# ITAR Compliance Program Template: Policy, Procedures and Manual Outline

> Source: https://netray.co/tools/itar-compliance-program-template
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

A fill-in ITAR compliance manual covering policy statement, roles, U.S. person access controls, ERP setup and recordkeeping.

## Category

compliance-legal

## Industry

Aerospace and Defense

## Region

United States

## Audience

- Empowered official
- Export compliance manager
- Machine shop owner

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Company name

**Key:** company

**Type:** text

**Default:** Acme Precision Ltd

#### Site address

**Key:** site

**Type:** text

**Default:** 100 Industrial Way, Wichita, KS

#### Empowered official

**Key:** eo

**Type:** text

**Default:** Jane Doe, VP Compliance

#### DDTC registration code

**Key:** ddtc

**Type:** text

**Default:** M00000

#### Effective date

**Key:** effective

**Type:** date

**Default:** 2026-11-01

#### ERP / PLM system

**Key:** erp

**Type:** text

**Default:** Infor SyteLine on-premises

#### Technical data repository

**Key:** share

**Type:** text

**Default:** Restricted file share \\fs01\ITAR

#### Record retention

**Key:** retention

**Type:** select

**Options:**

- 5 years
- 7 years
- 10 years

**Default:** 5 years

**Blocks:**

#### ITAR Compliance Program: {{company}}

**Body:** Site: {{site}}
Effective: {{effective}}
Empowered official: {{eo}}
DDTC registration code: {{ddtc}}

#### 1. Policy statement

**Body:** {{company}} complies with the Arms Export Control Act and the International Traffic in Arms Regulations (22 CFR Parts 120 to 130). No defense article, technical data or defense service is exported, reexported, retransferred or released to a foreign person without authorization. Management supports this program and every employee is responsible for reporting concerns to the empowered official without retaliation.

#### 2. Roles and responsibilities

**Body:** The empowered official, {{eo}}, has authority to sign license applications and to refuse to sign. Managers classify work centers and projects. IT administers access controls. HR confirms U.S. person status before hire into restricted roles. All employees complete ITAR awareness training at hire and annually.

#### 3. Registration and classification

**Body:** {{company}} maintains DDTC registration under 22 CFR Part 122 and renews it annually. Each part and drawing is classified against the USML category before work starts, using commodity jurisdiction determinations from DDTC where classification is uncertain. Classification is recorded in {{erp}} on the item master.

#### 4. U.S. person access control

**Body:** Access to ITAR technical data is limited to U.S. persons as defined in the ITAR, unless a license or exemption authorizes a foreign person. HR records citizenship or permanent resident status or protected person status evidence before access is granted. Foreign national employees, contractors and visitors are denied access to restricted areas and systems. Technical data is stored in {{share}} and in controlled folders of {{erp}}. Access is by named account only, reviewed quarterly.

#### 5. Physical, IT and cloud controls

**Body:** Restricted work areas are badge controlled with visitor escort and a visitor log. Technical data is encrypted in transit and at rest. Cloud, email and AI services may only be used if the service stores and processes data in the United States, is operated by U.S. persons and is encrypted end to end per DDTC encryption guidance. Remote access uses multi-factor authentication.

#### 6. Procedures

**Table:**

**Columns:**

- Procedure
- Trigger
- Owner
- Record

**Rows:**

**0:** Classify new part or program

**1:** New quote or PO

**2:** Engineering

**3:** Classification form

**0:** Screen customers and suppliers

**1:** New account

**2:** Compliance

**3:** Restricted party screening result

**0:** Foreign visitor approval

**1:** Visit request

**2:** Empowered official

**3:** Visit log

**0:** Technical data transfer

**1:** Any outbound send

**2:** Program manager

**3:** Transfer log

**0:** Suspected violation

**1:** Any concern

**2:** All staff

**3:** Voluntary disclosure file

#### 7. Licenses, agreements and exemptions

**Body:** All exports, temporary imports and agreements (DSP-5, DSP-73, DSP-61, TAA, MLA) are prepared by the empowered official's office and tracked with expiry dates, provisos and quantity drawdown. Exemptions are used only with written analysis kept on file.

