ITAR Compliance Program Template: Policy, Procedures and Manual Outline
This ITAR compliance program template gives you a complete manual outline to adapt: policy statement, roles, registration, U.S. person access, IT controls, procedures, recordkeeping and voluntary disclosure. Fill in the fields and export to Word or PDF.
Fill in
ITAR Compliance Program Template
ITAR Compliance Program: Acme Precision Ltd
Site: 100 Industrial Way, Wichita, KS Effective: 2026-11-01 Empowered official: Jane Doe, VP Compliance DDTC registration code: M00000
1. Policy statement
Acme Precision Ltd complies with the Arms Export Control Act and the International Traffic in Arms Regulations (22 CFR Parts 120 to 130). No defense article, technical data or defense service is exported, reexported, retransferred or released to a foreign person without authorization. Management supports this program and every employee is responsible for reporting concerns to the empowered official without retaliation.
2. Roles and responsibilities
The empowered official, Jane Doe, VP Compliance, has authority to sign license applications and to refuse to sign. Managers classify work centers and projects. IT administers access controls. HR confirms U.S. person status before hire into restricted roles. All employees complete ITAR awareness training at hire and annually.
3. Registration and classification
Acme Precision Ltd maintains DDTC registration under 22 CFR Part 122 and renews it annually. Each part and drawing is classified against the USML category before work starts, using commodity jurisdiction determinations from DDTC where classification is uncertain. Classification is recorded in Infor SyteLine on-premises on the item master.
4. U.S. person access control
Access to ITAR technical data is limited to U.S. persons as defined in the ITAR, unless a license or exemption authorizes a foreign person. HR records citizenship or permanent resident status or protected person status evidence before access is granted. Foreign national employees, contractors and visitors are denied access to restricted areas and systems. Technical data is stored in Restricted file share \\fs01\ITAR and in controlled folders of Infor SyteLine on-premises. Access is by named account only, reviewed quarterly.
5. Physical, IT and cloud controls
Restricted work areas are badge controlled with visitor escort and a visitor log. Technical data is encrypted in transit and at rest. Cloud, email and AI services may only be used if the service stores and processes data in the United States, is operated by U.S. persons and is encrypted end to end per DDTC encryption guidance. Remote access uses multi-factor authentication.
6. Procedures
| Procedure | Trigger | Owner | Record |
|---|---|---|---|
| Classify new part or program | New quote or PO | Engineering | Classification form |
| Screen customers and suppliers | New account | Compliance | Restricted party screening result |
| Foreign visitor approval | Visit request | Empowered official | Visit log |
| Technical data transfer | Any outbound send | Program manager | Transfer log |
| Suspected violation | Any concern | All staff | Voluntary disclosure file |
7. Licenses, agreements and exemptions
All exports, temporary imports and agreements (DSP-5, DSP-73, DSP-61, TAA, MLA) are prepared by the empowered official's office and tracked with expiry dates, provisos and quantity drawdown. Exemptions are used only with written analysis kept on file.
8. Recordkeeping
Records of exports, licenses, agreements, classifications, screening and training are kept for 5 years from the expiry of the license or last transaction, or longer where a contract requires. Records are retrievable in Infor SyteLine on-premises and on Restricted file share \\fs01\ITAR for a DDTC request.
9. Violations and voluntary disclosure
Suspected violations are reported immediately to the empowered official, who decides whether to file an initial voluntary disclosure with DDTC under 22 CFR 127.12 and who directs corrective action.
10. Review and audit
The program is reviewed at least annually and after any process, ownership or regulation change. Findings are recorded and tracked to closure.
Approvals
This template is a starting point and not legal advice. ITAR obligations depend on your products, customers and activities. Have export counsel review the final program, and verify current ITAR section numbers and DDTC guidance.
Map the program onto your ERP
Optional: we can walk through how ITAR flags and access roles map to your ERP and file shares.
Optional. The tool and every export work without this. No spam.
What an ITAR compliance program needs
DDTC's compliance program guidelines describe elements that regulators expect to see: management commitment, identification and classification of items, license and agreement management, recordkeeping, training, auditing, reporting and violation handling. Smaller shops do not need a binder of hundreds of pages. They need a short, accurate manual that matches what people actually do, and records to show it.
