ITAR compliance software for small manufacturers
Published 2026-10-22
No software is "ITAR certified": the ITAR registers manufacturers and exporters with the State Department and does not certify products. What a tool can do is carry four jobs the ITAR gives a shop: checking who you deal with 22 CFR 127.1(d), knowing which parts sit on the Munitions List 22 CFR 120.11, keeping licences and agreements inside their limits, and keeping records that show every change 22 CFR 122.5.
There is a fifth job no trade suite does: keeping the drawings themselves away from foreign persons 22 CFR 120.56. So we read two kinds of vendor: four trade compliance suites and two tools that hold technical data. Most build-to-print shops need the second kind first. If you have not registered yet, start with ITAR registration, because a manufacturer must register even if it never exports.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
Descartes Visual Compliance
Its own pages name the State Department's lists, a USML search and TAA tracking with drawdown; no other suite here states all three, and it sells in modules a small shop can start small with.
Read the Descartes Visual Compliance notesKiteworks
Listed FedRAMP Moderate in the Marketplace, with role-based access its pages say keeps drawings to authorized US persons and a log of every file opened.
Read the Kiteworks notesPreVeil
End-to-end encrypted email and files that sit beside the mail you already use, built on the ITAR's encryption carve-out in 22 CFR 120.54.
Read the PreVeil notes
The four jobs, and which your shop has
ITAR software is sold as one thing and is really four. Each job comes from a different part of the regulation, and a small shop rarely has all four. A machine shop that builds to a prime's drawings and ships only inside the US has to register and keep records, but may never need a licence. The ITAR compliance checklist walks the same ground item by item.
| Job | What the rule says | What software adds |
|---|---|---|
| Screen who you deal with | You may not deal, directly or indirectly, with a debarred or otherwise ineligible person in an ITAR transaction without DDTC's written authorization.§ 127.1(d), § 127.7 | Re-screens your saved customers and suppliers every time a list changes, and keeps the record of each hit you cleared. |
| Classify your parts | Start from the item's general characteristics, find its USML category, then match the specific entry; an enumerated entry beats a catch-all.§ 120.11, § 121.1 | A searchable USML beside the Commerce Control List. It finds the paragraph; it does not decide. Real doubt goes to DDTC as a commodity jurisdiction request. |
| Licences and agreements | A DSP-5 licence is valid four years, or until the authorized value or quantity has shipped, whichever comes first. A TAA must be approved before the defense service starts.§ 123.1, § 123.21, § 124.1 | Draws each shipment down against the licence and warns before it runs out, by value, quantity or date. |
| Records for five years | Keep records of making, buying and disposing of defense articles and technical data for five years, stored so that no change goes unrecorded: what changed, who changed it, when.§ 122.5(a) | A change history by default. A shared spreadsheet keeps none unless you build it. |
Tick what your shop does below. The jobs it triggers, and the tools on this page whose own documentation states each one, update as you go.
Tick what your shop does. Pre-filled with a typical build-to-print shop.
A full trade suite is probably more than you need. Put the money into controlling the drawings, screen on the government's free Consolidated Screening List, and keep the record of each search.
| Job | Your shop | Tools that state it |
|---|---|---|
| Register with DDTC22 CFR 122.1 | Needed | Form DS-2032, filed with DDTC. No tool does it for you. |
| Screen who you deal with22 CFR 127.1(d) | Needed | Descartes Visual Compliance |
| Classify your parts22 CFR 120.11 | Not triggered | Descartes Visual Compliance |
| Licences and agreements22 CFR 123.1, 124.1 | Not triggered | Descartes Visual Compliance |
| Records for five years22 CFR 122.5 | Needed | None states it fully |
| Control who opens the drawings22 CFR 120.56 | Needed | Kiteworks, PreVeil |
A starting list, not a ruling. Your empowered official or export counsel decides.
