EX-MF880-0112-Oct-2017
HP Global Trade – Classification Compliance Supplier’s Declaration
3rd Party Products – Export Classification Data Collection Form
**** To be completed by the Manufacturer/Supplier of the 3rd Party Product ****
Document Identifier / EX-MF880-01Revision and Date / E. 12-Oct-2017
Abstract / This questionnaire provides information about third-party products that HP intends to export. This information assists HP’s Global Trade Classification team to determine the proper export classification.
Applicability / This questionnaire is applicable to third-party manufacturers or vendors who provide products to HP that HP intends to export.
Status / Approved
© Copyright 2017 HP Development Company, L.P.
This is an uncontrolled copy when in printed form.
1.1Introduction
The following is a list of questions/requests will help HP collect the needed classification information for 3rd party products that HP intends to export. Please obtain the following information from the 3rd party manufacturer or vendor in order to assist our HP Global Trade Classification team in determining the proper export classification for each product:
Product QuestionsPlease respond to the following set of questions for each product. These questions will help to collect the needed classification information. If the product data is available in an electronic file please provide a copy or allow access.
Primary Product Detail(s) and Contact Name(s)
Date:
Name of Product:
HP Product Number:
Manufacturer/Vendor Product Number:
HP Contact Name & Phone Number:
Manufacturer Contact Name & Phone Number: Name and Phone Number of person completing this form:
1.Export Commodity Classification Numbers /Control List numbers (ECCN) and HTS
Please confirm with your Export compliance department if the product is subject to U.S. and/or other national government export regulations (dual use, military etc.) and insert all control list numbers applicable for the product:
U.S. ECCN: [ ]
EU (European Union) ECCN: [ ]
National country______ECCN: [ ]
Please provide the Harmonized Tariff Schedule Number (HTS) used bythe manufacturer of the product: [ ]
2.Please provide technical specs or a product data sheet or a technical description that provides a functional overview of the product.
Note that classifications of steel products (such as, but not limited to, steel fittings for large format printers) imported into the US require a mill analysis or mill test certificate that includes the percentages by weight of carbon and any metallic elements contained in the articles.
3.What is the overall design function and characteristics of the product?
4.Specify the related system software and/or hardware this product will interoperate or interface with.
5.If this product is a module or subcomponent of a higher product, identify this product and provide the main product number if available.
6.If software, is this software available as freeware?___Yes ___No
7.Does this product use cryptography to provide for password protection, authentication, access control or digital signature of the user?___Yes ___No
8.Does this product contain encryption/decryption for any data privacy purposes, such as for information security over virtual private network or public networks, or for data storage, etc.? ___Yes ___No
9.Does this product contain a cryptographic application program interface (i.e. APIs specially designed to allow the plug-in or implementation of specific crypto capabilities)?___Yes ___No
10.If software, what type of media is the software loaded on?
___CD/DCD ___ Tape ___ Floppy Disk ___ Electronic Download____other please explain:
11.Please provide the Harmonized Tariff Schedule Number (HTS) used by the manufacturer of the product.
12.Please provide the Adjusted Peak Performance (APP) for computer based products.
13.If this product is a 'graphics accelerator' or 'graphics coprocessor', classified under ECCN 4A994.g, thenplease provide the 3D vector rate for the product.
14.Please provide the US export commodity classification number (ECCN) used by the manufacturer for the product.
15.Was this product self-classified or was an official export classification decision obtained from the US Dept of Commerce?
16.If an official export classification decision was obtained from the US Dept of Commerce, please provide a copy of the classification decision documents, or provide the case review (CCATS) number and the results of the review including any ‘Comments from Licensing Officer’ stated on the CCATS document and associated with this product.
17.Does the product fall under the U.S. Government International Traffic in Arms Regulations (ITAR), or any other local government regulations which uniquely control the product for military or encryption reasons? If YES, please provide the regulatory citation:
18.Is this product specially designed or intended primarily for military, defense or government use? If ‘yes’ please explain.
19.If this product has been classified for export in any country other than the US please identify the country, provide the classification, explain the justification/basis for the classification and provide references to any government issued documents supporting the classification.
20.If the product was not developed or manufactured in the US then please identify the country where the product was developed and/or manufactured, and explain what local country export requirements, export control and export classification applies to this product.
21.Is this product specially designed and limited for banking use, financial transaction use or for money transaction use?
22.If response was positive for questions 6, 7 or 8 then please answer the remaining questions in order to provide further details regarding the use of cryptography in the product:
23.Please indicate if this product uses cryptography functionality (i.e., incorporates or uses encryption or decryption code, techniques or a cryptography application programming interface) for any purpose, including but not limited to access control, user/data authentication, message/data privacy, data storage security, network communications security or general purpose use?
If yes please identify all uses of crypto:
24.Please describe in detail the type of data that is encrypted for example general purpose user data/files, general user communications, limited financial data, data limited to systems and/or network management (Operations, Administration, Maintenance and Provisioning):
25.Please provide the following technical details regarding the implementation of cryptography in the product:
a)the type of algorithm(s)
b)where the crypto was sourced from,
c)key lengths,
d)method of key management including key size,
e)identify crypto functions/parameters exposed to applications,
f)purpose or use of the crypto,
g)identify if the product contains any cryptographic application programming interfaces (i.e., APIs specially designed to allow the plug-in or implementation of specific crypto capability(ies))
26.If the product contains cryptography please indicate if a one-time cryptography product review and French import approval was requested from the French ANSSI (formerly referred to as DCSSI) agency and provide the results of the review.
