What is ITAR compliance? What the rule asks of a small manufacturer
Published 2026-10-23, 16 min read
ITAR compliance means following the International Traffic in Arms Regulations, 22 CFR parts 120 to 130, for every defense article, piece of technical data and defense service your shop makes, holds or sends. The State Department's Directorate of Defense Trade Controls (DDTC) runs it. For a manufacturer it comes down to registering, keeping the records 22 CFR 122.5 asks for, and getting a licence or other approval before anything leaves the country or reaches a foreign person. Nobody issues a certificate for it.
- Part 120Purpose and DefinitionsWhat counts as a defense article, technical data, an export
- Part 121The United States Munitions ListWhether your part or drawing is on the list
- Part 122Registration of Manufacturers and ExportersRegistering with DDTC, and keeping records
- Part 123Licenses for the Export and Temporary Import of Defense ArticlesShipping hardware out of the country
- Part 124Agreements, Off-Shore Procurement, and Other Defense ServicesRarely the first stop for a parts shop
- Part 125Licenses for the Export of Technical Data and Classified Defense ArticlesSending drawings abroad
- Part 126General Policies and ProvisionsProscribed countries (126.1)
- Part 127Violations and PenaltiesPenalties and voluntary disclosures
- Part 128Administrative ProceduresRarely the first stop for a parts shop
- Part 129Registration and Licensing of BrokersRarely the first stop for a parts shop
- Part 130Political Contributions, Fees and CommissionsRarely the first stop for a parts shop
Part titles from 22 CFR Subchapter M (eCFR, current to 2026-10-21). Filled square: where a small shop usually meets the rule (our reading).
What the ITAR is
The ITAR is the State Department's rule for military goods and know-how. Section 38 of the Arms Export Control Act gives the President power over the export and import of defense articles and defense services; that power is delegated to the Secretary of State and run day to day by DDTC. In DDTC's words, the ITAR “governs the manufacture, export, and temporary import of defense articles, the furnishing of defense services, and brokering activities” for items on the U.S. Munitions List (USML).
Note the first word: manufacture. A shop that never ships a box overseas is still inside the ITAR the day it machines a Munitions List part. The rule controls three kinds of thing.
Anything on the Munitions List, plus the technical data about it. A part counts before it is finished.
“Forgings, castings, and other unfinished products, such as extrusions and machined bodies, that have reached a stage in manufacturing where they are clearly identifiable by mechanical properties, material composition, geometry, or function as defense articles.”Rule text, 22 CFR 120.31(a)(2)
The drawings, models and instructions needed to make, test or repair a defense article.
“This includes information in the form of blueprints, drawings, photographs, plans, instructions, or documentation”Rule text, 22 CFR 120.33(a)(1)
Helping a foreign person with a defense article, or handing them controlled technical data.
“The furnishing to foreign persons of any technical data controlled under this subchapter, whether in the United States or abroad”Rule text, 22 CFR 120.32(a)(2)
The first quote is the one machine shops miss. A half-finished housing that is already recognisable by its geometry is a defense article on the bench, before anyone has shipped it, invoiced it or called it finished.
- IFirearms and Related Articles
- IIGuns and Armament
- IIIAmmunition and Ordnance
- IVLaunch Vehicles, Guided Missiles, Ballistic Missiles, Rockets, Torpedoes, Bombs, and Mines
- VExplosives and Energetic Materials, Propellants, Incendiary Agents, and Their Constituents
- VISurface Vessels of War and Special Naval Equipment
- VIIGround Vehicles
- VIIIAircraft and Related Articles
- IXMilitary Training Equipment and Training
- XPersonal Protective Equipment
- XIMilitary Electronics
- XIIFire Control, Laser, Imaging, and Guidance Equipment
- XIIIMaterials and Miscellaneous Articles
- XIVToxicological Agents, Including Chemical Agents, Biological Agents, and Associated Equipment
- XVSpacecraft and Related Articles
- XVINuclear Weapons Related Articles
- XVIIClassified Articles, Technical Data, and Defense Services Not Otherwise Enumerated
- XVIIIDirected Energy Weapons
- XIXGas Turbine Engines and Associated Equipment
- XXSubmersible Vessels and Related Articles
- XXIArticles, Technical Data, and Defense Services Not Otherwise Enumerated
Category titles from 22 CFR 121.1, eCFR current to 2026-10-21
Each category runs from end items down to parts, components, technical data and services “directly related” to them (22 CFR 120.10(b)). A bracket machined to a military aircraft print may fall under a USML entry, or under the Commerce Department's export rules instead (22 CFR 120.11(d)). Which one depends on the entry, and finding out is the classification duty below.
