What is an ECCN?

An Export Control Classification Number (ECCN) is a five-character alphanumeric code assigned under the U.S. Export Administration Regulations (EAR) to items on the Commerce Control List – including networking hardware and cryptographic software – that determines what export license, if any, is required to ship the item outside the United States.

Key takeaways

• ECCN codes classify items against the U.S. Commerce Control List.
• The code determines licensing requirements for shipping items abroad.
• Encryption hardware and software fall under their own ECCN category.
• Versa’s CSX and CSG appliances and their crypto modules carry ECCNs.
• EAR99 is the default for items the CCL doesn’t separately list.

On this page: Why it matters · How it works · Types · ECCN & Versa · FAQ

Why is ECCN important?

Any company that manufactures or resells hardware or software across borders has to know how U.S. export law treats that product, and the ECCN is the mechanism that answers the question. Shipping an item without the correct classification – or ignoring the license conditions it carries – exposes a company to civil and criminal penalties under the Export Administration Regulations, regardless of intent.

The stakes are higher for networking equipment than for most consumer goods, because encryption is treated as a controlled technology in its own right. A router, VPN gateway, or SD-WAN appliance that embeds IPsec or SSL/TLS functionality doesn’t just get classified as networking hardware; its cryptographic components get their own ECCNs, and the strictest classification applies. For enterprises deploying equipment internationally, the ECCN determines which countries an appliance can legally ship to and whether an export license is required.

What is an ECCN?

An ECCN follows a fixed pattern: a digit for the general category (0–9 – for example, 5 covers telecommunications and information security), a letter for the product group (A–E – equipment, test/production gear, materials, software, or technology), and three digits for the specific control reason, such as national security or encryption. The U.S. Bureau of Industry and Security (BIS) maintains the Commerce Control List these codes index.

Manufacturers typically self-classify their products against the CCL. When the correct code isn’t obvious, a company can ask BIS for an official determination, documented in a Commodity Classification Automated Tracking System (CCATS) letter confirming the ECCN was formally reviewed rather than self-assigned. Items that don’t match any CCL entry default to the catch-all classification EAR99.

Types of export control classifications

EAR99 is the baseline: items not elsewhere specified on the CCL, generally exportable to most destinations without a license, subject to standard restrictions on embargoed countries and prohibited end-users. Category 5, Part 1 covers telecommunications equipment – the transmission and switching hardware itself. Category 5, Part 2 covers information security: encryption hardware (5A002), encryption software (5D002), and encryption technology (5E002), applied separately from whatever category the underlying device otherwise falls into. License-exception-eligible ECCNs still require classification but can ship without a full export license under provisions such as License Exception ENC for mass-market encryption. Restricted ECCNs, like 5A002A designations, carry destination- and end-user-specific conditions on every shipment.

ECCN & Versa

Versa documents ECCN, HTS, and CCATS numbers for its Cloud Services Switch (CSX) and Cloud Services Gateway (CSG) appliance families in each model’s hardware specification guide – for example, the CSX2000 Series Hardware Guide and the CSX8000 Series Appliance Specifications. The embedded SSL VPN proxy module is classified 5E002, and the IPsec toolkit used by the Versa Operating System (VOS) is classified 5D002; the appliance’s hardware-based encryption and decryption engine carries 5A002U.

The appliance as a whole also receives a separate, restriction-level ECCN – 5A002A for both the CSX2000 and CSX8000 series – assigned by BIS, with an encryption status of Restricted and eligibility under License Exception 740.17(A) and (B)(2)(i)(A). Versa keeps these numbers current as new hardware ships; updated guides listing ECCN, HTS, and CCATS values appear in New Articles as they’re published.

Frequently asked questions

What does ECCN stand for?

Export Control Classification Number – the alphanumeric code the U.S. Commerce Control List uses to classify an item for export purposes. It tells an exporter which licensing rules apply before the item can legally leave the United States, based on what the item is and what it does.

Who assigns an ECCN?

Manufacturers and exporters usually self-classify their own products against the Commerce Control List. When the right code isn’t clear, a company can request an official ruling from the Bureau of Industry and Security, which documents the determination in a CCATS reference number.

What is the difference between an ECCN and EAR99?

An ECCN identifies an item’s specific entry on the Commerce Control List, along with the license conditions that entry carries. EAR99 is the default classification for items that don’t match any CCL entry – generally exportable with minimal restriction, aside from embargoed destinations and prohibited end-uses.

Why do networking appliances need a separate ECCN for encryption?

Because cryptographic functionality is controlled independently of the device it runs on. Category 5, Part 2, of the Commerce Control List classifies encryption hardware, software, and technology on their own terms, so a VPN gateway or SD-WAN appliance carries distinct ECCNs for its IPsec toolkit and SSL modules alongside its base classification.

Does an ECCN determine whether an export license is required?

Yes, in combination with the destination country and end-user. Some ECCNs are freely exportable to most destinations; others, including several encryption classifications, ship only under a specific license exception or require a validated export license depending on where the equipment is going.

More on ECCN

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about ECCN, these are worth looking at next.