ITAR and Export Controls for Federal Defense Contractors
ITAR and EAR export controls govern defense-related technology and products. Learn what contractors must do to comply, how to screen employees, and the consequences of violations.
If your company develops, manufactures, or handles defense technology — weapons systems, military electronics, cryptography, spacecraft, or any item on the United States Munitions List — you are subject to ITAR (International Traffic in Arms Regulations). Failure to comply can result in criminal penalties, debarment, and loss of federal contracts.
Export controls are not just for large defense primes. Small businesses with a single DoD contract involving controlled technology must comply with the same framework as Lockheed or Raytheon.
The Regulatory Framework
Two primary export control regimes govern most defense-related technology:
ITAR (International Traffic in Arms Regulations)
22 C.F.R. Parts 120-130 — Administered by the State Department's Directorate of Defense Trade Controls (DDTC)
ITAR covers items and services specifically designed, developed, or modified for military or defense applications. The United States Munitions List (USML) defines what is ITAR-controlled — 21 categories covering:
- Category I: Firearms
- Category IV: Launch vehicles, guided missiles, rockets
- Category VIII: Aircraft and related articles
- Category XI: Military electronics
- Category XIII: Materials and miscellaneous articles
- Category XV: Spacecraft and related articles
EAR (Export Administration Regulations)
15 C.F.R. Parts 730-774 — Administered by the Commerce Department's Bureau of Industry and Security (BIS)
EAR covers items with both commercial and military applications (dual-use items). The Commerce Control List (CCL) defines what is EAR-controlled. EAR is generally less restrictive than ITAR but still requires licensing for exports to certain countries.
Who Must Register with DDTC?
Any U.S. company that manufactures, exports, or imports defense articles or services must register with DDTC.
Registration is required even if you have no current exports — if you manufacture items on the USML or provide services covered by ITAR (engineering, technical data, training), you must register.
DDTC registration process:
- Submit registration form through DDTC's electronic system (D-Trade)
- Pay annual registration fee ($2,250 per year for manufacturers/exporters)
- Receive registration confirmation; renew annually
Non-registered companies cannot:
- Export ITAR-controlled items
- Provide ITAR-controlled technical data to foreign nationals
- Enter into defense manufacturing contracts that require ITAR compliance
What Is an "Export" Under ITAR?
The definition of "export" under ITAR is much broader than shipping items overseas:
Physical export: Sending ITAR-controlled hardware outside the United States.
Technical data disclosure: Releasing ITAR-controlled drawings, specifications, software, or technology to any person who is not a U.S. person (citizen, LPR, or asylee).
Defense services: Providing ITAR-controlled technical assistance, training, or consulting to foreign persons.
The "deemed export" rule: Disclosing ITAR-controlled technical data to a foreign national inside the United States is treated as an "export" to that person's home country. This applies even when the foreign national is an employee working in your US facility.
Deemed Exports and Your Workforce
The deemed export rule is the most commonly overlooked ITAR compliance obligation for small contractors.
Who is a "foreign national" for ITAR purposes? Anyone who is not a U.S. citizen, a lawful permanent resident (green card holder), or a protected individual under 8 U.S.C. § 1324b. This includes H-1B visa holders, F-1 students working in your company, and any other visa status.
What you must do:
- Know the citizenship status of every employee who will have access to ITAR-controlled technical data
- Apply for an export license (or use an available license exemption) before a foreign national accesses controlled data
- Implement technology control procedures to prevent unauthorized access
Common available exemptions for employees:
- 27(a) Exemption (TAA/MLA): Technical data shared under an agreement approved by DDTC
- 125.4(b)(10): Data transferred to U.S. persons only
- License for intracompany transfer: If the foreign national employee is part of a multi-national corporation with an existing agreement
When in doubt, consult an export control attorney. The deemed export rules are complex and the consequences of violations are severe.
Technology Control Plans
An ITAR-compliant company should have a Technology Control Plan (TCP) — a documented policy describing:
- What ITAR-controlled items and data the company possesses
- Physical security measures for ITAR-controlled areas
- IT system controls preventing foreign national access
- Employee training requirements
- Procedures for visitors to ITAR-controlled areas
- Procedures for handling export license applications
Some defense contracts (particularly Classified contracts and sensitive technology programs) require TCPs as a contract condition.
Common ITAR Violations and Penalties
ITAR violations result in both civil and criminal penalties — and federal contractors have been debarred, prosecuted, and fined for violations ranging from negligent to intentional.
Common violation patterns:
- Emailing ITAR-controlled drawings to a foreign subcontractor without a license
- Hiring a foreign national engineer and allowing unrestricted access to controlled technical data
- Exporting a defense component to a foreign customer without checking USML classification
- Disclosing ITAR-controlled information during a trade show or conference
Civil penalties: Up to $1,327,627 per violation (2024 adjustment). Violations are per-transaction, not per company — a single program with 50 unlicensed disclosures is 50 separate violations.
Criminal penalties: Up to 20 years in prison and $1 million per violation for willful violations.
Debarment: DDTC can debar companies from receiving DDTC-registered activities — effectively ending defense contracting.
Recent enforcement examples: Several mid-size defense contractors have paid settlements in the $5M–$50M range for systemic ITAR violations discovered during acquisition due diligence or employee whistleblower complaints.
EAR Compliance for Dual-Use Items
For items on the Commerce Control List (CCL) but not the USML:
License requirements: Export licenses may be required based on the item's Export Control Classification Number (ECCN) and the destination country.
No-License-Required (NLR): Some items can be exported without a license to most countries; check the CCL listing for your item's restrictions.
Restricted parties screening: Even for items that don't require a license, you cannot export to companies or individuals on restricted party lists — the BIS Entity List, Treasury OFAC SDN List, or State Department Debarred Parties List.
Restricted party screening is a compliance action every export transaction should include. Free screening tools are available through the Consolidated Screening List at trade.gov.
Building Export Compliance Into Your Operations
Export Control Officer (ECO): Appoint a dedicated ECO responsible for ITAR/EAR compliance. For small businesses, this may be a part-time collateral duty for a senior operations or legal professional.
Employee training: ITAR/EAR training for all employees who handle controlled items or data. Document training completion.
Classification reviews: When you develop or acquire a new product, conduct a formal classification review — is it ITAR, EAR, or EAR99? Document the determination.
Licensing system: Track all export license applications, approvals, and expirations. Export licenses typically have specific authorized end-users, end-uses, and expiration dates.
Audit program: Periodic internal audits comparing actual exports against license authorizations.
Key Takeaways
- ITAR applies to any company that manufactures, exports, or provides defense services — registration with DDTC is mandatory regardless of export volume.
- Deemed exports — disclosing ITAR-controlled data to foreign nationals inside the US — require the same licenses as physical exports. Know your workforce's citizenship status.
- Technology Control Plans describe how you physically and digitally secure controlled data — required by some contracts, good practice for all.
- Penalties are per-violation: civil fines up to $1.3M per transaction; criminal penalties up to 20 years for willful violations.
- Restricted party screening must occur before every export transaction — selling to a sanctioned party violates ITAR/EAR even if the item doesn't require a license.
- Export Control Officer should be designated and trained — compliance cannot be informal at any company size handling ITAR-controlled technology.
Find opportunities like this one
RFxNerd monitors federal procurement and surfaces the best-fit opportunities for your business — scored and ranked automatically.
Get started →