#### 8. Recordkeeping

**Body:** Records of exports, licenses, agreements, classifications, screening and training are kept for {{retention}} from the expiry of the license or last transaction, or longer where a contract requires. Records are retrievable in {{erp}} and on {{share}} for a DDTC request.

#### 9. Violations and voluntary disclosure

**Body:** Suspected violations are reported immediately to the empowered official, who decides whether to file an initial voluntary disclosure with DDTC under 22 CFR 127.12 and who directs corrective action.

#### 10. Review and audit

**Body:** The program is reviewed at least annually and after any process, ownership or regulation change. Findings are recorded and tracked to closure.

#### Approvals

**Signatures:**

- Empowered official
- President or CEO
- IT manager
- HR manager

**Notes:** This template is a starting point and not legal advice. ITAR obligations depend on your products, customers and activities. Have export counsel review the final program, and verify current ITAR section numbers and DDTC guidance.

## Content

**Intro:** This ITAR compliance program template gives you a complete manual outline to adapt: policy statement, roles, registration, U.S. person access, IT controls, procedures, recordkeeping and voluntary disclosure. Fill in the fields and export to Word or PDF.

**Sections:**

#### What an ITAR compliance program needs

**Body:** DDTC's compliance program guidelines describe elements that regulators expect to see: management commitment, identification and classification of items, license and agreement management, recordkeeping, training, auditing, reporting and violation handling. Smaller shops do not need a binder of hundreds of pages. They need a short, accurate manual that matches what people actually do, and records to show it.

**Bullets:**

- Management commitment and a named empowered official
- Classification of every part and technical data set
- Access control to technical data and physical areas
- Training, screening and recordkeeping
- A procedure for suspected violations and voluntary disclosure

#### ITAR compliance for U.S. persons and foreign persons

**Body:** ITAR allows release of technical data to U.S. persons, meaning citizens, lawful permanent residents and certain protected individuals. A foreign national employee, even one working in your shop, is a foreign person for ITAR purposes and cannot see controlled technical data without authorization. That is why the access section requires HR evidence before any account is created, and why ERP roles, file shares and project folders must follow the same list.

#### Configuring your ERP and file shares

**Body:** Flag ITAR items in the item master, restrict drawings and routings by role, and keep an audit log of who opened controlled documents. Separate databases or companies are cleaner than field-level rules when a plant mixes commercial and defense work. For AI or search tools, run them inside your own network on U.S.-controlled infrastructure, since sending technical data to a public cloud service may constitute an export if foreign persons can access it.

#### Common mistakes

**Body:** Frequent problems are treating a signed NDA as authorization to share technical data, forgetting that email and cloud storage can place data outside the United States, failing to screen subcontractors and visitors, and letting registration lapse. Keep the program current: update the empowered official, facilities and system names when they change.

**Cta:** Netray builds private AI that runs on your own servers so engineers can query ERP and document data without technical data leaving your controlled environment.

**Faq:**

#### Does every manufacturer need an ITAR compliance program?

**Answer:** Anyone who manufactures or exports defense articles must register with DDTC, and DDTC expects a compliance program appropriate to size and risk. Even a small shop should document policy, access control, classification and records.

#### Who is an ITAR U.S. person?

**Answer:** Generally a U.S. citizen, a lawful permanent resident, or a protected individual under the immigration rules. A person who is none of these is a foreign person and needs authorization before accessing technical data.

#### How long must ITAR records be kept?

**Answer:** The ITAR requires five years from the expiration of the license or other approval, or from the date of the transaction. Many companies keep records longer to satisfy contracts. Confirm with counsel for your situation.

#### Is this template enough for DDTC?

**Answer:** It is a framework. DDTC judges whether a program is effective in practice, so adapt every section to how your company operates and keep records that show the procedures running.

## Search terms

itar compliance program template, itar compliance manual pdf, itar procedures and compliance documents, itar compliance program guidelines, itar compliance us persons, itar compliance policy template, itar technology control plan

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json