Here's the problem: there is no such thing as "ITAR certified." No government agency issues that credential to companies. Yet the myth persists across the defense supply chain, costing suppliers real time chasing paperwork that won't satisfy anyone.
Meanwhile, the actual requirement — registering with the Directorate of Defense Trade Controls (DDTC) and running a documented compliance program — gets overlooked. That gap is what gets companies debarred, fined, or quietly dropped from supplier lists.
This guide clarifies the myth, explains who must register, walks through the DDTC process step-by-step, and outlines what a real ITAR compliance program requires.
Key Takeaways
- No official "ITAR certification" exists; the real requirement is DDTC registration plus an active compliance program
- Any company manufacturing, exporting, or brokering USML-listed items must register with DDTC, regardless of size
- Registration alone proves nothing; DDTC expects documented, audited, continuously trained programs
- Civil and criminal penalties for violations run into the millions of dollars, making audit-readiness non-negotiable
What Is "ITAR Certification"? Separating Myth from Regulation
The Certification Myth
"ITAR Certified" appears on countless supplier websites and LinkedIn profiles. It isn't a defined term anywhere in the regulations. Trade compliance advisors have said this plainly for years: Fortra's 2025 breakdown of ITAR compliance states flatly that "there is no such thing as being ITAR certified."
So where does the confusion come from? Usually a questionnaire.
Prime contractors send suppliers forms asking them to "certify" their ITAR compliance as part of vendor onboarding or flowdown requirements. Suppliers read the word "certify" and assume there's a formal process behind it, similar to ISO certification through a registrar, but there isn't. The prime is asking for evidence, not a credential.
Individuals can earn compliance-related titles through training programs, such as an Empowered Official credential or export compliance certificate. That's different from a company claiming it holds "ITAR Certification": individual expertise is real and earnable, but no company can purchase a credential the regulations never created.
What ITAR Actually Regulates
ITAR is the regulatory framework at 22 CFR Parts 120-130, administered by the State Department's DDTC under the Arms Export Control Act. It governs the manufacture, export, temporary import, and brokering of defense articles, defense services, and related technical data.
The scope sits inside the U.S. Munitions List (USML), 21 categories covering:
- Firearms, ammunition, and ordnance
- Military and naval vehicles and vessels
- Aircraft, spacecraft, and satellite technology
- Military electronics, fire control, and guidance equipment
- Toxicological agents and directed energy weapons
Whether your company falls under ITAR jurisdiction comes down to classification, not intuition. A part that looks purely commercial can still land on the USML if it was designed or modified for military application.
So what does "ITAR compliant" actually mean? It means being registered with DDTC (when your activities require it) and operating according to the regulations, not holding a certificate. Registration is a status; compliance is an ongoing operating condition.
Who Needs ITAR Registration and Compliance?
DDTC applies registration based on activity, not job title. A company doesn't get a pass because it calls itself a "supplier" instead of an "exporter." Under 22 CFR 122.1, registration typically applies to:
- Manufacturers of any item specifically listed on the USML, even if they never export a single unit
- Exporters and temporary importers of defense articles, defense services, or related technical data
- Brokers and intermediaries who arrange defense trade transactions, even without ever touching the physical item (brokers register under a separate rule, 22 CFR 129.3)
- Universities and research institutions developing technology with potential military application, though research status alone doesn't exempt an institution
- Government contractors and subcontractors performing covered manufacturing or export activity in the supply chain of a prime defense contractor
One point trips people up constantly: foreign persons collaborating on U.S. defense programs. The trigger is engaging in the covered activity in the United States. Nationality alone doesn't automatically create or remove the obligation. If your organization touches USML-listed hardware or technical data anywhere in that chain, assume registration applies until a classification review proves otherwise.
How to Register with the DDTC: The Real "Certification" Process
This is the process suppliers should actually be running through, instead of chasing a nonexistent certificate.
- Determine USML jurisdiction. Classify your products, services, and technical data against the 21 USML categories before assuming registration is required, or assuming it isn't.
- Submit your registration application. File the electronic DS-2032 Statement of Registration through DECCS (DDTC's online portal) and pay the applicable tiered fee.
- Designate a qualified Empowered Official. This person must be a U.S. person with independent authority to review, verify, and refuse to sign export authorizations without penalty (the requirement now sits at 22 CFR 120.67).
- **Build and document a formal export compliance program** covering screening, licensing, and recordkeeping (more on this below).
- Apply for licenses or exemptions through DECCS before any export, transfer, or foreign-person disclosure occurs, not after.
- Maintain registration annually through renewal, ongoing employee training, and periodic internal audits.
Current DDTC Registration Fees
The tiered fee structure took effect January 9, 2025, according to DDTC's registration fee schedule:
| Tier | Fee | Applies To |
|---|---|---|
| Tier 1 | $3,000 | First-time registrants, stand-alone brokers, qualifying nonprofits, renewals with no favorable determinations |
| Tier 2 | $4,000 | Renewals with five or fewer favorable determinations |
| Tier 3 | $4,000 + $1,100 per favorable determination over five | Higher-volume registrants, subject to a revised cap formula |
Registration covers a 12-month period. DDTC recommends submitting your renewal 30 to 60 days before expiration — waiting until the last week is how companies end up unable to export while a renewal sits in review.
Building an ITAR-Ready Compliance Program
Registration gets you on the list. It doesn't prove anything happens after that. DDTC's compliance guidelines expect an operating program, not a filed form.
Core Elements DDTC Expects
A functioning program includes:
- Denied-party screening for every transaction party before engagement
- End-use and end-user verification to confirm goods or data aren't headed somewhere they shouldn't
- Technical data access controls, including restrictions on foreign-person access to controlled information
- Accurate recordkeeping on the manufacture and disposition of defense articles, generally retained for five years
- Employee training on ITAR fundamentals — untrained staff mishandling technical data or foreign visitor access is a leading cause of violations; role-specific pathways like QMS Learning's Aerospace & Defense course build this competency without pulling engineers off the floor for classroom sessions
- Regular internal audits and a documented voluntary disclosure procedure for when something goes wrong anyway
That last point matters more than most companies realize. A proper voluntary disclosure can be a significant mitigating factor during enforcement review. Silence after discovering a problem rarely ends well.
Penalties for Getting It Wrong
The numbers are not small. DDTC's compliance actions page describes civil exposure at $1 million or more per violation, with criminal exposure reaching $1 million and 20 years imprisonment per violation under the Arms Export Control Act.
Beyond the fines, violations can trigger:
- Loss of export privileges
- Civil or criminal debarment from future defense trade
- Exclusion from government contracts entirely
There's also a quieter cost: reputational damage. Prime contractors routinely disqualify suppliers found non-compliant, and word travels fast in a defense supply chain that isn't very large to begin with.
How QMS Learning Helps Teams Stay ITAR Audit-Ready
Registering is the easy part. Sustaining the compliance program DDTC expects (training records, audit evidence, current procedures) is where most companies struggle, especially with one or two people wearing the compliance hat alongside everything else.
QMS Learning's Aerospace & Defense Audit-Ready pathway bundles ITAR, AS9100D, and Counterfeit Parts Avoidance training into one practitioner-built program.
The ITAR course alone runs 6 modules and 30 lessons. It moves from fundamentals (the Arms Export Control Act, DDTC authority, ITAR vs. EAR) through USML classification, licensing, Technology Control Plans, and applied scenarios for aerospace manufacturers and MRO operations.
What sets it apart is the QMS Workbench AI. Ask it what to do when a foreign national is scheduled to visit your facility, and it walks through the process step by step, not with generic advice:
- Citizenship screening
- TCP review
- Escort briefing
- Access logging
The Workbench also handles USML classification questions, TAA vs. DSP-5 determinations, and TCP drafting on demand, 24/7, even after the course ends.
The Manager Dashboard then turns that activity into proof. When a prime contractor sends the "please certify your ITAR compliance" questionnaire, you export a single Audit-Evidence Package containing:
- Training records by employee
- Completed scenario logs
- AI-generated TCPs and access logs
- Time-stamped activity
This is exactly the kind of evidence a registrar or prime contractor audit looks for, whether or not they use the word "certify."
Frequently Asked Questions
What is ITAR certification?
No formal "ITAR certification" exists. There's no government-issued credential a company can obtain. The real requirement is DDTC registration paired with a documented, operating compliance program.
How do I obtain ITAR certification?
You don't — instead, register with DDTC through DECCS, appoint a qualified Empowered Official, and build a compliance program covering screening, training, and recordkeeping.
Who needs ITAR certification?
Manufacturers, exporters, temporary importers, brokers, and researchers dealing with USML-listed items or related technical data must register and comply, regardless of company size.
Does ITAR certification expire?
There's no certification to expire, but DDTC registration must be renewed annually. Letting it lapse can suspend your ability to export or apply for licenses.
What's the difference between ITAR and EAR?
ITAR (State Department, DDTC) governs defense articles and technical data on the USML. EAR (Commerce Department, BIS) governs dual-use and commercial items with potential military application, under a separate Commerce Control List.
How much does ITAR registration cost?
DDTC's current tiered structure runs from $3,000 (Tier 1) to $4,000 plus per-determination fees at higher tiers. Confirm current figures directly on DDTC's site before budgeting, since fees adjust periodically.
