Answer from the shop, not from memory
Walk the floor, the file server and the inbox. An item is Done only when you could show the proof today.
ITAR compliance checklist for small manufacturers
28 checks from 22 CFR Parts 120 to 130 for a shop that builds defense articles: USML classification, DDTC registration, who may see technical data, the encryption carve-out, licences, screening, records and voluntary disclosure. Mark each one, add notes, print the result. Not legal advice; where an attorney or DDTC is the answer, the item says so. Rules read on eCFR on 2026-10-23.
ITAR compliance checklist
ITAR compliance checklist (cuideck.com/tools/itar-compliance-checklist)
Loading the checklist and any answers saved in this browser.
What this ITAR checklist checks
ITAR compliance for a small manufacturer is not a certificate. It is a handful of duties in 22 CFR Parts 120 to 130 that start the day you machine your first part to a defense prime's print: register with the Directorate of Defense Trade Controls (DDTC), keep USML technical data away from foreign persons unless licensed, keep records, and own up quickly when something slips. The 28 items above cover those duties in 8 groups, each tied to the section of the rule it comes from.
The trap most shops fall into is the deemed export. Releasing technical data to a foreign person in the United States is a deemed export, so a drawing on a screen during a plant tour, or a password shared with an offshore IT help desk, is treated like a shipment abroad. The guide to what ITAR compliance means walks through the rule in prose; this page is the working list.
Note
Registration is not optional for a shop that never exports: anyone in the US who manufactures or exports defense articles or furnishes defense services must register with DDTC; a manufacturer who does not export must nevertheless register. The steps are in our DDTC registration guide.
How to use the checklist
Use N/A only where the rule allows it
Registration, records and the deemed export items have no N/A for a maker of USML parts. Licence and screening items do, if nothing leaves the country.
Write the proof in the notes
Who owns it, where the document lives, the date you checked. The printout becomes your compliance file's first page.
Work the result list top down
Registration first, then anything that could already be a release of technical data, then records.
Print gives you every item with your answers and notes, whatever the screen filter shows. Copy puts the same sheet on your clipboard as plain text for an email to your attorney or quality manager.
Worked example: a 28-person machine shop
The example loaded in the tool is a shop that mills brackets to a prime's prints. It is registered, never exports and keeps drawings on a commercial file share run by an outside IT provider. It scores 10 of 19 applicable items done, with 9 not done and 9 marked N/A, most of them because nothing leaves the country.
Nothing on its gap list is exotic. Most are the quiet ways technical data reaches someone it should not: a shared login, a help desk abroad, a drawing in a plain email. Six of the fixes it made are below.
| Item | Gap found | What the shop did |
|---|---|---|
| R3 | A new VP of operations, not reported | Senior officer notice filed in DECCS; five-day rule added to the onboarding checklist |
| D3 | Two shared logins on the CAD vault | Named accounts only; USML folder limited to cleared staff |
| D4 | IT provider's help desk abroad can reach the file server | Written answer requested; USML data moved to a U.S.-person-only support tier |
| E1 | Drawings emailed to the plater in plain text | An end-to-end encrypted transfer tool for every drawing that leaves the shop |
| K2 | ERP keeps no edit history on traveller notes | Audit log switched on; notes locked after job close |
| V1 | No named person for a suspected violation | One-paragraph procedure; the owner and outside counsel named |
The encryption and help-desk fixes are product choices. The ITAR file sharing compare and the ITAR file transfer compare read the vendors against § 120.54, and the ITAR compliance software compare covers the tools that keep the screening, licence and records side in one place.
Where the rule says so
Two sentences carry most of the weight for a shop that builds to print. The first is why a shop with no export business still registers. The second is why a visitor or a help desk can turn into an export.
Rule textFor the purpose of this subchapter, engaging in such a business requires only one occasion of manufacturing or exporting or temporarily importing a defense article or furnishing a defense service. A manufacturer who does not engage in exporting must nevertheless register.
22 CFR 122.1(a), eCFR read 2026-10-23
Rule textAny release in the United States of technical data to a foreign person is deemed to be an export to all countries in which the foreign person has held or holds citizenship or holds permanent residency.
22 CFR 120.50(b), eCFR read 2026-10-23
22 CFR 120.5422 CFR 120.5622 CFR 122.522 CFR 127.12
ITAR and CMMC: the same drawings
The drawings this checklist protects are usually CUI as well. The CUI Registry's Export Control category (marking EXPT) includes items identified in the International Traffic in Arms Regulations (ITAR) and the munitions list. On a DoD contract that carries DFARS 252.204-7012, the systems that hold them also owe NIST SP 800-171: a separate duty with its own checklist. Check what is in force on the CMMC side today before you plan the work:
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
Start with whether a document is CUI, then run the NIST SP 800-171 checklist on the same systems. The GCC vs GCC High compare covers the Microsoft 365 choice most shops face at this point.
When the answer is an attorney or DDTC
A checklist finds the gaps. Some of them are not yours to close alone, and this page is not legal advice.
Caution
- You cannot tell whether a part is on the USML: DDTC decides, through a commodity jurisdiction request (DS-4076). Registration is not needed to file one.
- A foreign person may already have seen technical data, or a drawing went abroad without a licence: an export-compliance attorney, before you write to DDTC, because a voluntary disclosure has its own rules.
- You plan to hire a foreign national, take a foreign customer or sell the company to a foreign buyer: counsel first. A sale or transfer of control to a foreign person needs 60 days' notice to DDTC.
- A process question about registration or DECCS: DDTC's Response Team gives non-authoritative guidance by phone and email on weekdays.
Questions small shops ask
Is there an ITAR certification for a shop or a product?
No. The ITAR sets registration, licences, agreements and record duties; it has no certification step, and no product is ITAR certified. When a vendor says "ITAR compliant", ask what it does about U.S.-person access and encryption, item by item. The ITAR software compare asks exactly that.
We only machine parts for a U.S. prime and never export. Do we still register?
Yes, if the parts are defense articles. Anyone in the US who manufactures or exports defense articles or furnishes defense services must register with DDTC; a manufacturer who does not export must nevertheless register. New registrants pay the Tier 1 fee of $3,000 per year.
Can we keep ITAR drawings in a commercial cloud?
Only if the carve-out holds or access stays with U.S. persons. Sending, taking or storing technical data is not an export if it is unclassified, secured with end-to-end encryption, protected by FIPS 140-2 (or successor) cryptographic modules or by other means at least as strong as AES-128, not intentionally sent to a person in or stored in a country proscribed in 22 CFR 126.1, and not sent from such a country. If the provider holds the keys, its staff are part of your access question.
How long do we keep ITAR records?
Five years from the expiration of the licence or other approval, or from the date of the transaction (22 CFR 122.5(a)). Some guides cite § 123.26 for exemption records; that section is reserved today, so § 122.5 is the one to follow.
We found a mistake. What happens if we tell DDTC?
A voluntary disclosure can be a mitigating factor, not an amnesty. It starts with a notice immediately after the violation is discovered, a full disclosure within 60 calendar days, and senior management's knowledge and authorization (22 CFR 127.12). Talk to an export-compliance attorney before the first letter.
Does this checklist replace our CMMC or NIST SP 800-171 work?
No. ITAR asks who may see the data and where it may go; NIST SP 800-171 asks how the systems holding it are secured. Most shops with ITAR drawings need both. The CMMC scoping worksheet sorts the systems.
More free tools for the same shop are on the tools page.