# ITAR Compliance Checklist (PDF) for Manufacturers, Exporters, Importers, Software and Universities > Source: https://netray.co/tools/itar-compliance-checklist-by-role-pdf > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A role-based ITAR checklist covering manufacturers, exporters, importers, software and ERP access, research and training, and MLA/TAA basics. ## Category compliance-legal ## Industry Aerospace and Defense ## Region United States ## Audience - Export compliance - Machine shop - University research office - IT manager ## Tool **Kind:** checklist **Scoring Note:** Tick what is done and documented. Critical items are legal gatekeepers: a gap in any of them should be fixed before you ship, share data or start work. **Groups:** #### Manufacturer or machine shop **Items:** **Text:** Registered with DDTC under 22 CFR Part 122 and renewed on time **Critical:** true **Text:** Empowered official named with authority to sign and to refuse **Critical:** true Every part, drawing and program classified against the USML or confirmed EAR Customer flow-down clauses reviewed for ITAR markings and handling **Text:** Technical data stored only in controlled folders with named access **Critical:** true Physical access to ITAR work areas controlled with visitor log and escort Scrap, rework drawings and CNC programs handled as technical data #### Exporter **Items:** **Text:** Jurisdiction and classification confirmed before any export **Critical:** true **Text:** License, agreement or exemption identified for each transfer **Critical:** true Consignee, end user and end use screened against restricted party lists **Text:** Part 126.1 proscribed country check completed **Critical:** true Electronic Export Information filed where required and AES records kept License provisos, quantity and value drawdown tracked **Text:** Records kept at least five years from the end of the transaction or license **Critical:** true #### Importer **Items:** **Text:** Determine whether the import is permanent (ATF under 27 CFR Part 447) or temporary (DDTC DSP-61) **Critical:** true Temporary import authorization obtained before the goods arrive Exporter of record and re-export plan documented for temporary imports Customs broker briefed on ITAR and the correct entry type Imported defense articles tracked in inventory with the authorization reference #### Software, IT and ERP access **Items:** **Text:** ERP roles and file shares restricted to verified U.S. persons for ITAR data **Critical:** true Citizenship or status evidence recorded in HR before access is granted **Text:** Email, cloud and AI services keep technical data in U.S.-based, U.S.-person-administered environments **Critical:** true End-to-end encryption in line with DDTC guidance for data in transit and at rest Remote access uses multi-factor authentication and is logged Vendors and managed service providers with data access screened and under contract Access reviews run quarterly and on termination #### University, research and training **Items:** **Text:** Project reviewed to decide whether it is fundamental research or subject to export controls **Critical:** true Sponsor restrictions on publication or foreign national participation identified **Text:** Foreign national students, staff and visitors screened for access to controlled labs and data **Critical:** true Technology control plan approved for controlled projects Defense services training and foreign travel with equipment reviewed by the export office Annual ITAR awareness training completed and attendance recorded #### Manufacturing license agreement and TAA basics **Items:** **Text:** Agreement type chosen: MLA for foreign manufacturing of defense articles, TAA for technical assistance **Critical:** true Foreign party, territory, article, technical data and duration fully described **Text:** DDTC approval received before any technical data is exported or work begins **Critical:** true Amendments filed when scope, parties or terms change Required annual sales reports and any proviso conditions tracked Sublicensing and retransfer controls agreed with the foreign party ## Content **Intro:** Use this ITAR compliance checklist to see what applies to your role: manufacturer, exporter, importer, software and ERP administrator, or university. Tick each item, review the critical gaps and export to PDF. It also summarizes the basics of manufacturing license agreements. **Sections:** #### What are the ITAR compliance requirements **Body:** The ITAR (22 CFR Parts 120 to 130) controls the export, temporary import and brokering of defense articles, technical data and defense services on the U.S. Munitions List. Core requirements are registration with DDTC for manufacturers and exporters, authorization before exporting or releasing technical data to a foreign person, recordkeeping, screening and reporting of violations. The checklist groups these by who is doing the work so each team reads only what applies. **Bullets:** - Register and keep registration current - Classify items and technical data - Authorize before any export or foreign person release - Keep records and train staff #### Software and ERP checklists **Body:** Software teams often ask whether ITAR applies to code or cloud tools. Technical data about a defense article, including software that is directly related, is controlled, and release to a foreign person anywhere, including through cloud access, can be an export. For ERP, the practical steps are role-based access limited to U.S. persons, a flag on controlled items, and logging. AI search tools should run on infrastructure you control, with logging and the same role limits as the source system. #### Manufacturing license agreement basics **Body:** A manufacturing license agreement (MLA) authorizes a U.S. company to grant a foreign person the right to manufacture defense articles abroad, and a technical assistance agreement (TAA) covers defense services and technical data transfers. Both need DDTC approval before any data is shared. They must define parties, territory, articles and technical data, and be amended when anything changes. A small shop is more likely to be the U.S. party in a TAA or the supplier within a larger program than to hold an MLA. #### Common mistakes **Body:** The most frequent are assuming that a part made to a customer drawing is not controlled, giving foreign national employees access to shared drives, forgetting that a temporary import needs its own authorization, and treating university labs as exempt without a fundamental research determination. Fix the critical items first and re-run the list each quarter. **Cta:** Where ITAR technical data lives in an on-prem ERP, Netray can add AI search and assistants that run inside your network with the same role restrictions. **Faq:** #### Is there an official ITAR compliance checklist? **Answer:** DDTC publishes compliance program guidelines rather than a single checklist. This checklist turns those themes into practical items by role. It is a working tool, not an official form, so confirm details with counsel or DDTC. #### Does ITAR apply to software? **Answer:** It can. Software directly related to a defense article is technical data, and releasing it to a foreign person, including through remote access or cloud storage, may be an export that needs authorization. #### Do universities need ITAR compliance? **Answer:** Yes when a project involves controlled defense articles or technical data. Fundamental research that is published broadly can fall outside controls, but sponsor restrictions or controlled inputs change that, so each project needs review. #### What is the difference between an MLA and a TAA? **Answer:** An MLA authorizes foreign manufacture of defense articles under license. A TAA authorizes defense services or technical data transfers to a foreign person without the manufacturing rights. Both require DDTC approval before activity begins. ## Search terms itar compliance checklist pdf, itar compliance checklist for software, itar compliance checklist for exporters, itar compliance checklist for importers, itar compliance checklist for universities, what are itar compliance requirements, itar manufacturing license agreement, itar checklist for training and research --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json