# Council Regulation (EC) No 428/2009 of 5 May 2009 setting up a Community regime for the control of exports, transfer, brokering and transit of dual-use items (Recast), Division Part 2: – "INFORMATION SECURITY"

Extent: E+W+S+N.I.

Note 1:Not used.
Note 2:Category 5 – Part 2 does not control products when accompanying their user for the user’s personal use.
Note 3:Cryptography Note
5A002, 5D002.a.1., 5D002.b. and 5D002.c.1. do not control items as follows:
a..Items that meet all of the following:
1..Generally available to the public by being sold, without restriction, from stock at retail selling points by means of any of the following:
a..Over-the-counter transactions;
b..Mail order transactions;
c..Electronic transactions; or
d..Telephone call transactions;
2..The cryptographic functionality cannot easily be changed by the user;
3..Designed for installation by the user without further substantial support by the supplier; and
4..When necessary, details of the goods are accessible and will be provided, upon request, to the Secretary of State in order to ascertain compliance with conditions described in paragraphs 1. to 3. above;
b..Hardware components or ‘executable software’, of existing items described in paragraph a. of this Note, that have been designed for these existing items, meeting all of the following:
1.."Information security" is not the primary function or set of functions of the component or ‘executable software’;
2..The component or ‘executable software’ does not change any cryptographic functionality of the existing items, or add new cryptographic functionality to the existing items;
3..The feature set of the component or ‘executable software’ is fixed and is not designed or modified to customer specification; and
4..When necessary as determined by the Secretary of State, details of the component or ‘executable software’ and details of relevant end-items are accessible and will be provided to the Secretary of State upon request, in order to ascertain compliance with conditions described above.
Technical Note:
For the purposes of the Cryptography Note, ‘executable software’ means "software" in executable form, from an existing hardware component excluded from 5A002 by the Cryptography Note.
Note:
‘Executable software’ does not include complete binary images of the "software" running on an end-item.
Note to the Cryptography Note:
1.To meet paragraph a. of Note 3, all of the following must apply:
a..The item is of potential interest to a wide range of individuals and businesses; and
b..The price and information about the main functionality of the item are available before purchase without the need to consult the vendor or supplier. A simple price enquiry is not considered to be a consultation.
2.In determining eligibility of paragraph a. of Note 3, Secretary of State may take into account relevant factors such as quantity, price, required technical skill, existing sales channels, typical customers, typical use or any exclusionary practices of the supplier.

---
Source: https://www.legislation.gov.uk/eur/2009/428/annex/I/division/7/division/part+2+information+security (the official version)
Page: https://openlegislation.uk/eu-regulation-2009-428/annex-I/division-7/division-part+2+information+security
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.