# ITAR Technical Data Handling Procedure Template > Source: https://netray.co/tools/itar-technical-data-handling-procedure-template > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A procedure document with fields for roles, repositories, access control, transmission rules, foreign person screening, records and incident handling. ## Category compliance-legal ## Industry Defense ## Audience - Empowered official - Compliance lead - Contracts manager - IT manager ## Tool **Kind:** template **Output:** document **Fields:** #### Company name **Key:** company **Type:** text **Default:** Acme Precision Machining Inc. #### Procedure number **Key:** doc_no **Type:** text **Default:** EXP-PRC-003 #### Revision **Key:** rev **Type:** text **Default:** A #### Effective date **Key:** date **Type:** date **Default:** 2026-10-20 #### Empowered official or export compliance owner **Key:** eo **Type:** text **Default:** Director of Contracts #### Authorized repository **Key:** repo **Type:** text **Default:** Restricted SharePoint site for ITAR program files and the PLM vault #### How U.S. person status is verified **Key:** us_check **Type:** select **Options:** - I-9 and citizenship attestation at hire - HR verification with documents on file - Annual attestation plus HR documents **Default:** Annual attestation plus HR documents #### Approved transmission method **Key:** transmit **Type:** text **Default:** Encrypted email through the corporate gateway or the approved secure file transfer portal #### Record retention **Key:** retention **Type:** select **Options:** - 5 years - 6 years - 7 years **Default:** 5 years **Help:** ITAR requires at least five years from expiration of the license or approval #### Training frequency **Key:** training **Type:** select **Options:** - At hire and annually - At hire and every 2 years **Default:** At hire and annually **Blocks:** #### {{company}}: ITAR Technical Data Handling Procedure **Body:** Procedure: {{doc_no}} Revision: {{rev}} Effective: {{date}} Owner: {{eo}} #### 1. Purpose **Body:** This procedure sets out how {{company}} identifies, stores, transmits, releases and disposes of technical data controlled under the International Traffic in Arms Regulations (ITAR, 22 CFR Parts 120 to 130), so that no export, reexport, retransfer or release to a foreign person occurs without authorization. #### 2. Scope **Body:** This procedure applies to all employees, temporary staff, contractors, visitors and service providers who may access ITAR technical data in any form: drawings, models, specifications, software source, test data, manuals, email, chat, removable media and verbal discussion. #### 3. Roles **Table:** **Columns:** - Role - Responsibility **Rows:** **0:** {{eo}} **1:** Owns this procedure, determines jurisdiction and classification, approves foreign person access and licenses **0:** Engineering **1:** Marks and classifies technical data at creation, uses only authorized repositories **0:** IT **1:** Enforces access control and logging on {{repo}}, supports incident investigation **0:** HR **1:** Verifies U.S. person status: {{us_check}} **0:** All personnel **1:** Complete training ({{training}}), report suspected violations immediately #### 4. Identification and marking **Body:** Technical data received from customers with an ITAR statement keeps that statement. Technical data created by {{company}} from controlled sources is marked with an ITAR legend on each page or file and in the document control system. Where the data is also CUI, CUI banner and designation indicator markings are applied as the contract directs. Questions on jurisdiction go to {{eo}} before any release. #### 5. Storage and access control **Body:** ITAR technical data is stored only in {{repo}}. Access is granted by named role after {{eo}} confirms U.S. person status and need to know. Access is reviewed quarterly and removed on role change or termination within one business day. Local copies, personal accounts, unapproved cloud tools and consumer messaging are prohibited. #### 6. Transmission **Body:** Approved method: {{transmit}}. Technical data is not sent to personal email, unapproved portals or devices. Transmissions outside the company to a subcontractor or customer require confirmation that the recipient is a U.S. person and is authorized to receive the data. #### 7. Foreign persons and deemed exports **Body:** No foreign person, including foreign national employees, interns, visitors and service technicians, may access ITAR technical data without a license, agreement or exemption approved by {{eo}}. Release in the United States to a foreign person is treated as an export to that person's country. Visitors are escorted and shown only cleared information. #### 8. Subcontractors and suppliers **Body:** ITAR flow-down language is included in purchase orders that carry