ConsilienTorrance, California, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
ITAR
The International Traffic in Arms Regulations (22 CFR Parts 120 to 130) implement the Arms Export Control Act and control the export, temporary import, reexport, retransfer, and brokering of defense articles, defense services, and related technical data listed on the United States Munitions List.
The regulations are administered by the Directorate of Defense Trade Controls (DDTC) in the State Department's Bureau of Political-Military Affairs.
Any person who engages in the United States in the business of manufacturing, exporting or temporarily importing defense articles, or furnishing defense services, must register with DDTC (with narrow exemptions) and pay an annual fee, whether or not they ever export; brokers register under separate rules (Part 129).
Since January 9, 2025 the fee is $3,000 a year for a first-tier registrant, $4,000 for the second tier, and $4,000 plus $1,100 for each approval over five for the third tier. Exports and transfers require a license or an exemption, and releasing controlled technical data to a foreign person inside the United States (including a foreign national employee) counts as an export.
ITAR does not mandate a compliance program in so many words, but DDTC's published compliance program guidelines, the consent agreements that follow enforcement actions, and the record-keeping rule in 22 CFR 122.5 make one unavoidable.
In writing, a registrant needs current registration, an appointed empowered official, a written export compliance manual, jurisdiction and classification determinations for its products and data, license and exemption records, technology control plans for facilities and IT systems that hold technical data, foreign person access controls and screening records, training records, records of Part 130 fee and commission reporting, and a procedure for voluntary disclosure when something goes wrong.
Records must be kept for five years from the expiration of the license or the date of the transaction.
Recent changes: an exemption for defense trade with Australia and the United Kingdom under the AUKUS partnership took effect in 2024 and was finalized on December 30, 2025, and the Munitions List has been revised several times, with further removals taking effect on October 19 and November 20, 2026.
New to this? Read ITAR explained simply →
Share
Ad from the publisher
Policy Acknowledgment Proof
AcknowledgedTCP v3by name, on record
No Deemed Exportswith AllyMatter
Export-Control the Modern WayYour technology control plan, acknowledged by every US person on it
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee on record
Who read which version, and when
03
Show DDTC the trail
From $29/mo, 20 editors, unlimited staff (published)
Who has to comply
Any person in the United States who manufactures, exports, temporarily imports, or brokers defense articles or defense services, or furnishes technical data, must register (with narrow exemptions). Compliance duties extend to US persons abroad and to foreign parties who receive ITAR-controlled items.
Defense primes routinely require ITAR registration and compliance representations from subcontractors.
What the assessor asks to see
DDTC compliance staff, prime contractors, and auditors typically ask for: registration letter and empowered official designation; export compliance manual; product and technical data jurisdiction and classification records; license, exemption, and agreement files with shipping and transfer records; technology control plan and facility and IT access controls; foreign person screening and visitor logs; restricted party screening records; training records; Part 130 reports; internal audit reports and corrective actions; voluntary disclosure files; five-year record retention evidence.
Where the requirement sits: 22 CFR 122.5 records (5 years); DDTC Compliance Program Guidelines; technology control plans
Every internal policy in one place
AllyMatter is a full system for every internal policy your company keeps, including the ones ITAR turns on. Build the whole library in one place, across every department, and prove who has read what.
Start here
Employee Handbook Acknowledgment: who needs it, what goes in it, how often it is reviewed and who signs it off. Run exactly that in AllyMatter, alongside every other policy your company keeps.
How it works
Every document is approved by someone other than its author, versioned, distributed to the people it covers and acknowledged by name. Sign it where a signature is what the standard wants, send a set out together as a package, and export a dated record of who read which version when an assessor asks.
The written policies this standard turns on live here, with every version and every acknowledgment on the record.
Who helps with ITAR
Trade compliance law firms and consultancies build export compliance manuals, classify products, prepare license applications and agreements (TAAs, MLAs), design technology control plans, and run internal audits. Managed service providers offer ITAR-scoped IT environments.
Engagements range from a few weeks for registration and a manual to ongoing outsourced compliance management.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
Atlant SecurityUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
MeriplexHouston, TX, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, SOC 2, HIPAA, PCI DSS, CMMC and more.