What “ITAR compliant” can and cannot mean
There is no ITAR certificate. The regulation sets duties for the people who make and export defense articles; it has no accreditation scheme, no auditor and no product approval. Even Microsoft, which sells a cloud built for ITAR data, says so on its ITAR page.
So “ITAR compliant” is a claim about conduct, never a status someone grants. Said of a company, it means the company does what the rule asks. Said of a product, the most it can mean is that the product lets you do what the rule asks.
- Can mean
- The company is registered with DDTC and keeps the records 22 CFR 122.5 asks for
- It has classified what it makes and knows which drawings are technical data
- No foreign person can open the unencrypted data without an authorization
- A product stores and sends data in a way that fits the rule's encryption carve-out
- Cannot mean
- A government certificate, seal or audit report: none exists
- That DDTC has reviewed or approved a product
- That your shop is compliant because a tool you bought says it is
- That a registered company has no further duties
When a vendor uses the phrase, turn it into a question you can get answered in writing. These are the questions we would ask; they come from the sections of the rule that the claim is really about.
| What the vendor says | What to ask |
|---|---|
| ITAR compliant cloud | Is data stored only in the US? Can any foreign person, including vendor support staff, reach it unencrypted? |
| Encrypted to ITAR standards | Is it end to end, with no third party holding the keys? Which FIPS 140 module, or what strength if not FIPS? |
| US persons only | Does that cover support, backups and subcontractors, or only the people in the product team? |
| ITAR certified | Certified by whom? The ITAR has no certification, so ask what was actually checked. |
| We sign ITAR terms | Ask for the contract language in writing, and which of their services it covers. |
We read file-sharing and transfer services against exactly these questions in ITAR-compliant file sharing and ITAR-compliant file transfer, and the screening and records tools in ITAR compliance software.
ITAR compliant vs ITAR registered
Registered is a fact about your paperwork with DDTC. Compliant is a fact about how you run the shop. A registered company can break the rules on Monday, and a manufacturer that never registered is already breaking them: the ITAR makes it unlawful to manufacture defense articles “without complying with the registration requirements” (22 CFR 127.1(b)(3)).
| Question | ITAR registered | ITAR compliant |
|---|---|---|
| What it is | A filing with DDTC on form DS-2032, signed by a U.S.-person senior officer | Doing what 22 CFR 120–130 asks, every working day |
| Who needs it | Anyone in the US who manufactures or exports defense articles or furnishes defense services, even a manufacturer who never exports | Anyone who makes, holds or sends defense articles or technical data, registered or not |
| What triggers it | One occasion of manufacturing a defense article is enough | The first defense article or controlled drawing in the building |
| What it lets you do | Nothing by itself: it confers no export rights, but is generally a precondition to a licence | Ship, share or hire with a licence or exemption in hand |
| What it costs | New registrants pay the Tier 1 fee of $3,000 per year | Your time and your controls |
| How you show it | A current registration with DDTC, renewed on time | Your records, your access list and your licences |
Registered column: 22 CFR 122.1, 122.2(a), 122.3(a)(1); eCFR current to 2026-10-21
The core duties for a small manufacturer
DDTC sums up what the ITAR asks of a manufacturer or exporter in three items: “(1) registration, (2) maintenance of records required by 22 CFR 122.5, and (3) obtaining licenses or other approvals” before an export. Doing those three well takes three more: knowing what you make, controlling who sees it, and owning up when something slips. That gives six duties.
Register with DDTC
What the rule says
Anyone in the US who manufactures or exports defense articles or furnishes defense services must register with DDTC; a manufacturer who does not export must nevertheless register.
In a small shop
Register before the first USML job ships, not after the prime asks for your code. The filing itself is in the registration guide.
