ITAR Technical Data Handling Procedure Template
Auditors and primes increasingly ask to see how you handle ITAR technical data, in writing. This template gives a small manufacturer a structured procedure with defaults you can edit, covering the points a reviewer expects to see.
Fill in
ITAR requires at least five years from expiration of the license or approval
ITAR Technical Data Handling Procedure Template
Acme Precision Machining Inc.: ITAR Technical Data Handling Procedure
Procedure: EXP-PRC-003 Revision: A Effective: 2026-10-20 Owner: Director of Contracts
1. Purpose
This procedure sets out how Acme Precision Machining Inc. identifies, stores, transmits, releases and disposes of technical data controlled under the International Traffic in Arms Regulations (ITAR, 22 CFR Parts 120 to 130), so that no export, reexport, retransfer or release to a foreign person occurs without authorization.
2. Scope
This procedure applies to all employees, temporary staff, contractors, visitors and service providers who may access ITAR technical data in any form: drawings, models, specifications, software source, test data, manuals, email, chat, removable media and verbal discussion.
3. Roles
| Role | Responsibility |
|---|---|
| Director of Contracts | Owns this procedure, determines jurisdiction and classification, approves foreign person access and licenses |
| Engineering | Marks and classifies technical data at creation, uses only authorized repositories |
| IT | Enforces access control and logging on Restricted SharePoint site for ITAR program files and the PLM vault, supports incident investigation |
| HR | Verifies U.S. person status: Annual attestation plus HR documents |
| All personnel | Complete training (At hire and annually), report suspected violations immediately |
4. Identification and marking
Technical data received from customers with an ITAR statement keeps that statement. Technical data created by Acme Precision Machining Inc. from controlled sources is marked with an ITAR legend on each page or file and in the document control system. Where the data is also CUI, CUI banner and designation indicator markings are applied as the contract directs. Questions on jurisdiction go to Director of Contracts before any release.
5. Storage and access control
ITAR technical data is stored only in Restricted SharePoint site for ITAR program files and the PLM vault. Access is granted by named role after Director of Contracts confirms U.S. person status and need to know. Access is reviewed quarterly and removed on role change or termination within one business day. Local copies, personal accounts, unapproved cloud tools and consumer messaging are prohibited.
6. Transmission
Approved method: Encrypted email through the corporate gateway or the approved secure file transfer portal. Technical data is not sent to personal email, unapproved portals or devices. Transmissions outside the company to a subcontractor or customer require confirmation that the recipient is a U.S. person and is authorized to receive the data.
7. Foreign persons and deemed exports
No foreign person, including foreign national employees, interns, visitors and service technicians, may access ITAR technical data without a license, agreement or exemption approved by Director of Contracts. Release in the United States to a foreign person is treated as an export to that person's country. Visitors are escorted and shown only cleared information.
8. Subcontractors and suppliers
ITAR flow-down language is included in purchase orders that carry technical data. Suppliers must be registered where required and confirm U.S. person handling before drawings are released. The release is logged with date, recipient, document and authorizing person.
9. Records
Records are kept for 5 years or longer where a license or agreement requires it. Records include the technical data transfer log, access reviews, training records, licenses and agreements, screening results and incident reports.
10. Incidents and disclosures
Any suspected unauthorized access, release or loss is reported to Director of Contracts at once. Director of Contracts investigates, preserves logs, decides whether a voluntary disclosure to the Directorate of Defense Trade Controls is appropriate with counsel, and records corrective action.
11. Review
| Revision | Date | Change | Approved by |
|---|---|---|---|
| A | 2026-10-20 | Initial issue | Director of Contracts |
Approvals
This is a starting point, not legal advice. ITAR obligations depend on your registration status, products and agreements. Have export counsel review it before adopting. Check current citations because ITAR sections were renumbered in recent rulemaking.
Private AI search over controlled drawings
Optional: learn how an on-premises model can search your technical data without leaving your network.
Optional. The tool and every export work without this. No spam.
How to use it
Fill in the company name, procedure number, the person who owns export compliance, and the repositories and transmission methods you actually use. Choose how you verify U.S. person status and how long you keep records. The preview updates as you type, and you can export to Word or PDF to put into your document control system. Replace general statements with your real systems: name the SharePoint site, the PLM vault, the file transfer tool. A procedure that describes tools you do not use fails the first interview.
What the procedure must cover
A credible procedure answers six questions. What is ITAR data and how do we recognise it. Where may it live. Who may see it and how do we know. How may it leave the building. What happens when a foreign person needs access. What do we record and what do we do when something goes wrong. The template follows that order. Pair it with a technical data transfer log, which proves the procedure is operating, and with CUI marking rules where the data is both.
- Identification and marking at creation
- Single authorized repository with logging
- Quarterly access review
- Foreign person approval path
- Retention of at least five years
Common mistakes
Common failures include a procedure that exists but nobody has trained on, shared drives that still hold old copies, and cloud tools that store ITAR data outside the United States or with non U.S. person administrators. Another is forgetting that email attachments, chat and remote support sessions are all transmissions. Confirm how any cloud service handles administrator access and data location, and rely on counsel for the details of encryption provisions in the regulations.