technical data. Suppliers must be registered where required and confirm U.S. person handling before drawings are released. The release is logged with date, recipient, document and authorizing person. #### 9. Records **Body:** Records are kept for {{retention}} or longer where a license or agreement requires it. Records include the technical data transfer log, access reviews, training records, licenses and agreements, screening results and incident reports. #### 10. Incidents and disclosures **Body:** Any suspected unauthorized access, release or loss is reported to {{eo}} at once. {{eo}} investigates, preserves logs, decides whether a voluntary disclosure to the Directorate of Defense Trade Controls is appropriate with counsel, and records corrective action. #### 11. Review **Table:** **Columns:** - Revision - Date - Change - Approved by **Rows:** **0:** {{rev}} **1:** {{date}} **2:** Initial issue **3:** {{eo}} #### Approvals **Signatures:** - Prepared by - Empowered official or compliance owner - President or general manager **Notes:** This is a starting point, not legal advice. ITAR obligations depend on your registration status, products and agreements. Have export counsel review it before adopting. Check current citations because ITAR sections were renumbered in recent rulemaking. ## Content **Intro:** Auditors and primes increasingly ask to see how you handle ITAR technical data, in writing. This template gives a small manufacturer a structured procedure with defaults you can edit, covering the points a reviewer expects to see. **Sections:** #### How to use it **Body:** Fill in the company name, procedure number, the person who owns export compliance, and the repositories and transmission methods you actually use. Choose how you verify U.S. person status and how long you keep records. The preview updates as you type, and you can export to Word or PDF to put into your document control system. Replace general statements with your real systems: name the SharePoint site, the PLM vault, the file transfer tool. A procedure that describes tools you do not use fails the first interview. #### What the procedure must cover **Body:** A credible procedure answers six questions. What is ITAR data and how do we recognise it. Where may it live. Who may see it and how do we know. How may it leave the building. What happens when a foreign person needs access. What do we record and what do we do when something goes wrong. The template follows that order. Pair it with a technical data transfer log, which proves the procedure is operating, and with CUI marking rules where the data is both. **Bullets:** - Identification and marking at creation - Single authorized repository with logging - Quarterly access review - Foreign person approval path - Retention of at least five years #### Common mistakes **Body:** Common failures include a procedure that exists but nobody has trained on, shared drives that still hold old copies, and cloud tools that store ITAR data outside the United States or with non U.S. person administrators. Another is forgetting that email attachments, chat and remote support sessions are all transmissions. Confirm how any cloud service handles administrator access and data location, and rely on counsel for the details of encryption provisions in the regulations. **Cta:** If your drawings and ITAR data sit inside an ERP or PLM, we can help design access controls and on-premises AI search that never moves that data outside your boundary. **Faq:** #### Is this required by the ITAR? **Answer:** The ITAR does not prescribe one document by this name, but registered manufacturers are expected to have a compliance program and records, and primes often require written procedures. A written procedure is the clearest way to show your program. #### Who should sign it? **Answer:** The person responsible for export compliance, often called the empowered official when one is designated, and senior management. Their signatures show management commitment. #### Can foreign national employees ever see the data? **Answer:** Only with an approved authorization such as a license or agreement or a valid exemption, and only after your compliance owner confirms it. Do not rely on a visa status or an employee's seniority. #### How long must I keep records? **Answer:** ITAR recordkeeping requires at least five years from the expiration of the license or other approval, and longer periods can apply. Many companies keep seven years for simplicity. Confirm with counsel. ## Search terms itar technical data handling procedure, itar compliance program template, itar technical data policy template, itar sop template, itar access control procedure, itar record keeping procedure, itar foreign person access policy, itar written procedures small business --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json