There are basically 2 things to bear in mind. You are only allowed to set it to NO if you either don't use encryption at all, or you are part of the exempt regulations. This applies to the following kind of applications:
Source: Chamber of Commerce: https://www.bis.doc.gov/index.php/policy-guidance/encryption/encryption-faqs#15
Consumer applications
- piracy and theft prevention for software or music;
- music, movies, tunes/music, digital photos – players, recorders and organizers
- games/gaming – devices, runtime software, HDMI and other component interfaces, development tools
- LCD TV, Blu-ray / DVD, video on demand (VoD), cinema, digital video recorders (DVRs) / personal video recorders (PVRs) – devices, on-line media guides, commercial content integrity and protection, HDMI and other component interfaces (not videoconferencing);
- printers, copiers, scanners, digital cameras, Internet cameras – including parts and sub-assemblies
- household utilities and appliances
Business / systems applications: systems operations, integration and control. Some examples
business process automation (BPA) – process planning and scheduling, supply chain management, inventory and delivery
transportation – safety and maintenance, systems monitoring and on-board controllers (including aviation, railway, and commercial automotive systems), ‘smart highway’ technologies, public transit operations and fare collection, etc.
industrial, manufacturing or mechanical systems - including robotics, plant safety, utilities, factory and other heavy equipment, facilities systems controllers such as fire alarms and HVAC
medical / clinical – including diagnostic applications, patient scheduling, and medical data records confidentiality
applied geosciences – mining / drilling, atmospheric sampling / weather monitoring, mapping / surveying, dams / hydrology
Research /scientific /analytical. Some examples:
business process management (BPM) – business process abstraction and modeling
scientific visualization / simulation / co-simulation (excluding such tools for computing, networking, cryptanalysis, etc.)
data synthesis tools for social, economic, and political sciences (e.g., economic, population, global climate change, public opinion polling, etc. forecasting and modeling)
Secure intellectual property delivery and installation. Some examples
software download auto-installers and updaters
license key product protection and similar purchase validation
software and hardware design IP protection
computer aided design (CAD) software and other drafting tools
Note: These regulations are also true for testing your app using TestFlight