Framework Trade, Ethics & Franchise
ITAR
The International Traffic in Arms Regulations (22 CFR Parts 120 to 130) implement the Arms Export Control Act and control the export, temporary import, reexport, retransfer, and brokering of defense articles, defense services, and related technical data listed on the United States Munitions List.
The regulations are administered by the Directorate of Defense Trade Controls (DDTC) in the State Department's Bureau of Political-Military Affairs. Any US person who manufactures, exports, or brokers defense articles or services must register with DDTC and pay an annual fee, whether or not they ever export.
Exports and transfers require a license or an exemption, and releasing controlled technical data to a foreign person inside the United States (including a foreign national employee) counts as an export.
ITAR does not mandate a compliance program in so many words, but DDTC's published compliance program guidelines, the consent agreements that follow enforcement actions, and the record-keeping rule in 22 CFR 122.5 make one unavoidable.
In writing, a registrant needs current registration, an appointed empowered official, a written export compliance manual, jurisdiction and classification determinations for its products and data, license and exemption records, technology control plans for facilities and IT systems that hold technical data, foreign person access controls and screening records, training records, records of Part 130 fee and commission reporting, and a procedure for voluntary disclosure when something goes wrong.
Records must be kept for five years from the expiration of the license or the date of the transaction.
Who has to comply
Any person in the United States who manufactures, exports, temporarily imports, or brokers defense articles or defense services, or furnishes technical data, must register (with narrow exemptions). Compliance duties extend to US persons abroad and to foreign parties who receive ITAR-controlled items.
Defense primes routinely require ITAR registration and compliance representations from subcontractors.
What the assessor asks to see
DDTC compliance staff, prime contractors, and auditors typically ask for: registration letter and empowered official designation; export compliance manual; product and technical data jurisdiction and classification records; license, exemption, and agreement files with shipping and transfer records; technology control plan and facility and IT access controls; foreign person screening and visitor logs; restricted party screening records; training records; Part 130 reports; internal audit reports and corrective actions; voluntary disclosure files; five-year record retention evidence.
Where the requirement sits: 22 CFR 122.5 records (5 years); DDTC Compliance Program Guidelines; technology control plans
What AllyMatter does here
Controls the compliance programme documents and TCP with staff acknowledgment.
AllyMatter publishes this site.
Assessors
Who assesses ITAR
DDTC's Office of Defense Trade Controls Compliance conducts company visits, reviews disclosures, and enforces; the Department of Justice prosecutes criminal violations. No private certifier exists; "ITAR certified" claims by vendors are marketing shorthand for being registered and having a program.
No firm has claimed a ITAR assessor listing yet. Claim yours →
Consultants
Who helps with ITAR
Trade compliance law firms and consultancies build export compliance manuals, classify products, prepare license applications and agreements (TAAs, MLAs), design technology control plans, and run internal audits. Managed service providers offer ITAR-scoped IT environments.
Engagements range from a few weeks for registration and a manual to ongoing outsourced compliance management.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
No firm has claimed a ITAR consultant listing yet. Claim yours →
Software
Tools for ITAR
Tools that name this framework in their own material.
Related reading
- DDTC issues ITAR compliance program guidelinesSummarises the elements DDTC expects in a written compliance programme and how it weighs them in enforcement.Baker McKenzie
- Understanding the DDTC registration processCovers who has to register, the annual renewal cycle and the disclosures DDTC requires with the application.CTP
- Registering as an exporter under ITAR with DDTC: a step-by-step guidePractical walkthrough of DECCS registration, empowered official designation and the records a registrant must keep.Defense Trade Solutions
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Find a Consultant for ITAR
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Run the Policy Side of ITAR in AllyMatter
Approve the policies ITAR asks for, keep every version, and record a named acknowledgment from each person who has to read them.