ITAR Compliance Checklist (PDF) for Manufacturers, Exporters, Importers, Software and Universities
Use this ITAR compliance checklist to see what applies to your role: manufacturer, exporter, importer, software and ERP administrator, or university. Tick each item, review the critical gaps and export to PDF. It also summarizes the basics of manufacturing license agreements.
0 of 38 items complete
14 critical items still open - these are the highest-risk gaps.
Manufacturer or machine shop
Exporter
Importer
Software, IT and ERP access
University, research and training
Manufacturing license agreement and TAA basics
Tick what is done and documented. Critical items are legal gatekeepers: a gap in any of them should be fixed before you ship, share data or start work.
Check your ERP roles against this list
Optional: we can review how your ERP and file shares meet the U.S. person access items.
Optional. The tool and every export work without this. No spam.
What are the ITAR compliance requirements
The ITAR (22 CFR Parts 120 to 130) controls the export, temporary import and brokering of defense articles, technical data and defense services on the U.S. Munitions List. Core requirements are registration with DDTC for manufacturers and exporters, authorization before exporting or releasing technical data to a foreign person, recordkeeping, screening and reporting of violations. The checklist groups these by who is doing the work so each team reads only what applies.
- Register and keep registration current
- Classify items and technical data
- Authorize before any export or foreign person release
- Keep records and train staff
Software and ERP checklists
Software teams often ask whether ITAR applies to code or cloud tools. Technical data about a defense article, including software that is directly related, is controlled, and release to a foreign person anywhere, including through cloud access, can be an export. For ERP, the practical steps are role-based access limited to U.S. persons, a flag on controlled items, and logging. AI search tools should run on infrastructure you control, with logging and the same role limits as the source system.
Manufacturing license agreement basics
A manufacturing license agreement (MLA) authorizes a U.S. company to grant a foreign person the right to manufacture defense articles abroad, and a technical assistance agreement (TAA) covers defense services and technical data transfers. Both need DDTC approval before any data is shared. They must define parties, territory, articles and technical data, and be amended when anything changes. A small shop is more likely to be the U.S. party in a TAA or the supplier within a larger program than to hold an MLA.
Common mistakes
The most frequent are assuming that a part made to a customer drawing is not controlled, giving foreign national employees access to shared drives, forgetting that a temporary import needs its own authorization, and treating university labs as exempt without a fundamental research determination. Fix the critical items first and re-run the list each quarter.
Frequently Asked Questions
Is there an official ITAR compliance checklist?
DDTC publishes compliance program guidelines rather than a single checklist. This checklist turns those themes into practical items by role. It is a working tool, not an official form, so confirm details with counsel or DDTC.
Does ITAR apply to software?
It can. Software directly related to a defense article is technical data, and releasing it to a foreign person, including through remote access or cloud storage, may be an export that needs authorization.
Do universities need ITAR compliance?
Yes when a project involves controlled defense articles or technical data. Fundamental research that is published broadly can fall outside controls, but sponsor restrictions or controlled inputs change that, so each project needs review.
What is the difference between an MLA and a TAA?
An MLA authorizes foreign manufacture of defense articles under license. A TAA authorizes defense services or technical data transfers to a foreign person without the manufacturing rights. Both require DDTC approval before activity begins.
Where ITAR technical data lives in an on-prem ERP, Netray can add AI search and assistants that run inside your network with the same role restrictions.
Related Tools
ITAR Compliance Program Template
A fill-in ITAR compliance manual covering policy statement, roles, U.S. person access controls, ERP setup and recordkeeping.
Aerospace & DefenseITAR Compliance Checklist for Manufacturers
A 32-point checklist covering DDTC registration, technical data controls, foreign person access, IT security, and recordkeeping for ITAR-regulated manufacturers.
Aerospace & DefenseITAR USML Categories I to XXI Reference
All 21 USML categories with their official titles and a plain summary of what a machine shop, electronics house or software team should look for.
Aerospace & DefenseITAR License, Agreement and DDTC Form Reference
A quick reference to DSP-5, DSP-61, DSP-73, DSP-85, DSP-83, TAA, MLA, WDA and other ITAR authorizations and what each is used for.
More Compliance & Contracts tools
See all- Domestic Origin Supplier Affidavit Template
- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
- Infor XA (MAPICS) User Access Review Worksheet
- China ERP Data Security and Compliance Assessment
- ERP Vendor Data Processing Agreement Outline
- GDPR ERP Data Migration Checklist
Keep exploring
Free tools
- ITAR Compliance Program TemplateA fill-in ITAR compliance manual covering policy statement, roles, U.S. person access controls, ERP setup and recordkeeping.
- ITAR Compliance Checklist for ManufacturersA 32-point checklist covering DDTC registration, technical data controls, foreign person access, IT security, and recordkeeping for ITAR-regulated manufacturers.
- ITAR AI Workload Compliance AssessmentScore your AI deployments across eight dimensions of ITAR exposure, from technical data classification and US persons access control to technology control plan coverage.
ERP fixes and how-tos
- On-Prem vs Cloud ERP AI for Regulated ManufacturersHow CIOs at ITAR, CMMC, and export-controlled manufacturers should weigh on-prem versus cloud AI for their ERP, including what actually needs to stay on-prem and what does not.
- Fix The Oracle Fusion "You Don't Have Access To This Data" ErrorOracle Fusion says you don't have access to this data? It is a data security scope gap, not a missing role. Here is exactly where to check and fix it.
Guides
- How to Configure ITAR Compliance in SyteLineGuide to configuring Infor SyteLine for ITAR (International Traffic in Arms Regulations) compliance. Set up access controls, data segregation, export licensing, and technical data management for defense manufacturing.
- AI-Powered Defense Manufacturing ComplianceEnsure defense manufacturing compliance with AI. Automated ITAR, DFARS, CMMC, and export control management for defense contractors and subcontractors.
- AI-Powered Aerospace ERP SolutionsAerospace-specific ERP solutions with AI. AS9100 compliance, ITAR management, MRO optimization, and traceability for aviation and space manufacturers.
AI on your ERP
- AI for Infor LN in Aerospace and Defense ManufacturingAI grounded on Infor LN project, contract, and configuration management data for aerospace and defense manufacturers, with on-prem deployment for ITAR.
- AI on SAP for Aerospace and Defense Manufacturers, Without the ITAR ExposureEvaluate SAP for aerospace and defense industrial AI: S/4HANA and ECC data access, serial genealogy, config control and quoting, with ITAR data kept in-house.
Manufacturing hubs
- Canadian Manufacturers and Exporters (CME): sectors, rules and ERP realitiesCanadian Manufacturers and Exporters (CME) and the Canadian manufacturing base: sectors, CUSMA, Controlled Goods rules, plus ERP, quoting and private AI issues.
- Aerospace, Space and Defense Manufacturing in Denver and the Colorado Front RangeDenver and Colorado Front Range aerospace, space and defense manufacturing: anchor industries, MEP and research ecosystem, compliance, ERP and private AI.