Four trade compliance suites against the rule
Rows inside the boundary are the ITAR's own jobs, plus the FedRAMP test that applies only if CUI goes into the tool. Rows outside it are export and customs conveniences. Every word was read on the vendor's own pages on 2026-10-22; where a page speaks of lists or licences without naming the US rules, the word says so. If the suite would sit inside your ERP, read ERP for machine shops that hold CUI alongside this.
| What the rule asks | Descartes Visual Compliance | E2open Global Trade | Thomson Reuters ONESOURCE | AEB Trade Compliance |
|---|---|---|---|---|
| Inside the boundary | ||||
| Screens customers and suppliers against US restricted-party lists, the State Department's debarred list among them22 CFR 127.1(d), 127.7 | DDTC lists stated | Lists not named | Lists not named | Lists not named |
| Helps classify your parts against the 21 USML categories22 CFR 120.11, 121.1 | USML search stated | ECN stated, not USML | Not stated | ITAR not listed |
| Tracks licences and agreements, drawing down value and quantity as you ship22 CFR 123.1, 123.21, 124.1 | TAA, MLA, drawdown stated | Licence usage stated | Licence checks stated | Licence requests stated |
| Keeps records with a history of every change: who, what, when22 CFR 122.5(a) | Audit trail stated | Screening trail stated | Not stated | Change log stated |
| FedRAMP Moderate or equivalent, needed only if you put CUI in the toolDFARS 252.204-7012(b)(2)(ii)(D) | Not in Marketplace | Not in Marketplace | Not in Marketplace | Not in Marketplace |
| Outside the boundary | ||||
| EAR classification (ECCN) for dual-use items | Stated | ECN stated | Not stated | EAR stated |
| Export or customs filing from the tool | AES filing stated | Customs filing stated | Direct filing stated | Not stated |
| Connects to your ERP or CRM | Stated | Connectors stated | Not stated | SAP stated |
What the words mean
- MeetsDDTC lists statedUSML search statedTAA, MLA, drawdown statedStatedAES filing statedECN statedCustoms filing statedConnectors statedDirect filing statedEAR statedSAP stated
- The vendor's own documentation, or the official register, says so. Read on the date shown.
- PartialAudit trail statedLists not namedECN stated, not USMLLicence usage statedScreening trail statedLicence checks statedLicence requests statedChange log stated
- Covers part of the requirement, or the vendor claims it and the official register does not show it.
- Check with vendorNot in MarketplaceNot statedITAR not listed
- Not stated in what we read. Ask the vendor in writing before you rely on it.
The other half: who can open the drawings
For most small manufacturers the ITAR risk is not a shipment. It is a drawing. Showing technical data to a foreign person inside the US is an export, a deemed export, to every country where that person holds citizenship or permanent residency. And the rule counts access, not intent:
So the question for any cloud drive, email service or file portal is who can open the files, administrators and support staff included. A trade compliance suite never sees your drawings and cannot answer it. The two tools below exist for exactly this: one keeps the files with a provider whose access is limited to US persons, the other encrypts end to end so the provider never holds a key, the route 22 CFR 120.54 opens.
The same drawing is usually CUI as well: the CUI Registry lists ITAR-controlled information under its Export Controlled category, so where a defense contract carries DFARS 252.204-7012, the cloud that holds it must meet FedRAMP Moderate or its equivalent. Read what counts as CUI and what FedRAMP Moderate equivalency means before you trust a vendor's word on either.
| What the rule asks | Kiteworks | PreVeil |
|---|---|---|
| Inside the boundary | ||
| Keeps technical data away from foreign persons22 CFR 120.56, 120.62 | US-person RBAC stated | Carve-out stated |
| FedRAMP Moderate or equivalent for a cloud that holds CUIDFARS 252.204-7012(b)(2)(ii)(D) | Certified (Moderate) | Vendor states equivalency |
| FIPS-validated encryptionNIST SP 800-171 3.13.11 | FIPS 140-3 stated | FIPS 140-3 stated |
| Logs every access to the filesNIST SP 800-171 3.3.1; 22 CFR 122.5 | Immutable logs stated | Cryptographic logs stated |
| Outside the boundary | ||
| Encrypted email as well as files | Stated | Stated |
| SFTP for large CAD packages | Stated | Not stated |
What the words mean
- MeetsUS-person RBAC statedCertified (Moderate)FIPS 140-3 statedImmutable logs statedStatedCarve-out statedCryptographic logs stated
- The vendor's own documentation, or the official register, says so. Read on the date shown.