22 CFR 122.1(a)
Know what you make
What the rule says
To classify an item, “begin with a review of the general characteristics of the item”, then match its characteristics and functions to a specific USML entry. If you cannot tell, DDTC will answer a commodity jurisdiction request (form DS-4076), with a preliminary response within 10 working days; you do not need to be registered to ask.
In a small shop
Ask the prime, in writing, for the USML category of every controlled part number and drawing, and record it against the job. Their answer is a starting point; the duty stays yours.
22 CFR 120.1122 CFR 120.12
Control who sees the data
What the rule says
Releasing technical data to a foreign person in the United States is a deemed export (to every country of that person's citizenship or permanent residency); using access information to let a foreign person see unencrypted technical data is a release.
In a small shop
Keep a list of who may open controlled drawings and why, and know before access is granted whether each employee, visitor, IT contractor and cloud support desk is a U.S. person. A password handed over is a release.
22 CFR 120.5022 CFR 120.5622 CFR 120.62
Licence or exemption first
What the rule says
“Any person who intends to export or to import temporarily a defense article must obtain the approval of the Directorate of Defense Trade Controls prior to the export or temporary import, unless the export or temporary import qualifies for an exemption”. Unclassified permanent exports go on Form DSP-5, and a person who must register has to do so before using an exemption.
In a small shop
Before a part, a drawing or a set of instructions goes to anyone outside the US, stop and find the licence or the exemption by its paragraph number. Screen every party first.
22 CFR 123.1(a)22 CFR 120.15
Keep the records
What the rule says
A registrant keeps records of manufacture, acquisition and disposition of defense articles, technical data and defense services for five years from the expiration of the license or other approval, or from the date of the transaction; electronic records must be reproducible on paper, and no entry may change without recording what changed, who changed it and when.
In a small shop
Your ERP or job travellers probably hold most of this already. Check that edits are logged and that a five-year-old job can still be printed.
22 CFR 122.5(a)
Disclose and fix
What the rule says
DDTC asks you to notify it immediately after a violation is discovered and to file a full disclosure within 60 calendar days of that notice. It may treat a voluntary disclosure as a mitigating factor, and one of the factors it weighs is whether you have “instituted or improved an internal compliance program”.
In a small shop
Decide now who calls a halt and who talks to counsel when a drawing goes to the wrong inbox. The disclosure only counts as voluntary if senior management knows and authorises it.
22 CFR 127.12
The six fit on one page below. To work through them item by item and print your answers, use the ITAR compliance checklist.
ITAR duties for a small manufacturer, cuideck.com
| Duty | First thing to do | 22 CFR |
|---|---|---|
| 1Register with DDTC | File the DS-2032 before the first USML job, even if you never export | 122.1 |
| 2Know what you make | Get the USML category for each controlled part and drawing in writing | 120.11 |
| 3Control who sees the data | Keep an access list; confirm U.S.-person status before access | 120.50, 120.56 |
| 4Licence or exemption first | Nothing leaves the US or reaches a foreign person without one | 123.1, 120.15 |
| 5Keep the records | Five years; printable; every change logged | 122.5 |
| 6Disclose and fix | Notify DDTC at once; full disclosure within 60 calendar days | 127.12 |
Not legal advice. Rule text: eCFR, current to 2026-10-21
What a violation costs
The ITAR is enforced per violation, and a single drawing emailed to the wrong person can be one. The figures below are the ones in the regulation today; the civil penalty is adjusted for inflation, so read it again before you quote it to anyone.
$1,271,078
Civil penalty ceiling per violation
or twice the transaction's value, if greater
60 days
To file a full voluntary disclosure
calendar days after your first notice to DDTC
5 years
How long records are kept
from the licence's expiry or the transaction
That is the civil side. A willful violation, or a false statement in a registration or licence application, can also be prosecuted, with a fine or prison or both as set by the statute, 22 U.S.C. 2778(c) (22 CFR 127.3). And DDTC can make paying a civil penalty a condition of any export licence you hold or ask for later (22 CFR 127.10(b)).
DDTC's own list of what a violation costs ends with the part a small shop feels most: “loss of reputation and revocation/ rejection of export licenses”. For a subcontractor, the prime's supplier list is the licence that matters.
