# ITAR Compliance Checklist for Defense Manufacturers > Source: https://netray.co/tools/itar-compliance-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A 32-point checklist covering DDTC registration, technical data controls, foreign person access, IT security, and recordkeeping for ITAR-regulated manufacturers. ## Category aerospace-defense ## Tool **Kind:** checklist **Groups:** #### Registration and Program Governance **Items:** **Text:** Company is registered with the Directorate of Defense Trade Controls (DDTC) and registration is current **Critical:** true A named Empowered Official is designated, trained, and documented A written ITAR compliance program manual exists and is reviewed at least annually Senior management has issued a signed commitment statement to export compliance **Text:** All products and technical data are classified against the U.S. Munitions List (USML), with commodity jurisdiction requests filed where jurisdiction is unclear **Critical:** true Compliance responsibilities are assigned to specific roles, not just to one person #### Technical Data Controls **Items:** **Text:** ITAR technical data (drawings, specs, models, source code) is identified and marked with export control legends **Critical:** true ERP, PLM, and file systems segregate ITAR technical data from uncontrolled data **Text:** Access to ITAR technical data is restricted to authorized U.S. persons on a need-to-know basis **Critical:** true Email and file transfer of technical data is controlled; no ITAR data in unauthorized cloud or personal accounts Engineering change and quoting processes check export control status before sharing data with suppliers Defense articles and technical data provided by customers are logged and handled under the same controls #### Personnel and Foreign Person Access **Items:** **Text:** Employment screening verifies U.S. person status (citizen, permanent resident, or protected person) before granting ITAR access **Critical:** true Foreign person employees, contractors, and visitors are identified and access-restricted or covered by an approved license (e.g., DSP-5) Visitor procedures include escorts, badging, and camera/phone restrictions in controlled areas All employees with ITAR exposure receive documented training at hire and annually Facility tours, trade shows, and supplier visits are reviewed for deemed export risk HR notifies the compliance function of changes in employee citizenship or immigration status #### Physical and IT Security **Items:** Controlled areas where defense articles or technical data are handled have physical access restrictions **Text:** IT systems hosting ITAR data are located in the U.S. and administered only by U.S. persons **Critical:** true **Text:** Cloud services used for ITAR data meet DDTC's end-to-end encryption carve-out or are ITAR-qualified (e.g., GovCloud) **Critical:** true Remote access to ITAR systems is restricted, MFA-protected, and blocked from foreign locations Mobile devices and laptops that may hold technical data are encrypted and covered by travel procedures Printers, scanners, and shared drives in engineering areas are covered by data handling procedures #### Exports, Shipments, and Brokering **Items:** **Text:** Every export of hardware or technical data is authorized by a license, agreement (TAA/MLA), or documented exemption **Critical:** true License conditions and provisos are recorded and communicated to affected staff before performance Restricted party screening is performed on all customers, suppliers, freight forwarders, and end users Shipping documentation (EEI filings, destination control statements) is accurate and retained Temporary exports (demos, repairs, trade shows) are covered by appropriate licenses or exemptions Any brokering activities are identified and separately registered and reported as required #### Recordkeeping, Audits, and Violations **Items:** Export records, licenses, and screening evidence are retained for at least 5 years Internal ITAR audits are performed at least annually with documented findings and closure **Text:** A documented procedure exists for investigating and voluntarily disclosing suspected violations **Critical:** true Corrective actions from audits and incidents are tracked to completion Subcontractors and suppliers handling ITAR data are flowed down requirements and periodically verified **Scoring Note:** Score yourself honestly: every unchecked critical item represents exposure to civil penalties that can exceed $1M per violation, plus potential debarment from defense contracting. If you cannot check all critical items, treat those gaps as your immediate remediation priorities and consider whether a voluntary disclosure conversation with counsel is warranted. ## Content **Intro:** This free ITAR compliance checklist gives defense manufacturers a structured 32-point review of their export compliance program, from DDTC registration through technical data controls, foreign person access, IT security, licensing, and recordkeeping. It is built for machine shops, electronics manufacturers, and assemblies suppliers who make USML-listed hardware or handle ITAR technical data flowed down from primes. Work through each group with your compliance, engineering, IT, and HR leads; the critical-flagged items are the ones that most often trigger consent agreements and