- Management commitment and a named empowered official
- Classification of every part and technical data set
- Access control to technical data and physical areas
- Training, screening and recordkeeping
- A procedure for suspected violations and voluntary disclosure
ITAR compliance for U.S. persons and foreign persons
ITAR allows release of technical data to U.S. persons, meaning citizens, lawful permanent residents and certain protected individuals. A foreign national employee, even one working in your shop, is a foreign person for ITAR purposes and cannot see controlled technical data without authorization. That is why the access section requires HR evidence before any account is created, and why ERP roles, file shares and project folders must follow the same list.
Configuring your ERP and file shares
Flag ITAR items in the item master, restrict drawings and routings by role, and keep an audit log of who opened controlled documents. Separate databases or companies are cleaner than field-level rules when a plant mixes commercial and defense work. For AI or search tools, run them inside your own network on U.S.-controlled infrastructure, since sending technical data to a public cloud service may constitute an export if foreign persons can access it.
Common mistakes
Frequent problems are treating a signed NDA as authorization to share technical data, forgetting that email and cloud storage can place data outside the United States, failing to screen subcontractors and visitors, and letting registration lapse. Keep the program current: update the empowered official, facilities and system names when they change.
Frequently Asked Questions
Does every manufacturer need an ITAR compliance program?
Anyone who manufactures or exports defense articles must register with DDTC, and DDTC expects a compliance program appropriate to size and risk. Even a small shop should document policy, access control, classification and records.
Who is an ITAR U.S. person?
Generally a U.S. citizen, a lawful permanent resident, or a protected individual under the immigration rules. A person who is none of these is a foreign person and needs authorization before accessing technical data.
How long must ITAR records be kept?
The ITAR requires five years from the expiration of the license or other approval, or from the date of the transaction. Many companies keep records longer to satisfy contracts. Confirm with counsel for your situation.
Is this template enough for DDTC?
It is a framework. DDTC judges whether a program is effective in practice, so adapt every section to how your company operates and keep records that show the procedures running.
Netray builds private AI that runs on your own servers so engineers can query ERP and document data without technical data leaving your controlled environment.
Related Tools
ITAR Compliance Checklist by Role
A role-based ITAR checklist covering manufacturers, exporters, importers, software and ERP access, research and training, and MLA/TAA basics.
Compliance & ContractsITAR Technical Data Handling Procedure Template
A procedure document with fields for roles, repositories, access control, transmission rules, foreign person screening, records and incident handling.
Compliance & ContractsITAR Technical Data Transfer Log Worksheet
An editable log that records each release of technical data, who received it, under which authorization and how it was sent.
Aerospace & DefenseITAR USML Categories I to XXI Reference
All 21 USML categories with their official titles and a plain summary of what a machine shop, electronics house or software team should look for.
More Compliance & Contracts tools
See all- Domestic Origin Supplier Affidavit Template
- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
- Infor XA (MAPICS) User Access Review Worksheet
- China ERP Data Security and Compliance Assessment
- ERP Vendor Data Processing Agreement Outline
- GDPR ERP Data Migration Checklist
Keep exploring
Free tools
- ITAR Compliance Checklist for ManufacturersA 32-point checklist covering DDTC registration, technical data controls, foreign person access, IT security, and recordkeeping for ITAR-regulated manufacturers.
- ITAR Compliance Checklist by RoleA role-based ITAR checklist covering manufacturers, exporters, importers, software and ERP access, research and training, and MLA/TAA basics.
- Export Compliance Program ROI CalculatorCompare program cost with the expected annual loss avoided, then see payback and multi-year net benefit as the effectiveness of controls changes.
Guides
- How to Configure ITAR Compliance in SyteLineGuide to configuring Infor SyteLine for ITAR (International Traffic in Arms Regulations) compliance. Set up access controls, data segregation, export licensing, and technical data management for defense manufacturing.
- AI-Powered Defense Manufacturing ComplianceEnsure defense manufacturing compliance with AI. Automated ITAR, DFARS, CMMC, and export control management for defense contractors and subcontractors.
- AI-Powered Aerospace ERP SolutionsAerospace-specific ERP solutions with AI. AS9100 compliance, ITAR management, MRO optimization, and traceability for aviation and space manufacturers.
AI on your ERP
- AI for Infor LN in Aerospace and Defense ManufacturingAI grounded on Infor LN project, contract, and configuration management data for aerospace and defense manufacturers, with on-prem deployment for ITAR.
- AI on SAP for Aerospace and Defense Manufacturers, Without the ITAR ExposureEvaluate SAP for aerospace and defense industrial AI: S/4HANA and ECC data access, serial genealogy, config control and quoting, with ITAR data kept in-house.