ITAR Technical Data Transfer Log Worksheet
Auditors and the State Department ask for proof of what technical data left your company, to whom and under which approval. This worksheet gives export staff a simple running log that exports cleanly to Excel.
| Date sent | Document or drawing | Rev | USML category or ECCN | Recipient | Country | Authorization | Authorization number | Method | Files sent | |
|---|---|---|---|---|---|---|---|---|---|---|
Example classifications are illustrative placeholders, not determinations. Classify your own items using the USML or Commerce Control List, or request a commodity jurisdiction or classification ruling when unsure. Authorization column values are suggestions, adjust to your program. Not legal advice.
Auto-log document releases from your ERP
Optional review of how release events could feed a compliance log automatically.
Optional. The tool and every export work without this. No spam.
How to use the log
Enter one row per release event. Record the document and revision, the controlled category you determined, the recipient and country, the authorization used and its number, and how the data moved. Keep the list append-only: correct mistakes with a new dated row rather than overwriting history.
- Log before or at the time of sending, not later
- Tie each row to an authorization number
- Record the transmission method
- Review monthly for gaps
Why a log helps
ITAR requires registrants to keep records of defense article and technical data transactions, generally for five years. EAR has its own recordkeeping rule. A single log answers the common audit questions fast: who received revision C of this drawing, and which agreement covered the transfer. It also reveals patterns such as many transfers with no authorization number.
Reading the totals
File counts show volume by period, which helps you see where to automate or tighten controls. Pair the log with a quarterly sample: pick five rows, trace each to the signed agreement and the stored message. Differences between the log and reality are the findings you want to catch before an outside party does.
Common mistakes
Using email for controlled data without encryption, logging a verbal discussion as nothing, and forgetting that uploading to a cloud tool outside the U.S. may itself be an export. Include verbal and visual releases.
Frequently Asked Questions
Does ITAR require a transfer log?
ITAR requires records of defense article and technical data transactions, generally retained for five years. It does not prescribe this exact format, so a log like this is a practical way to meet the requirement and to answer audit questions quickly.
Should domestic transfers be logged?
Transfers to U.S. persons are not exports, but many companies log them for CUI traceability. Include them if you need a full chain of custody, and mark the authorization as domestic US person.
What if I am unsure of the classification?
Do not guess. Ask your empowered official, request a commodity jurisdiction determination from the State Department, or a classification from Commerce BIS. Treat the item as controlled until you have an answer.
Can I attach the files?
No, keep the log free of controlled content. Store the transferred files in your controlled repository and reference the document number and revision here.
Netray can discuss pulling document release events from your ERP or PLM into a log like this, on-prem. The worksheet works on its own.
Related Tools
Export Classification Matrix Worksheet (USML and ECCN)
A part-level classification register with jurisdiction, control number, basis, reviewer and next review date.
Compliance & ContractsForeign Person Visitor Access Request Template
A visitor request form that records the purpose, screening result, escort, areas visited and the controlled data the visitor may not see.
Compliance & ContractsEnd-Use and End-User Statement Template
A statement a foreign buyer completes to declare the end user, end use and commitment not to re-export or divert the items.
Aerospace & DefenseITAR Compliance Checklist for Manufacturers
A 32-point checklist covering DDTC registration, technical data controls, foreign person access, IT security, and recordkeeping for ITAR-regulated manufacturers.
More Compliance & Contracts tools
See all- EAR ECCN Self-Classification Worksheet
- Technology Control Plan (TCP) Template
- Export License Tracking Worksheet
- DFARS 252.204-7012 Cyber Incident Report Template
- ITAR USML Categories Reference Table
- NIST SP 800-171 System Security Plan (SSP) Template
- CMMC POA&M (Plan of Action and Milestones) Worksheet
- DFARS 252.204-7012 Cyber Incident Report Template
- Defense Subcontractor Flow-Down Tracker Worksheet