- PartialVendor states equivalency
- Covers part of the requirement, or the vendor claims it and the official register does not show it.
- Check with vendorNot stated
- Not stated in what we read. Ask the vendor in writing before you rely on it.
Two tools is a short list on purpose. The full field, with GCC High, Box, FileCloud and Sharetru, is in ITAR-compliant file sharing; for large CAD packages see ITAR-compliant file transfer, and for drawings that travel by mail, CMMC- and ITAR-ready email.
What the free route covers, and where it stops
5 years
from the licence's expiry or the transaction date
22 CFR 122.5(a)
4 years
or until the authorized value or quantity has shipped
22 CFR 123.21(a)
$1,271,078
per violation, or twice the transaction's value if greater
22 CFR 127.10(a)(1)(i)
Screening costs nothing to start. The Commerce Department's Consolidated Screening List pulls the US government's restricted-party lists into one free search, the State Department's AECA Debarred List among them, and refreshes every day at 5:00 AM Eastern. Its own page says a likely match calls for more diligence and a check of the official list before you act. What it does not do is remember: it will not re-screen last year's customers when a list changes, or keep the record of who searched what.
Licences are where the free route strains. A DSP-5 dies at four years or when the last authorized part ships, whichever comes first, so somebody has to subtract every shipment. Classification, too, is a judgement the software only supports: our guide to what ITAR compliance asks of a manufacturer walks the order of review.
The vendors, one by one
Descartes Visual Compliance
What it is. A web-based export compliance suite sold in modules: restricted-party screening with daily re-screening, a searchable USML with a cross-search of the Commerce Control List, an export licence manager that tracks TAAs and MLAs and draws licences down, and a visitor workflow for deemed exports.
Who it fits. A shop that exports a little or works under a TAA, with one person who owns compliance part time and no ERP team to integrate an enterprise suite.
| What the rule asks | What we found |
|---|---|
| Helps classify your parts against the 21 USML categories | USML search stated |
| Tracks licences and agreements, drawing down value and quantity as you ship | TAA, MLA, drawdown stated |
| Keeps records with a history of every change: who, what, when | Audit trail stated |
Checked on visualcompliance.com, 2026-10-22
Check with the vendor before you buy.
E2open Global Trade
What it is. An enterprise trade platform (now owned by WiseTech Global, per e2open's own site) whose export management screens transactions, classifies goods by HS code and export control number, flags licence requirements and stores licence usage, on top of a regulatory content database it maintains in house.
Who it fits. A manufacturer that already ships worldwide in volume and wants screening, licensing and customs filing in one platform; more than a ten-person shop needs.
| What the rule asks | What we found |
|---|---|
| Screens customers and suppliers against US restricted-party lists, the State Department's debarred list among them | Lists not named |
| Helps classify your parts against the 21 USML categories | ECN stated, not USML |
| Tracks licences and agreements, drawing down value and quantity as you ship | Licence usage stated |
Checked on e2open.com, 2026-10-22
Check with the vendor before you buy.
Thomson Reuters ONESOURCE
What it is. Thomson Reuters' trade management line: Denied Party Screening against more than 750 lists, wired into its import and export modules so a blocked party blocks the transaction, and Export Management for documents, clearance and licence determination.
Who it fits. A company with a shipping desk that files its own exports and wants a hit on a screening list to stop the shipment automatically.
| What the rule asks | What we found |
|---|---|
| Screens customers and suppliers against US restricted-party lists, the State Department's debarred list among them | Lists not named |
| Helps classify your parts against the 21 USML categories | Not stated |
| Tracks licences and agreements, drawing down value and quantity as you ship | Licence checks stated |
Checked on tax.thomsonreuters.com, 2026-10-22
Check with the vendor before you buy.
