ITAR Compliance Services That Keep Controlled Technical Data in the Right Hands

Often, yes. Any U.S. business that manufactures defense articles must register with DDTC even if it never ships anything overseas. ITAR also treats releasing technical data to a foreign person inside the U.S. as an export, so an email, a screen share, or a shop-floor tour can create a violation without anything leaving the country. If you build parts to a defense print or receive controlled drawings from a prime, ITAR likely affects how you store and share that data.

Technical data is information needed to design, develop, produce, manufacture, assemble, operate, repair, test, maintain, or modify a defense article. That includes blueprints, drawings, CAD models, specifications, photographs, plans, and instructions. General marketing material, basic science taught in schools, and information already in the public domain generally aren't technical data. Your prime contractor or export counsel can help you confirm how specific files are classified.

Yes, if it's handled correctly. Under 22 CFR 120.54, sending or storing unclassified technical data isn't an export if the data is protected with end-to-end encryption using FIPS 140-2 compliant modules (or an equivalent standard of at least 128-bit strength), the cloud or email provider never has the means to decrypt it, and it isn't intentionally sent to or stored in a country on the ITAR proscribed list or in Russia. Everyday cloud storage that relies on the provider's own encryption keys doesn't meet that standard. Many defense suppliers also move to a U.S.-controlled environment such as Microsoft 365 GCC High, where data and administrator access stay in the U.S. We help you choose and set up the right approach.

ITAR is an export control regulation from the State Department. It governs who can receive defense articles and technical data. DFARS 252.204-7012, NIST SP 800-171, and CMMC come from the Department of War (formerly the Department of Defense) and set the cybersecurity safeguards contractors must use to protect Controlled Unclassified Information (CUI). ITAR technical data on a defense contract is usually also CUI, so many defense suppliers have to meet both sets of requirements. We build environments that support both.

Civil penalties can reach $1,271,078 per violation or twice the value of the transaction, whichever is greater, under the 2025 inflation adjustment. Willful violations can bring criminal fines of up to $1 million and up to 20 years in prison per violation. Companies and individuals can also be debarred from defense trade. In April 2026, GE Aerospace agreed to a $36 million settlement with the State Department to resolve 116 ITAR violations, including unauthorized exports of technical data.

Act quickly, but don't delete anything. Stop further access to the data, preserve emails, files, and access logs, and bring in your export compliance lead or export counsel right away. DDTC encourages voluntary disclosures under ITAR 127.12 and treats them as a mitigating factor when deciding penalties. Then call us at 401-522-5200. We help you lock down access, pull the logs that show who saw what, and close the gap so it doesn't happen again.

No, and be cautious of anyone who says they can. There is no such thing as an ITAR certification. Registration with DDTC, export licenses, and decisions about what is controlled are handled by your company and its export counsel. Our role is the technology: we put the safeguards in place that keep controlled technical data restricted, encrypted, and tracked, and we document them so you can show your work to a prime or a regulator.