaire is applicable to third
party manufacturers or
vendors who provide products to HP that HP intends to export.
© Copyright 2013
Packard Development Company, L.P.
This is an uncontrolled copy when in printed form.
The following is a list of questions/requests will help HP collect the needed classification
information for 3rd party products that HP intends to export. Please obtain the following
ation from the 3rd party manufacturer or vendor in order to assist our HP Global Trade
Classification team in determining the proper export classification for each product:
Please respond to the following set of questions for each produc
t. These questions will help to
collect the needed classification information. If the product data is available in an electronic file
please provide a copy or allow access.
Name of Product:
HP Product Number:
Manufacturer/Vendor Product Number:
Contact Name & Phone Number:
Manufacturer Contact Name & Phone Number:
Name and Phone Number of person completing this form:
0. Export Commodity Classification Numbers /Control List numbers (ECCN)
Please confirm with your Export compliance department
if the product is subject to U.S. and/or
other national government export regulations (dual use, military etc.) and insert all control list
numbers applicable for the product:
EU (European Union) ECCN:
Please provide technical specs or a product data sheet or a technical description that
provides a functional overview of the product.
What is the overall design function and characteristics of the produc
Specify the related system software and/or hardware this product will interoperate or
If this product is a module or subcomponent of a higher product, identify this product and
provide the main product number if available.
, is this software available as freeware?
Does this product use cryptography to provide for password protection, authentication,
access control or digital signature of the user?
Does this product contain encryption/decryptio
n for any data privacy purposes, such as for
information security over virtual private network or public networks, or for data storage, etc.?
Does this product contain a cryptographic application program interface (i.e. APIs specially
gned to allow the plug
in or implementation of specific crypto capabilities)?
If software, what type of media is the software loaded on?
___CD/DCD ___ Tape ___ Floppy Disk ___ Electronic Download
____other please explain:
Please provide the
Harmonized Tariff Schedule Number (HTS) used by the manufacturer of
Please provide the Adjusted Peak Performance (APP) for computer based products.
If this product is a 'graphics accelerator' or 'graphics coprocessor', c
lassified under ECCN
please provide the 3D vector rate for the product.
Please provide the US export commodity classification number (ECCN) used by the
manufacturer for the product.
Was this product self
classified or was an official expor
t classification decision obtained from
the US Dept of Commerce?
If an official export classification decision was obtained from the US Dept of Commerce,
please provide a copy of the classification decision documents, or provide the case review
umber and the results of the review including any ‘Comments from Licensing
Officer’ stated on the CCATS document and associated with this product.
Does the product fall under the U.S. Government International Traffic in Arms Regulations
(ITAR), or any oth
er local government regulations which uniquely control the product for
military or encryption reasons?
, please provide the regulatory citation:
Is this product specially designed or intended primarily for military, defense or government
use? If ‘
yes’ please explain.
If this product has been classified for export in any country other than the US please identify
the country, provide the classification, explain the justification/basis for the classification and
provide references to any government i
ssued documents supporting the classification.
If the product is not designed or manufactured in the US then please identify the country
where designed and/or manufactured, and explain what local country export requirements,
export control or export cl
assification applies to this product.
Is this product
specially designed and limited for banking use, financial transaction use or for
money transaction use?
If response was positive for questions 6, 7 or 8 then please answer the remaining
order to provide further details regarding the use of cryptography in the
Please indicate if this product uses cryptography functionality (i.e., incorporates or uses
encryption or decryption code, techniques or a cryptography application progr
interface) for any purpose, including but not limited to access control, user/data
authentication, message/data privacy, data storage security, network communications
security or general purpose use?
If yes please identify all uses of crypto:
e describe in detail the type of data that is encrypted
for example general purpose user
data/files, general user communications, limited financial data, data limited to systems
and/or network management (
Operations, Administration, Maintenance and Provisi
Please provide the following technical details regarding the implementation of cryptography
in the product:
the type of algorithm(s)
where the crypto was sourced from,
method of key management including key size,
identify crypto f
unctions/parameters exposed to applications,
purpose or use of the crypto,
identify if the product contains any cryptographic application programming interfaces
(i.e., APIs specially designed to allow the plug
in or implementation of specific crypto
If the product contains cryptography please indicate if a one
review and French import approval was requested from the French ANSSI (formerly referred
to as DCSSI) agency and provide the results of the review.
product is exempted from the one
time cryptography product review in France please
explain the basis for the exempt status.
