ITAR Compliance
for SoCal's defense industrial base.

ITAR (International Traffic in Arms Regulations) is the US export control regime administered by the State Department's Directorate of Defense Trade Controls (DDTC). It governs the export, re-export, and brokering of defense articles, defense services, and technical data on the United States Munitions List (USML). Any US person or company that manufactures, designs, develops, exports, or provides defense services for items on the USML must comply — including primes, tiered suppliers, machine shops, engineering services firms, universities with ITAR-controlled research, and the IT and cybersecurity vendors supporting them. The annual DDTC registration is the entry point; the technical and IT controls follow.

ITAR (State Department) covers defense articles on the USML — items specifically designed or modified for military application. EAR (Export Administration Regulations, administered by the Commerce Department's Bureau of Industry and Security) covers dual-use items on the Commerce Control List (CCL) — items with both civilian and military applications. ITAR is generally stricter: most ITAR-controlled technical data cannot be released to foreign persons without an export license, even inside the US (deemed export). EAR allows more license exceptions. Some items moved from USML to CCL through Export Control Reform — classification of a specific item matters more than the general framework.

ITAR is the export control framework — what you can do with defense articles and technical data. CMMC and NIST 800-171 are the cybersecurity frameworks — how you must protect Controlled Unclassified Information including ITAR-controlled technical data. Most ITAR technical data is also CUI, so ITAR-regulated businesses typically need both frameworks operating together. WCC's compliance practice runs them as an integrated program — Technology Control Plan, SSP, POA&M, GCC High tenancy, FIPS encryption, and foreign person access controls all coordinated rather than siloed.

A Technology Control Plan documents how the company will protect ITAR-controlled technical data from unauthorized access — particularly by foreign persons. It identifies the controlled data, the physical and IT systems where it lives, the personnel authorized to access it, the procedures for granting and revoking access, the screening processes, training requirements, recordkeeping, and incident response. Most TCPs cover IT controls (network segmentation, access control, encryption, logging), physical controls (badge access, visitor controls, escort policies), and administrative controls (training, agreements, screening). The TCP is the central document a DDTC compliance review or audit will examine.

A deemed export is the release of ITAR-controlled technical data to a foreign person inside the United States — through email, file share, conversation, demonstration, or even visual access to a screen. Under ITAR, this is treated as an export to the foreign person's country of nationality and typically requires a license. Most US companies discover deemed export issues when foreign national employees, contractors, or interns access systems containing ITAR technical data. Proper controls require knowing which employees are foreign persons, controlling their access to ITAR data systems, and documenting authorization. The IT systems need to enforce this — not rely on employee discretion.

ITAR doesn't prescribe specific IT controls the way NIST 800-171 does, but DDTC enforcement actions and industry practice make several controls essentially mandatory: US-person-only cloud tenancy (Microsoft GCC High, AWS GovCloud, or Google Workspace for Government) for systems handling ITAR technical data; FIPS 140-2/3 validated encryption for data at rest and in transit; strong identity and access control with MFA; network segmentation isolating ITAR systems; comprehensive audit logging; deemed-export tracking in identity systems; and 5-year recordkeeping. Email handling of ITAR data requires either licensed encryption or a separate ITAR-only mail path.

Civil penalties run up to $1 million per violation. Criminal penalties run up to 20 years imprisonment and $1 million criminal fine per violation. Beyond direct penalties, companies face debarment from federal contracts, suspension of export privileges, and the substantial cost of consent agreements (DDTC consent agreements have run $20-$80 million for major violators). Voluntary disclosure of violations to DDTC typically results in substantially reduced penalties — most experienced ITAR programs include a voluntary disclosure policy.

ITAR compliance preparation runs through five phases. Phase 1: jurisdiction analysis (what items are ITAR-controlled, what's EAR, what's uncontrolled). Phase 2: DDTC registration (annual, required before any ITAR activity). Phase 3: Technology Control Plan authorship covering personnel, IT systems, physical controls, training, and recordkeeping. Phase 4: IT implementation — GCC High tenancy, FIPS encryption, MFA, segmentation, and the deemed-export tracking in identity systems. Phase 5: ongoing operations — training, screening, recordkeeping, audit, and voluntary disclosure procedures. Implementation typically runs 4 to 12 months depending on starting maturity.