If someone at my company is accessing CUI or ITAR data through a company VPN while in another country, is that legal? The data is stored securely on company servers with ITAR and NIST 800-171 compliant infrastructure in place for CUI. The individual is a U.S. citizen, and assuming the data remains secure and isn’t transferred to anyone else, are there any legal risks they should be aware of?

Thank you!