Does this product provide: secure Wide Area Network (WAN),
Metropolitan Area Network (MAN), Virtual Private Network (VPN)?
, please answer the following 4 questions:
Is the aggregate encrypted WAN, MAN, VPN or backhaul throughput (includes
communications through wireless network elements such as gateways, mobile switches,
controllers, etc.) greater than 90 Mbps?
Does the wire (line), cable or fiber optic WAN, MAN or VPN single channel input data
rate exceed 154 Mbps?
Does the media (voice/video/data) encryption or centralized
key management support
more than 250 concurrent encrypted data channels, or suppor
t encrypted signaling to more
1,000 endpoints, for digital packet telephony/media (voice/video/data) over internet protocol
Does the air interface coverage (e.g., through base stations, access points to mesh
networks, bridges, e
tc.) exceed 1,000 meters, where any of the following applies?
Maximum data rates exceed 10 Mbps (at operating ranges
beyond 1,000 meters); or
Maximum number of concurrent full duplex voice
channels exceed 30; or
Substantial support is required for installation
26. Is this product generally available to the public by being sold or freely distributed, without
restriction, from stock at retail selling
points such as through over
counter, mail order,
electronic or telephone transactions? If yes, please explain.
27. Can the cryptography
functionality in the product be easily changed by the user?
28. Is the product designed for installation by the use
r without further substantial support by the
29. Import to Russia: Pl
ease indicate if a technical product import review has been done by the
FSB or by a Russian technical laboratory and if a Russian import license has been obtained
from the Mini
stry of Industry and Technology (MIT) or if an import notification request has been
filed with the FSB, and provide the results of any reviews, import license or notification
30. Import to China: If the
product contains cryptography please indi
cate if any China import
license request has been filed with the Chinese government and provide the results of any
China government reviews or import license request?
31. Is this is an open source code product which contains cryptography
and no formal ex
classification decision was obtained from the US
govt (see questions 14 and 15 above)?
If YES, then please:
identify the URL where the source code can be obtained without cost,
confirm if written notification of the internet posting ha
s been sent
to the US Department of
, Bureau of Industry and
Security in accordance with US exports
ADDITIONAL EVALUATION QUESTIONS TO DETERMINE IF PRODUCT IS SUBJECT TO
US GOVT CRYPTOGRAPHY REVIEW
Does the product provide penet
ration capabilities that are capable of attacking, denying,
disrupting or otherwise impairing the use of cyber infrastructure or networks?
Does the product provide or perform vulnerability analysis, network forensics, or
computer forensics functions c
haracterized by any of the following?:
(A) Automated network analysis,
visualization, or packet inspection for profiling
network flow, network user or client behavior, or
network structure/topology and adapting
time to the operating envi
(B) Investigation of data leakage, network
breaches, and other malicious intrusion
through triage of captured digital forensic data for
law enforcement purposes or in a
rigorous evidentiary manner.
Does the prod
uct provide or perform
standard cryptography" as defined below?
Definition of Non
. Means any
of "cryptography" involving the
or use of proprietary or unpublished
functionality, including encryption
or protocols that have not been
or approved by a duly recognized
standards body (e.g., IEEE, IETF,
ISO, ITU, ETSI, 3GPP, TIA, and GSMA) and
have not otherwise been published.
Does the product include encryption source code? If yes please identify the source code
and confirm if the source code is open source or proprietary?
Does the product have any of the following:
Been designed, modified, adapted o
r customized for "government end
Cryptographic functionality that has
been modified or customized to customer
Cryptographic functionality or
"encryption component" that is user
accessible and can
changed by the user;
Encryption commodities and software
that provide functions necessary for quantum
Encryption commodities and software
that have been modified or customized for
computers classified under ECCN 4A003 (high performance comp
Public safety / first responder radio (
Terrestrial Trunked Radio
(TETRA) and/or Association of Public
Communications Officials International
Project 25 (P25) standards);
Can the product be characterized as chips, chipsets
assemblies or a field
programmable logic device?
Can the product be described as cryptographic libraries, modules,
development kits or
toolkits, including for operating syst
ems and cryptographic service providers (CSPs)?
Can the product be described as an application
specific hardware or software
development kit implementing cryptography?
End of Questionnaire
Please send the completed form with requested information to
Brief Description of change
Initial release of reformatted questionnaire dated 31
B , 11