- Standards
- Pricing
- Not published
Integrate CyberAustin, TX, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Glocal Insight LLCKansas City, MO, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, SOC 2, ISO 9001, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
IQC The ISO Professionals (ISO Pros)USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, ISO 9001, CMMC, NIST 800-171, ISO 14001 and more.
- Standards
- Pricing
- Not published
My ISO ConsultantsCrestline, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, SOC 2, ISO 9001, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
CVG Strategy LLCViera, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, ISO 9001, CMMC, NIST 800-171, ISO 13485 and more.
- Standards
- Pricing
- Not published
Eagle GroupTroy, Michigan, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, ISO 27001, ISO 9001, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
Quality Systems Enhancement (QSE), Inc.Roswell, Georgia, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, ISO 27001, ISO 9001, CMMC, ISO 14001 and more.
- Standards
- Pricing
- Not published
Next7 ITCranberry Township, PA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, CMMC, NIST 800-171, DFARS.
- Standards
- Pricing
- Not published
Cape EndeavorsMyrtle Beach, SC, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, CMMC, NIST 800-171, DFARS.
- Standards
- Pricing
- Not published
CMMC Advisors, IncUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, CMMC, FedRAMP.
- Standards
- Pricing
- Not published
DTSArlington, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
CorpInfoTechCharlotte, NC, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
CorporateTechIrvine, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, SOC 2, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
Covenant Technology Solutions, Inc.Gladstone, OR, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, ISO 27001, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
ExcalTechRolling Meadows, IL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, ISO 27001, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
F1 Cloud SolutionsManassas, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
How to GRCHomer, AK, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, ISO 27001, SOC 2, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
NetCov (Network Coverage)Danvers, MA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, ISO 27001, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
Propel TechnologyWestminster, CO, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
SWICKtechNew Berlin, WI, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, SOC 2, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
SysAudits, LLCWilliamsburg, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, SOC 2, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
TrifidentOldsmar, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, SOC 2, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
Workplace ITDenver, CO, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, SOC 2, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
Jones ITSan Francisco, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for ITAR, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Who assesses ITAR
DDTC's Office of Defense Trade Controls Compliance reviews voluntary disclosures and handles compliance matters; civil penalties are imposed by the State Department's Assistant Secretary for Political-Military Affairs, Customs and Border Protection and Immigration and Customs Enforcement enforce at the border, and the Department of Justice prosecutes criminal violations.
No private certifier exists; DDTC states that registration is not a certification of ITAR compliance, so "ITAR certified" is marketing shorthand for being registered and having a program.
Assessors
Be the first ITAR assessor listed here
This page is read by the organizations looking for someone to certify them.
Tools for ITAR
Tools that name this framework in their own material.
Grouped by type. Inside each group the order is random, reshuffled each time the page loads. AllyMatter, the publisher of this site, is always first.
AllyMatterPolicy management tool, the policy and acknowledgment layerPublisher of this siteGRC and compliance automation1 tool
Controls, evidence and audit workflows, with a policy module inside.
QMS and EQMS suites1 tool
Document control for quality systems; ISO 9001, 13485 and AS9100 shops.
Related reading
- DDTC issues ITAR compliance program guidelinesSummarizes the elements DDTC expects in a written compliance program and how it weighs them in enforcement.Baker McKenzie
- Understanding the DDTC registration processCovers who has to register, the annual renewal cycle and the disclosures DDTC requires with the application.CTP
- Registering as an exporter under ITAR with DDTC: a step-by-step guidePractical walkthrough of DECCS registration, empowered official designation and the records a registrant must keep.Defense Trade Solutions
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Sources
DDTC: Getting and staying in compliance with the ITARDDTC: International Traffic in Arms Regulations (ITAR) overvieweCFR: 22 CFR Part 122, registration of manufacturers and exporters (including fees)eCFR: 22 CFR Part 120, purpose and definitionsFederal Register: ITAR registration fee rule (December 10, 2024, effective January 9, 2025)DDTC: ITAR Compliance Program Guidelines
Need a hand implementing it?
Find a Consultant for ITAR
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Run the Policy Side of ITAR in AllyMatter
Approve the policies ITAR asks for, keep every version, and record a named acknowledgment from each person who has to read them.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff