What Is ITAR Compliance? A Practical Guide for Defense Supply Chain Teams

One unregistered supplier in a defense supply chain can create legal exposure for everyone involved. That, in part, is the risk ITAR was designed to minimize.

Yet for all the weight it carries, most of the guidance written about what ITAR compliance is written for lawyers. This article is for engineers, sourcing managers, and procurement leads who need to understand what ITAR compliance actually requires, how to recognize when it applies, and how to verify that your suppliers are properly registered.

Firstar is ITAR registered and works regularly with defense programs and the supply chains that support them. The questions we address below will help engineering and sourcing teams approach their next supplier qualification with confidence.

What Is ITAR Compliance?

ITAR — the International Traffic in Arms Regulations — is part of Title 22 of the Code of Federal Regulations (CFR), or 22 CFR Parts 120–130. Administered by the U.S. Department of State, ITAR governs the manufacturing, export, temporary import, and handling of defense articles and related technical data. These standards implement the provisions of the Arms Export Control Act (AECA), originally enacted in 1976 to further protect national security against foreign persons.

Its scope is broad: ITAR applies not only to finished weapons systems, but to components, assemblies, blueprints, drawings, specifications, and any technical data associated with items on the U.S. Munitions List (USML).

For a machine shop, that means ITAR can apply at the moment you receive a piece of Controlled Unclassified Information (CUI) — before a single part is ever cut. If a manufacturing program is part of USML-listed end items or includes defense-controlled specifications, ITAR compliance requirements extend to every supplier who touches that work.

ITAR can commonly be confused with the Export Administration Regulations (EAR), but the two are distinctly different. While ITAR is specific to items on the USML for military applications, EAR governs items that are considered “dual use” for both commercial and military operations. EAR is administered by the Department of Commerce’s Bureau of Industry and Security (BIS) and covers items on the Commerce Controls List (CCL).

An Overview of the United States Munitions List (USML)

The USML is the master list of defense articles and defense services subject to ITAR control. It is organized into 21 categories, including:

• Guns and armament
• Military electronics
• Fire control
• Military training
• Aircraft, submersible vessels, spacecraft, and launch vehicles
• Bombs, explosives, torpedoes, mines, directed energy weapons, nuclear weapons, and classified articles
• Incendiary agents, biological agents, and toxicological agents
• Gas turbine engines
• Personal protective equipment

Each category encompasses finished systems as well as the components, subassemblies, and technical data used to produce them.

The practical implication for machined components is that a part does not need to look like a weapon to fall under USML coverage. Precision-machined components, custom fasteners, structural assemblies, and actuator parts produced for defense programs can all carry USML classification depending on their end use and the specifications they were manufactured to.

If you’re unsure whether a part or program falls under USML coverage, the conservative approach is to treat it as ITAR-controlled until you receive confirmation otherwise from your legal counsel.

The Penalties for ITAR Violations

The Directorate of Defense Trade Controls (DDTC) is the branch of the U.S. Department of State responsible for administering and enforcing ITAR.

Its core functions include:

• Managing company registrations
• Reviewing and issuing export licenses
• Providing policy guidance
• Pursuing enforcement actions against ITAR violations

One distinction worth understanding: Registration and licensing are separate. Registration is a prerequisite which establishes your company in the DDTC system and is required before any license or approval can be issued. An export license, when required, authorizes a specific transaction or category of transactions to U.S. persons. A registered company is not automatically authorized to export ITAR-controlled items; that requires a separate license or applicable exemption.

Enforcement is not theoretical. DDTC violations carry civil penalties up to $1.3 million per violation and criminal penalties including fines and imprisonment. Violations can also result in debarment from future defense contracting.

How a Company Becomes ITAR Registered

Companies that manufacture or export defense articles or related technical data are required to register with the DDTC. Registration is completed through the DDTC’s online portal and requires disclosure of company information, ownership structure (including any foreign ownership), and the categories of USML items the company manufactures or exports.

