It’s no big deal. Massive infrastructure, laws, processes, and a whole ecosystem of services providers already exist for ITAR/CMMC/FedRamp controls

When you ask for regulation, you get regulated. Welcome to the real world