Give controlled RFQs an approved path before receipt

Receipt and authorization

Procedure owner: [name/role]. Approved scope: [data categories and contracts]. Before receipt, confirm the customer’s classification, markings, authorized recipients and transfer instructions with [responsible lead]. If a package arrives through an unapproved route, restrict further distribution and notify [contact] using the incident process. Record the sender, date, file identifiers and actions taken without copying technical content into ordinary ticketing or chat. A missing marking is a reason to clarify classification, not proof the drawing is unrestricted.

Storage and estimating

Approved repository: [system and configuration]. Access approval: [person and evidence]. Review access at [interval] and when roles change. ITAR parts go in the ITAR vault when using QuotedPart: the vault encrypts protected files in the browser before upload. Document local downloads, devices, keys and any authorized processing separately; the vault does not determine recipient authorization, contract requirements or the shop’s registration obligations. Keep controlled files and technical extracts out of ordinary support requests, public sample tools and unapproved AI services.

Transfers, retention and disposal

Before sending files to a processor, confirm [authorization owner], [approved recipient] and [approved transfer method], then retain the approval record. Apply the shop’s approved retention schedule and legal holds; do not invent a universal deletion interval. At disposal, account for working copies, downloads, backups and recipient obligations, and record who verified completion. Train employees on the actual tools and escalation path, test the procedure with noncontrolled sample files, and have the responsible export professional review it whenever the process or applicable requirements change.

• Read the vault’s product boundary