What is ITAR Compliance?

The International Traffic in Arms Regulations (ITAR) is a regulation that restricts and controls the export of defense and space-related articles, technologies and services to safeguard United States national security and foreign policy objectives. The Directorate of Defense Trade Controls (DDTC), U.S. Department of State, administers the ITAR, which is outlined in the Electronic Code of Federal Regulations (e-CFR) – 22 CFR parts 120 through 130.

Your Guide to ITAR Compliance

Learn why complying with the International Traffic in Arms Regulation (ITAR) is important for your government contractor business and how to adhere to the requirement.

Get Your ITAR Guide

ITAR requires that access to technical data and physical materials related to defense and military technologies be restricted to only U.S. citizens on a secure, compliant network.

U.S.-based companies with overseas operations are prohibited from sharing ITAR technical data with employees local to those countries, unless State Department authorization is secured. U.S. companies that work with non-U.S. subcontractors are also subject to this rule. A few companies have secured exemptions, based on specific purposes, including Canada, the United Kingdom and Australia.

Because ITAR exists to track sensitive military and defense materials in order to keep them from foreign players, government contractors are required to put a documented ITAR compliance plan in place. The programs includes the tracking, monitoring and auditing of technical data. Every company in the supply chain of a contract or project – subcontractors, computer software/hardware vendors, third-party suppliers, wholesalers and distributors – also needs to be ITAR compliant and must be factored into the plan.

Your Guide to Government Compliance

Navigating compliance regulations can be difficult for even the most seasoned of government contractors. Get an overview of top priorities and how Costpoint provides a clear path to compliance.

Get Your Guide

Articles (the current list outlines 21 categories) and services are defined in the United States Munitions List (USML). Technical data outlined by ITAR includes plans, blueprints, photos, diagrams, drawings, instructions, and other documentation.

Categories on the United States Munitions List

1. Guns and armament
2. Firearms, close assault weapons and combat shotguns
3. Ordnance and ammunition
4. Nuclear weapons and related articles
5. Directed energy weapons
6. Surface vessels of war and special naval equipment
7. Ground vehicles
8. Aircraft and related articles
9. Spacecraft and related articles
10. Submersive vessels and related articles
11. Launch vehicles, guided missiles, ballistic missiles, rockets, torpedoes, bombs, and mines
12. Explosives and energetic materials, propellants, incendiary agents, and their constituents
13. Military training equipment and training
14. Personal protective equipment
15. Military electronics
16. Classified articles, technical data and defense services not otherwise enumerated
17. Articles, technical data and defense services not otherwise enumerated
18. Fire control, range finder, optical and guidance and control equipment, including night-vision goggles
19. Materials and miscellaneous articles
20. Toxicology agents, including chemical agents, biological agents, and associated equipment
21. Gas Turbine engines and related articles

Any company that manufactures, exports and/or brokers defense articles, services or is involved with related technical data must comply with ITAR requirements. This technical data is necessary for the development, design, production, manufacturing, operation, assembly, testing, maintenance, repair, or altering of an article.

To protect technical data, security strategies should be multi-layered and follow the standards and guidelines within the National Institute of Standards and Technology (NIST) special publication 800-53.

Principles to consider to ensure ITAR technical data compliance:

• Locate, classify and secure data as defined by business policies
• Identify and map administrators, users, groups, folders and file permissions
• Manage access controls
• Monitor and audit data, file activity and user behavior to detect security vulnerabilities and threats for remediation.

Penalties for ITAR non-compliance include civil and criminal fines.

• Civil fines: Up to $500,000 per violation
• Criminal fines: Up to $1 million per violation OR 10 years imprisonment per violation

The U.S. government also has the authority to take the additional measure of banning a company from any related future exports and imports.

In a massive global foreign bribery resolution, the United States Department of Justice issued details on an agreement with Airbus SE to pay over $3.9 billion in penalties involving ITAR non-compliance. A global provider of civilian and military aircraft based in France, their penalties included bribery charges with authorities in the U.S., France and the United Kingdom. Airbus planned to “use third-party business partners to bribe government officials, as well as non-governmental airline executives, around the world and to resolve the Company’s violation of the Arms Export Control Act (“AECA”) and its implementing regulations, the International Traffic in Arms Regulations (“ITAR”), in the United States,” according to a statement from the U.S. Department of Justice.

Currently, no formal certification process exists to become ITAR Compliant. Certain standards exist within the defense industry, however, that are important for building an ITAR compliance plan.

1. Register with the State Department – Specifically, the Directorate of Defense Trade Controls (DDTC).
2. Formalize ITAR Compliance Programs within your Business – Having formal programs and defined processes demonstrate a commitment to compliance and a framework for addressing issues.
3. Use a Compliant Cloud Storage – To ensure technical data is not accessible to foreign persons or nations, government business seeking ITAR compliance should consider having data centers managed solely by U.S. persons in U.S. locations.

In an effort to support the government contractors’ increasing cybersecurity and compliance demands, Deltek offers industry-leading solutions and cloud environments, providing enhanced cybersecurity controls to help protect data and meet strict federal compliance requirements.

Deltek has gone to great lengths to ensure our cloud environments meet the security and oversight demands of government agencies like the U.S. Department of State and Department of Defense. Costpoint GovCon Cloud (GCC) Moderate supports government contractors with meeting compliance requirements for the protection of Controlled Unclassified Information (CUI) and ITAR data in the Deltek Cloud, eliminating the burden of on-premises equipment. Deltek has implemented controls to align with government contracting requirements, such as NIST SP 800-53 and CSNI 1253. Costpoint GCCM has also achieved FedRAMP Moderate Ready status and is listed on the FedRAMP Marketplace.

As a software-as-a-service provider, Deltek covers approximately 75% of the required controls and shares in the responsibility of most of the remaining controls. Costpoint GCC Moderate customers share in the responsibility of meeting the FedRAMP Moderate control requirements beyond Deltek in terms of how they internally define process and procedures to secure technical data.