Where ITAR meets CMMC and CUI
Most small shops meet the ITAR and CMMC through the same drawing. The CUI Registry's Export Control category (marking EXPT) includes items identified in the ITAR and the munitions list, and it lists Controlled Technical Information under DFARS 252.204-7012 as CUI Specified, marked with one of the distribution statements B through F. So an ITAR print that came to you under a DoD contract will usually be CUI as well (the contract should say so), and both rulebooks apply to it at once.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
They ask different questions. The ITAR asks who may see the data. DFARS 7012 and CMMC ask how the systems that hold it are protected. Passing one tells you little about the other.
| Topic | ITAR | DFARS 7012 and CMMC |
|---|---|---|
| Whose rule | State Department (DDTC), 22 CFR 120–130 | DoD: DFARS 252.204-7012, NIST SP 800-171, 32 CFR 170 |
| What it protects | Defense articles, technical data and defense services on the USML | Covered defense information, including Controlled Technical Information |
| Who may see it | No foreign person without an authorization: a release in the US is a deemed export | Authorized users on protected systems; nationality is the ITAR's question |
| Encryption | FIPS 140-2 (or successor) modules, or other means at least as strong as AES-128, end to end | FIPS-validated cryptography to protect CUI (3.13.11) |
| Cloud | Not stored in, or intentionally sent to, a country proscribed in 22 CFR 126.1 | Security equivalent to the FedRAMP Moderate baseline |
| When it goes wrong | Voluntary disclosure to DDTC; full disclosure within 60 calendar days | Report cyber incidents to DoD within 72 hours of discovery |
| Certificate | None exists | Only after a C3PAO or DIBCAC assessment; a self-assessment gets none |
The row that trips shops up is encryption. The ITAR says that sending, taking or storing technical data is not an export at all if it is encrypted the way 22 CFR 120.54(a)(5) describes, which is what makes cloud storage of ITAR drawings workable.
The rest of the carve-out matters as much as the cipher: the encryption has to be end to end, with the means of decryption kept from any third party, and the data may not be sent to or stored in a proscribed country. That is why cloud vendors are asked who holds the keys, and why GCC High and its alternatives come up in the same breath as ITAR. The clause side is in our DFARS 7012 guide.
Questions shops ask about ITAR compliance
Is ITAR compliance a certification?
No. Nothing in 22 CFR 120 to 130 certifies a company or a product. Microsoft's ITAR page says it plainly: “While there's no compliance certification for the ITAR, …”. A vendor that says “ITAR certified” is describing its own controls, not a government approval.
We only machine parts to print and never export. Do we need to register?
If the parts are defense articles, yes: a manufacturer who does not export must nevertheless register, and one occasion of manufacturing is enough. See the registration guide for the exemptions and the filing.
Can a foreign national work in an ITAR shop?
The ITAR does not ban employing anyone. It controls what you release: showing technical data to a foreign person in the US is a deemed export, and helping a foreign person with a defense article can be a defense service, both of which need DDTC authorization first (22 CFR 120.50(a)(2), 120.32(a)). Hiring itself has its own legal limits, so take hiring questions to employment counsel.
What is the difference between the ITAR and the EAR?
The ITAR is the State Department's rule for items on the U.S. Munitions List. Items not on the USML may be controlled by another agency instead, mainly the Commerce Department under the Export Administration Regulations; the ITAR points to Supplement No. 4 to part 774 of the EAR for classifying those (22 CFR 120.11(d)).
Does passing a CMMC assessment make us ITAR compliant?
No. CMMC checks how your systems protect CUI; the ITAR controls who may receive defense articles and technical data at all. A well-protected system can still let the wrong person in. The table in Where ITAR meets CMMC puts the two side by side.
What makes a cloud service usable for ITAR drawings?
The rule's carve-out: end-to-end encryption with FIPS 140-2 (or successor) modules or equivalent AES-128 strength, the means of decryption kept from any third party, and no storage in or intentional sending to a proscribed country (22 CFR 120.54(a)(5), (b)). We read file services against it in ITAR-compliant file sharing.
We already sent a drawing to the wrong person. What now?
Stop further sharing, write down what went where, and talk to export counsel. DDTC asks for an initial notice immediately after a violation is discovered and a full disclosure within 60 calendar days, and it only treats the disclosure as voluntary if senior management knows and authorises it (22 CFR 127.12).