Frequently Asked Questions
Is this required by the ITAR?
The ITAR does not prescribe one document by this name, but registered manufacturers are expected to have a compliance program and records, and primes often require written procedures. A written procedure is the clearest way to show your program.
Who should sign it?
The person responsible for export compliance, often called the empowered official when one is designated, and senior management. Their signatures show management commitment.
Can foreign national employees ever see the data?
Only with an approved authorization such as a license or agreement or a valid exemption, and only after your compliance owner confirms it. Do not rely on a visa status or an employee's seniority.
How long must I keep records?
ITAR recordkeeping requires at least five years from the expiration of the license or other approval, and longer periods can apply. Many companies keep seven years for simplicity. Confirm with counsel.
If your drawings and ITAR data sit inside an ERP or PLM, we can help design access controls and on-premises AI search that never moves that data outside your boundary.
Related Tools
ITAR Technical Data Transfer Log Worksheet
An editable log that records each release of technical data, who received it, under which authorization and how it was sent.
Compliance & ContractsCUI Banner and Dissemination Control Marking Reference
Quick lookup for how to build a CUI banner, which category codes appear most often in manufacturing, and how dissemination controls are written.
Aerospace & DefenseITAR Compliance Checklist for Manufacturers
A 32-point checklist covering DDTC registration, technical data controls, foreign person access, IT security, and recordkeeping for ITAR-regulated manufacturers.
Compliance & ContractsCMMC Asset Scoping and Categorization Worksheet
Build your in scope asset inventory by CMMC category, with quantities, documentation effort and annual tool cost so you can see what scope reduction would save.
More Compliance & Contracts tools
See all- SPRS Score Recovery Timeline Calculator
- CMMC Practice Evidence Tracker Worksheet
- CMMC Shared Responsibility Matrix Worksheet for MSPs and Cloud Providers
- CMMC C3PAO Assessment Day Prep Checklist
- CMMC Level 2 Checklist Worksheet
- CMMC Level 1 Checklist (15 Practices) with Evidence Tracker
- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
Keep exploring
Free tools
- ITAR Technical Data Transfer Log WorksheetAn editable log that records each release of technical data, who received it, under which authorization and how it was sent.
- ITAR Compliance Program TemplateA fill-in ITAR compliance manual covering policy statement, roles, U.S. person access controls, ERP setup and recordkeeping.
- ITAR Compliance Checklist for ManufacturersA 32-point checklist covering DDTC registration, technical data controls, foreign person access, IT security, and recordkeeping for ITAR-regulated manufacturers.
ERP fixes and how-tos
- SAP QM Sample-Drawing Procedure: Setup and Use (QPV1)Set up an SAP QM sample-drawing procedure with QPV1: containers, number of samples, link to the inspection plan and lot, and how physical samples are created.
- Pricing Procedure in SAP MM, with a Worked PO ExampleHow the SAP MM purchasing pricing procedure works: condition types, calculation schema, schema determination, a worked PO and how freight is captured.
- SAP MM Pricing Procedure Configuration (Calculation Schema, M/08)Configure the SAP MM pricing procedure (calculation schema): condition types, M/08, schema groups and determination, MEK1 condition records and account keys.
Guides
- ITAR and CMMC: Handling Technical Data in AI WorkloadsHow ITAR and CMMC apply to AI workloads: technical data boundaries, CUI handling, assessed environments, and where on-prem AI is the only option.
- How to Configure ITAR Compliance in SyteLineGuide to configuring Infor SyteLine for ITAR (International Traffic in Arms Regulations) compliance. Set up access controls, data segregation, export licensing, and technical data management for defense manufacturing.
- ITAR Compliant AI for Manufacturing: What Qualifies and What Does NotITAR compliant AI explained: what makes an AI tool compliant, why public cloud LLMs fail, and how on-prem open-weight models keep technical data in-house.
AI on your ERP
- ITAR Compliant AI for ERP Technical DataITAR compliant AI for ERP: how to add generative AI without creating a deemed export, using on-prem, US-person-only patterns an Empowered Official can approve.
- AI on SAP for Aerospace and Defense Manufacturers, Without the ITAR ExposureEvaluate SAP for aerospace and defense industrial AI: S/4HANA and ECC data access, serial genealogy, config control and quoting, with ITAR data kept in-house.
Manufacturing hubs
- Aerospace, Space and Defense Manufacturing in Denver and the Colorado Front RangeDenver and Colorado Front Range aerospace, space and defense manufacturing: anchor industries, MEP and research ecosystem, compliance, ERP and private AI.
- San Diego manufacturing: defense, shipbuilding and biotechSan Diego manufacturing guide: defense and unmanned systems, shipbuilding, biotech and medical devices, cross-border Tijuana supply chains, standards and private AI.