Section 5 Part 2 (Information Security) of the EAR Commerce Control List likely applies.

IANAL; you need to be one to interpret this stuff. These laws are as thick as a dictionary.

The EAR dates back to the Export Administration Act of 1979 but it was mostly overhauled by Congress in 2018.