27.If this product is exempted from the one-time cryptography product review in France please explain the basis for the exempt status.
28.Does this product provide: secure Wide Area Network (WAN), Metropolitan Area Network (MAN), Virtual Private Network (VPN)?
If YES, please answer the following 4 questions:
a)Is the aggregate encrypted WAN, MAN, VPN or backhaul throughput (includes communications through wireless network elements such as gateways, mobile switches, controllers, etc.) greater than 90 Mbps?
b)Does the wire (line), cable or fiber optic WAN, MAN or VPN single channel input data rate exceed 154 Mbps?
c)Does the media (voice/video/data) encryption or centralized key management support more than 250 concurrent encrypted data channels, or support encrypted signaling to more than
1,000 endpoints, for digital packet telephony/media (voice/video/data) over internet protocol communications?
d)Does the air interface coverage (e.g., through base stations, access points to mesh networks, bridges, etc.) exceed 1,000 meters, where any of the following applies?
- Maximum data rates exceed 10 Mbps (at operating rangesbeyond 1,000 meters); or
- Maximum number of concurrent full duplex voice channels exceed 30; or
- Substantial support is required for installation or use
29.Is this product generally available to the public by being sold or freely distributed, without restriction, from stock at retail selling points such as through over-the-counter, mail order,electronic (e.g. over the Internet) or telephone transactions?
If yes, please respond to the following 6 questions:
a)Please explain/provide examples of how the product is generally available to the public.
b)Can the user easily change the product or cryptography functionality beyond the features of the product? If yes please explain.
c)Is the product designed for installation by the user without further substantial support by the supplier?
d)If requested by a government authority, can details of the product be accessible and provided, to the appropriate government authority in order to ascertain compliance with questions a,b and c above?
e)Is this product of potential interest to a wide range of individuals and/or businesses? If NO please explain.
f)Is the price and information about the main functionality of the product available before purchase without the need to consult the vendor or supplier?
30.Import to Russia: Please indicate if a technical product import review has been done by the FSB or by a Russian technical laboratory and if a Russian import license has been obtained from the Ministry of Industry and Technology (MIT) or if an import notification request has been filed with the FSB, and provide the results of any reviews, import license or notification requests?
31.Import to China: If the product contains cryptography please indicate if any China import license request has been filed with the Chinese government and provide the results of any China government reviews or import license request?
32.Is this is an open source code product which contains cryptographyand no formal export classification decision was obtained from the USgovt (see questions 14 and 15 above)? If YES, then please:
Identify the URL where the source code can be obtained without cost, and
Confirm if written notification of the internet posting has been sent to the US Department of Commerce, Bureau of Industry and Security in accordance with US exports regulations.
1.2Additional Evaluation Questions to Determine if Product is Subject to US Govt Cryptography Review
1.Does the product provide penetration capabilities that are capable of attacking, denying, disrupting or otherwise impairing the use of cyber infrastructure or networks?
2.Does the product provide or perform vulnerability analysis, network forensics, or computer forensics functions characterized by any of the following?:
a)Automated network analysis,visualization, or packet inspection for profilingnetwork flow, network user or client behavior, ornetwork structure/topology and adapting inreal-time to the operating environment; or
b)Investigation of data leakage, networkbreaches, and other malicious intrusion activitiesthrough triage of captured digital forensic data forlaw enforcement purposes or in a similarlyrigorous evidentiary manner.
3.Does the product provide or perform"non-standard cryptography" as defined below?
a)Definition of Non-standard cryptography:
b)Non-standard cryptography. Means any
c)Implementation of "cryptography" involving the
d)Incorporation or use of proprietary or unpublished
e)Cryptographic functionality, including encryption
f)Algorithms or protocols that have not been
g)Adopted or approved by a duly recognized
h)International standards body (e.g., IEEE, IETF,
i)ISO, ITU, ETSI, 3GPP, TIA, and GSMA) and
j)have not otherwise been published.
k)Reserved.
4.Does the product include encryption source code? If yes please identify the source code and confirm if the source code is open source or proprietary?
5.Does the product have any of the following:
a)Been designed, modified, adapted or customized for "government end-user(s)";
b)Cryptographic functionality that hasbeen modified or customized to customerspecification; or
c)Cryptographic functionality or"encryption component" that is user-accessible and can be easilychanged by the user;
d)Encryption commodities and softwarethat provide functions necessary for quantum cryptography;
e)Encryption commodities and softwarethat have been modified or customized for computers classified under ECCN 4A003 (high performance computers);
f)Public safety / first responder radio (e.g. Implementing Terrestrial Trunked Radio(TETRA) and/or Association of Public-SafetyCommunications Officials International (APCO)Project 25 (P25) standards);
g)Cryptanalytic functionality
h)"Open cryptographic interface"
i)Can the product be characterized as chips, chipsets, electronic assemblies or a field programmable logic device?
j)Can the product be described as cryptographic libraries, modules,development kits or toolkits, including for operating systems and cryptographic service providers (CSPs)?
k)Can the product be described as an application-specific hardware or software development kit implementing cryptography?
End of Questionnaire
Please send the completed form with requested information to
Revision History:
Revision,Date,
Change Number / Brief Description of change
- 10-Jan-2007
- 11-Mar-2013, DCN -03163
- 25-Jun-2014
- 11-May-2015
- 12-Oct-2017
Page 1