Registration is subject to an annual fee and must be renewed each year. It is not a one-time certification. Companies must also promptly notify DDTC of material changes to their registration information, including changes in ownership or business structure.

Part 122 of the ITAR is direct about what registration does and does not mean:

“Registration is primarily a means to provide the U.S. Government with necessary information on who is involved in certain manufacturing and exporting activities. Registration does not confer any export rights or privileges. It is generally a precondition to the issuance of any license or other approval under this subchapter, unless an exception is granted by the Directorate of Defense Trade Controls.”

In other words, ITAR registration tells the government who you are and what you’re making. It does not authorize you to export anything. Firstar is ITAR registered, which means we’re in good standing with DDTC and eligible to work on ITAR-controlled programs — with appropriate controls in place for record-keeping and how we handle controlled technical data.

ITAR Compliance vs. CMMC Compliance

ITAR and Cybersecurity Maturity Model Certification (CMMC) are two different compliance frameworks in defense contracting.

ITAR governs the export and transfer of defense-related services, articles, and data. The main focus is what information can be shared and with whom, specifically restricting access to foreign nationals.

CMMC (Cybersecurity Maturity Model Certification) governs how that information is protected once it’s in your systems. It’s a cybersecurity framework rather than an export control.

Defense primes vetting suppliers should evaluate both of these independently. ITAR registration tells you a supplier is in good standing with the DDTC; CMMC Certification tells you they have the systems to protect controlled unclassified information.

Types of Contracts That Require ITAR Compliance

ITAR compliance requirements attach to programs and contracts, not just companies. Common scenarios where ITAR applies include:

• Defense prime contracts and subcontracts involving USML-listed end items or components
• Any program where controlled technical data — drawings, specifications, performance parameters — is shared with the supplier, even if no hardware is exported
• Tier 1 and Tier 2 supplier work on Department of Defense-funded programs, even when the supplier’s contract is with a prime contractor rather than the government directly
• Foreign Military Sales (FMS) programs, where U.S. defense articles are sold to foreign governments through the U.S. government

If a manufacturing program is DoD-funded or involves items that appear on the USML, all suppliers are likely required to be ITAR registered. Even if you are unsure, the cost of an unnecessary compliance step is trivial compared to the cost of a violation.

How to Evaluate and Verify a Supplier’s ITAR Registration

During supplier qualification for ITAR-covered work, ask for their DDTC registration number and a copy of the current registration certificate. You may also ask for documentation of internal access controls for controlled technical data (who can access drawings, how they’re stored, how access is revoked).

Some red flags to keep an eye out for include:

• Reluctance to disclose registration status
• No documented data-handling procedures
• A compliance program that exists on paper but can’t be described in practice

A mature ITAR compliance posture is not a certificate on the wall, but a set of operational controls that limit access to controlled data and create an auditable record.

At Firstar, our ITAR compliance covers controlled drawing access, employee training, and data-handling procedures. When we qualify for a new defense program, our registration code and additional certifications are made available.

The Bottom Line

ITAR compliance is supply chain risk management for the entire U.S. defense system. A single unregistered or non-compliant supplier can create legal exposure for any government contract, which is why evaluating registration status and compliance is part of responsible supplier qualification.

When qualifying suppliers for defense work, the key questions are:

• Are they ITAR registered? And is the registration current?
• Do they have documented controls for handling controlled technical data?
• Can they describe their compliance program in operational terms, not just on paper?
• Are they transparent about their registration status and willing to document it?

If you’re qualifying suppliers for defense programs and want to understand how Firstar handles ITAR-controlled work, we’re straightforward about our registration status and compliance practices. Contact us to start a capabilities conversation.

This article is intended for general informational purposes only and does not constitute legal advice. ITAR compliance obligations are fact-specific and program-specific. Consult qualified legal counsel for guidance on your company’s specific compliance requirements.