AEB Trade Compliance
What it is. A German trade-software maker's screening and export-control checks, built to run inside SAP: each check is logged with every change, and its export-control data package names the EAR, the EU dual-use rules and German law.
Who it fits. A manufacturer that runs SAP and sells both dual-use and defense parts, and wants the checks inside the order instead of in a separate window.
| What the rule asks | What we found |
|---|---|
| Helps classify your parts against the 21 USML categories | ITAR not listed |
| Keeps records with a history of every change: who, what, when | Change log stated |
Checked on aeb.com, 2026-10-22
Check with the vendor before you buy.
Kiteworks
What it is. A private data network for files, email and SFTP. Its Federal Cloud is listed FedRAMP Moderate in the Marketplace; its ITAR page describes role-based access for authorized US persons, FIPS 140-3 Level 1 validated encryption and immutable audit logs of every open and download.
Who it fits. A shop that trades large drawing packages with primes and suppliers and wants one place, with one log, for every way a file leaves the building.
| What the rule asks | What we found |
|---|---|
| Keeps technical data away from foreign persons | US-person RBAC stated |
| FedRAMP Moderate or equivalent for a cloud that holds CUI | Certified (Moderate) |
| Logs every access to the files | Immutable logs stated |
Checked on kiteworks.com, 2026-10-22
PreVeil
What it is. End-to-end encrypted email and file sharing that works alongside Microsoft 365, Google or an on-premise server. PreVeil says it holds no decryption keys, uses FIPS 140-3 validated algorithms, stores ITAR and DFARS data in AWS GovCloud (US), and meets FedRAMP Moderate equivalency.
Who it fits. A shop that wants drawings out of ordinary email this month without moving the whole company to a government cloud.
| What the rule asks | What we found |
|---|---|
| Keeps technical data away from foreign persons | Carve-out stated |
| FedRAMP Moderate or equivalent for a cloud that holds CUI | Vendor states equivalency |
| FIPS-validated encryption | FIPS 140-3 stated |
Checked on preveil.com, 2026-10-22
Check with the vendor before you buy.
How we read the vendors
Questions small shops ask
Is there ITAR-certified software?
No. The ITAR registers people who manufacture or export defense articles; it has no certification for products. A vendor that says "ITAR compliant" means its tool can support your compliance. Ask which of the jobs on this page it does, and where its own documentation says so.
We only build to print for a US prime and never export. Do we need any of this?
You still have to register: a manufacturer of defense articles registers with DDTC even if it never exports, on form DS-2032, and new registrants pay the Tier 1 fee of $3,000 a year. You keep records for five years, and you keep the drawings from foreign persons. You probably do not need a licence manager. How ITAR registration works.
Is the free Consolidated Screening List enough?
For a shop that screens a few new customers and suppliers a month, it can be, if you save each search with the date and the result. It covers the State Department's debarred list and the Commerce and Treasury lists, and it is refreshed daily. Paid screening adds re-screening of everyone you already deal with when a list changes, and a log you do not have to keep by hand.
Who counts as a US person?
A lawful permanent resident (green-card holder) or a "protected individual" as US immigration law defines it, which takes in US citizens, plus any company incorporated to do business in the US. Everyone else is a foreign person, and showing them ITAR technical data needs an authorization first, even in your own shop.
Is ITAR technical data also CUI?
Usually, when it reaches you under a defense contract. The CUI Registry lists ITAR-controlled information in its Export Controlled category, so the same drawing falls under DFARS 252.204-7012 and NIST SP 800-171 as well. Our is it CUI? tool walks through a drawing, a spec and an email.
Can software tell me whether my part is on the USML?
It can find the likely category and paragraph faster than reading part 121. The decision is yours, made by the order of review in 22 CFR 120.11, and if real doubt remains, DDTC settles it through a commodity jurisdiction request. No vendor's answer binds the State Department.