seven-figure penalties when they fail. **Sections:** #### How this checklist is organized **Body:** The checklist follows the structure DDTC expects to see in a functioning compliance program: governance and registration first, because nothing else matters if you are unregistered or have misclassified your products; then the operational controls - technical data handling, personnel screening, and IT security - where day-to-day violations actually occur; and finally transactional controls and recordkeeping, which is what investigators pull first. Critical items are flagged where enforcement history shows the highest penalty exposure: unregistered manufacturing, unmarked technical data, foreign person access without authorization, non-compliant cloud storage, and unauthorized exports. Roughly a quarter of the items carry that flag, which mirrors how consent agreements distribute their findings. #### Where manufacturers most often fail **Body:** Enforcement patterns are consistent across recent DDTC consent agreements, and four failure modes dominate for mid-market manufacturers: **Bullets:** - Technical data leakage - ITAR drawings emailed to offshore suppliers or stored in commercial cloud tools without the encryption carve-out - Deemed exports - foreign person employees or visitors given access to controlled data without a license, often because HR and engineering never compared notes - Registration and classification gaps - companies manufacturing USML items for years without DDTC registration, or assuming EAR jurisdiction without analysis - Recordkeeping failures - inability to produce screening evidence, license records, or training documentation during an audit or disclosure #### Interpreting your gaps and prioritizing **Body:** If any critical item is unchecked, that is your remediation priority regardless of how the rest of the checklist looks - these are the gaps that convert from compliance debt into violations. Sequence remediation in three passes. First, stop ongoing exposure: restrict access, quarantine data, pause questionable transfers. Second, fix the systemic control - the process, marking standard, screening step, or system configuration that let the gap exist. Third, assess look-back exposure with export counsel and decide whether voluntary disclosure is appropriate; DDTC treats disclosure as a significant mitigating factor. Re-run the checklist quarterly, and after any acquisition, new program win, ERP change, or cloud migration, because those events reliably reopen closed gaps. #### How Netray helps you close ITAR gaps **Body:** Most ITAR technical data at a manufacturer does not sit in a compliance tool - it sits in your ERP and the systems around it: item masters, routings, drawings attached to jobs in SyteLine or LN, supplier portals, and quoting emails. Netray helps you find and control that data where it actually lives. We implement export-control flags and access segregation inside Infor SyteLine, LN, and Baan, design ITAR-compliant data architectures including GovCloud and on-prem options, and deploy on-prem AI so your teams get modern automation without technical data ever leaving your controlled boundary. If this checklist surfaced gaps, we can turn them into a sequenced remediation plan. **Cta:** Run through the checklist with your team, then send yourself the results to anchor your ITAR remediation plan. **Faq:** #### Do I need to register with DDTC if I only make parts for a prime contractor? **Answer:** If you manufacture defense articles - items described on the U.S. Munitions List - you must register with DDTC even if you never export anything and even if you are a lower-tier subcontractor. Registration is required for manufacturing alone. Many machine shops discover this obligation years late. If you are unsure whether your parts are USML-controlled, a jurisdiction and classification analysis should be your first step, and your prime's flowdown clauses are a strong hint. #### Can I store ITAR technical data in the cloud? **Answer:** Yes, under conditions. DDTC's encryption carve-out allows properly end-to-end encrypted technical data to transit or be stored in cloud infrastructure without it being an export, provided keys are not accessible to foreign persons. Alternatively, ITAR-qualified environments like AWS GovCloud or Azure Government restrict data to U.S. regions and U.S.-person support staff. Standard commercial tenants of consumer SaaS tools generally do not qualify, which is where most violations occur. #### What happens if I find a past violation while working through this checklist? **Answer:** Stop the ongoing conduct, preserve records, and engage export counsel before communicating broadly. DDTC operates a voluntary disclosure program and treats self-disclosure as a major mitigating factor - most disclosed cases resolve without monetary penalty. The worst path is discovering an issue, fixing it quietly, and having it surface later through an audit, a whistleblower, or a prime's investigation, at which point the lack of disclosure itself aggravates the outcome. ## Search terms itar compliance checklist, itar requirements for manufacturers, ddtc registration checklist, itar technical data controls, foreign person access itar, itar compliance program, usml classification checklist --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json