Introduction
A controlled drawing doesn't need to leave the country to become an export problem. It can move through a shared drive, an email attachment, a supplier portal, or a conversation with a foreign-national visitor standing in your facility.
ITAR stands for the International Traffic in Arms Regulations, the U.S. export-control framework administered by the Department of State's Directorate of Defense Trade Controls (DDTC). It governs defense articles, defense services, and related technical data identified on the U.S. Munitions List.
This article covers what ITAR means, who carries obligations under it, and what a working compliance program actually requires.
One caveat before you read further: ITAR outcomes depend on the specific article, data, service, person, destination, and authorization involved. Confirm current requirements against official DDTC sources and qualified export counsel before making a compliance decision.
Key Takeaways
- ITAR covers USML-listed defense articles, defense services, and technical data, including digital, visual, and verbal disclosures
- Manufacturers, exporters, brokers, suppliers, subcontractors, and anyone storing or transmitting controlled data may have obligations
- DDTC registration is a prerequisite for certain activities, not proof of full compliance
- Classification, authorization, access controls, training, and recordkeeping all factor into a real compliance posture
- U.S. citizenship alone doesn't resolve whether someone is a "foreign person" under ITAR
What ITAR Compliance Means: Definition, Scope, and the Regulator
ITAR exists to protect national security and foreign-policy interests, not to function as a cybersecurity standard or a certification scheme. The regulations sit in 22 CFR Parts 120-130, and DDTC's Deputy Assistant Secretary for Defense Trade Controls administers the licensing and compliance offices behind them. Regulatory text changes, so verify the current language on eCFR before relying on any summary, including this one.
The USML and Three Categories of Controlled Activity
The U.S. Munitions List runs across 21 categories, from firearms and ammunition to spacecraft, directed energy weapons, and classified articles not otherwise enumerated. Everything ITAR regulates falls into one of three buckets:
- Defense articles: physical products, components, systems, and other items identified on or covered by the USML
- Defense services: assistance, training, design, engineering, production, repair, testing, or support tied to a defense article
- Technical data: information needed to design, develop, produce, operate, repair, test, maintain, or modify a defense article
Technical data is where most organizations get tripped up. Drawings, CAD files, specifications, source code, manufacturing instructions, maintenance documentation, photographs, and even technical conversations can qualify. Context and classification determine the outcome, not assumptions, so treat every new document type as a question rather than a given.
Exports Aren't Always Physical Shipments
Releasing technical data to a foreign person inside the United States can count as an export under the regulatory concept known as a "deemed export." A foreign engineer reviewing an unencrypted drawing in your own building can trigger the same obligations as shipping a part overseas. 22 CFR 120.50 covers this directly, including how release is attributed to every country where that person holds citizenship or permanent residency.
What ITAR Is Not
ITAR isn't an ISO-style certification you earn once and display. It's not a blanket ban on hiring foreign nationals, either. And it doesn't replace your cybersecurity program, your facility-security plan, or your contractual obligations. It sits alongside them, with its own distinct requirements.
Who ITAR Applies To: Organisations, Activities, and People
Who ITAR Applies To: Organizations, Activities, and People
ITAR applicability turns on what you make, provide, handle, store, export, or disclose, not on whether you call yourself a defense company.
Organizations Carrying Obligations
A long list of organization types can have ITAR duties, including:
- Prime contractors and aerospace/defense OEMs
- Tier 1, Tier 2, and Tier 3 suppliers
- Component manufacturers and engineering firms
- Software developers working on defense-related systems
- Repair and MRO providers
- Brokers, freight forwarders, and logistics providers
- Research organizations, cloud providers, and data-hosting vendors
Supply-chain position doesn't erase responsibility. A small Tier 3 machine shop handling one USML-listed component can carry the same flow-down obligations as the prime contractor above it, usually written directly into the contract.
Roles That Need Defined Responsibilities
A functioning program assigns ITAR duties across several roles, not just one compliance officer:
| Role | Typical Responsibility |
|---|---|
| Empowered official / export lead | Registration, authorizations, DDTC communication |
| Engineering & program teams | Classification, marking, controlled workflows |
| IT & security teams | Access control, encryption, logging, incident response |
| HR, facilities & security | Nationality determinations, visitor controls, TCP execution |
U.S. Person vs. U.S. Citizen
These terms aren't interchangeable. Lawful permanent residents and certain protected individuals qualify as U.S. persons under the regulatory definition. Dual nationality can still trigger foreign-person questions that require a documented review.
Visitors, overseas employees, contractors, and remote workers all need a documented determination rather than an informal assumption about who is safe to let near controlled data.
What ITAR Compliance Requires: Registration, Authorisation, Security, and Evidence
What ITAR Compliance Requires: Registration, Authorization, Security, and Evidence
Registration is the part most people hear about first — and the part most often misunderstood.
Registration Isn't Authorization
Manufacturers, exporters, and brokers engaged in covered activity generally need to register with DDTC, even a manufacturer that never actually exports anything. Registration uses Form DS-2032, renews annually, and currently carries tiered fees starting around $3,000. See 22 CFR 122.3 for the current fee structure and exemptions.
Here's the part that trips teams up: registering doesn't authorize a single export, transfer, or defense service. You still need the applicable license, agreement, or exemption, and you need to confirm its scope, parties, destinations, and provisos before relying on it.
Classification Is an Ongoing Exercise, Not a One-Time Event
A working classification process looks like this:
- Identify the product, service, or data and determine whether it sits on the USML or under a different control regime
- Document the classification rationale, relevant USML category, and any uncertainty that needs legal or official review
- Reassess whenever the design, end use, contract, component, customer, or destination changes
Access, Security, and the Evidence Auditors Expect
Technical controls matter as much as paperwork. Organizations typically need:
- Role-based, least-privilege access tied to approved person, project, and need to know
- Scrutiny of cloud, email, remote-access, and removable-media arrangements for unauthorized foreign access
- Encryption, monitoring, audit logs, and secure disposal appropriate to the data involved
On the administrative side, auditors generally expect to see a written export-compliance manual, Technology Control Plans, marking rules, visitor procedures, training records, authorization files, and access reviews. Keep this evidence checklist handy:
- Approved classifications and their rationale
- Training completion records by role
- Access approvals and periodic reviews
- System and visitor logs
- License or exemption decisions
- Documented corrective actions
How to Build an ITAR Compliance Program and Avoid Violations
A program doesn't appear overnight. It builds in a sequence.
The Practical Build Sequence
- Appoint an accountable empowered official
- Inventory products, services, and data that might be controlled
- Determine jurisdiction and classification
- Map which people and systems touch controlled items
- Assess gaps against current controls
- Implement access, marking, and training controls
- Test the controls and review the program whenever operations or regulations change
Common Violation Patterns
Most enforcement actions trace back to a handful of recurring mistakes:
- Unauthorized technical-data sharing by email or cloud
- Access by an unauthorized foreign person
- Incomplete DDTC registration
- Unapproved defense services
- Shipment to an unauthorized party or destination
- Inaccurate export records or ignored license provisos
If you suspect a violation:
- Stop the transfer where possible
- Preserve records
- Escalate to your empowered official and counsel
- Assess the scope of affected data
Civil penalties can run high. 22 CFR 127.10 sets the cap at the greater of roughly $1.27 million or twice the transaction value per violation, so the stakes for a single mishandled disclosure aren't trivial.
ITAR vs. EAR vs. CMMC: Not the Same Thing
These frameworks overlap but don't substitute for one another:
- ITAR governs defense articles, services, and related exports under the State Department and USML
- EAR covers Commerce Department-jurisdiction items, including many dual-use products
- CMMC and NIST-based requirements address cybersecurity for covered information; they strengthen your safeguards but don't replace export authorizations
This is where training earns its keep. QMS Learning's founder, Will Trikha, spent 20 years writing and closing audit findings on aerospace and defense floors before building the Aerospace & Defense Audit-Ready pathway.
That pathway includes a dedicated ITAR Compliance course spanning six modules and 30 lessons on USML classification, export licensing, Technology Control Plans, and program management. The course is explicit that it supports a compliance program. It doesn't determine jurisdiction, grant a license, or substitute for legal advice.
Frequently Asked Questions
Who needs to be ITAR compliant?
Organizations that manufacture, export, broker, supply, or handle USML defense articles, defense services, or related technical data may have obligations. Contractors and subcontractors of any size should assess their activities and contracts directly.
Is ITAR restricted to US citizens?
No. ITAR distinguishes between U.S. persons and foreign persons, and lawful permanent residents can qualify as U.S. persons. Foreign-person access typically requires an authorization or applicable exemption, so citizenship alone doesn't settle the question.
What are some examples of ITAR violations?
Common examples include unauthorized technical-data disclosure, unapproved foreign-person access, exporting without the required authorization, ignoring license provisos, inaccurate records, and inadequate registration or controls.
What is a deemed export under ITAR?
A deemed export happens when controlled technical data is released to a foreign person inside the United States, through a document, conversation, or system access. It's treated the same as shipping the data abroad.
Does DDTC registration mean my company is ITAR compliant?
No. Registration is often a prerequisite for certain activities, but it doesn't authorize any specific export, transfer, or service. Full compliance also requires classification, authorization, access controls, training, and recordkeeping.