What is ITAR Compliance? (Regulations, Fines, & More)

Posted on June 8, 2023

This blog provides a comprehensive overview of International Traffic in Arms Regulations (ITAR) compliance, including what it means for your organization, experts' thoughts and recommendations, frequently asked questions, and more.

In this blog: 

 

What is ITAR Compliance?

ITAR compliance is compliance with the International Traffic in Arms Regulations (ITAR) which controls the export and import of defense-related articles and services on the United States Munitions List (USML). According to the U.S. Government, all manufacturers, exporters, and brokers of defense articles, defense services, or related technical data must be ITAR compliant. Therefore, more companies are requiring their supply chain members to be ITAR compliant as well.

For an organization involved in the manufacturing, sale, or distribution of goods or services covered under the USML, or a component supplier to goods covered under the United States Munitions List (USML), the stipulation or requirement of being “ITAR certified (compliant)” means that the organization must be registered with the State Department’s Directorate of Defense Trade Controls (DDTC) if required as spelled out on DDTC’s website. Additionally, the company must understand and abide by the ITAR as it applies to their USML-linked goods or services. The organization itself is certifying that it operates in accordance with the ITAR when it accepts being a supplier for the USML prime exporter.

In other words, organizations must register with the DDTC and know what is required of them to be ITAR compliant, therefore certifying that they possess that knowledge.

What Does ITAR Compliance Mean for My Organization?

Overall, it is important to understand that registering with the DDTC to sell your products or services in the ITAR industry is not enough; you must be sure not to violate ITAR compliance regulations. The expectation is that complying organizations' employees are educated and trained in ITAR regulations. Keep in mind that ITAR violations may result in criminal or civil penalties, being barred from future exports, and/or imprisonment, including:

  • Civil fines as high as $500,000 per violation
  • Criminal fines of up to $1,000,000, 10 years imprisonment, or both per violation

 

ITAR Compliance and Technology Companies

As an important U.S. export control law, the ITAR affects the manufacturing, sale, and distribution of technology. The goal of the legislation is to control access to specific types of technology and their associated data. Overall, the government is attempting to prevent the disclosure or transfer of sensitive information to a foreign national. As a result, ITAR compliance can pose challenges for global corporations, since data related to specific technologies may need to be transferred over the internet or stored locally outside of the United States to make business processes flow smoothly. The responsibility lies with the manufacturer or exporter to take the necessary precautions and steps to certify that they are, in fact, meeting ITAR compliance requirements.

Specifically, ITAR [22 CFR 120-130]:

  • Covers military items or defense articles
  • Regulates goods and technology designed to kill or defend against death in a military setting
  • Includes space-related technology because of application to missile technology
  • Includes technical data related to defense articles and services
  • Involves strict regulatory licensing and does not address commercial or research objectives

Updates to ITAR Compliance

Like other laws that regulate sensitive data, ITAR is regularly updated and refined based on expert and industry feedback. The following are a few examples of updates from the past several years particularly relevant to ITAR-compliant organizations:

84 FR 70887 - Effective 3/25/2020

This amendment to 22 CFR 120 created a definition of “activities that are not exports, reexports, retransfers, or temporary imports” by combining existing text from the regulations with new text regarding secured unclassified technical data. For example, unclassified technical data transferred outside the U.S. is no longer defined as an “export” under the amendment, along with the electronic transmission and storage of properly secured unclassified technical data via foreign communications infrastructure, so long as end-to-end encryption is still used.

87 FR 16396 - Effective 9/6/2022

This update served as an announcement that the State Department would be launching a large-scale "multi-year, multi-rule" revision of ITAR. The project aims to streamline and clarify the subchapter by progressively eliminating redundant provisions, clarifying language, and simplifying the regulatory framework. 

88 FR 39323 - Effective 6/15/2023

As one of the first rules released in relation to the State Department's revision project, this imposed a debarment on individuals convicted of violating the Arms Export Control Act (AECA). It establishes a presumption of denial for licenses or other approvals involving such individuals which, along with statutory debarment, effectively prohibits them from participating directly or indirectly in any activities that are regulated by the ITAR. Reinstatement after the three-year period is not automatic, and in all cases, the debarred person must submit a request to the Department of State for approval before engaging in any activities subject to the ITAR. 

Data Security Recommendations for ITAR Compliance

Now that you know the significance of ITAR compliance and the penalties for failing to comply, it is important to understand how to secure your ITAR-regulated data. While all organizations will have different data security requirements, the following are considered general best practices to follow in securing ITAR-regulated data:

  • Maintain an information security policy
  • Build and maintain a secure network by installing and maintaining firewall configuration to protect data 
  • Avoid the use of vendor-supplied passwords and other security defaults
  • Assign a unique ID to each person with computer access
  • Regularly test security systems and processes
  • Protect sensitive data with end-to-end encryption
  • Regularly monitor and test networks
  • Implement strong access control measures
  • Track and monitor all access to network resources and sensitive data
  • Maintain a vulnerability management program
  • Implement measures to prevent the loss of ITAR-controlled data

The above list is not exhaustive but is meant to provide a starting point for securing sensitive data and maintaining ITAR compliance. By following and adopting these measures, your organization can ensure that ITAR data is still accessible while staying protected against loss or unauthorized access.

Experts Weigh in on ITAR Compliance

Here’s a look at what the experts have to say about ITAR compliance:

1. Certification is a myth. 

“Many have heard the term ‘certified’ in relation to ITAR. In reality, there is no such thing as being ITAR certified. There is only a regulatory requirement to be registered and a company’s obligation to be compliant. The confusion comes when you receive a letter from your customer asking you to ‘certify’ that your business is ITAR compliant. What they are really asking is, ‘Are you registered for ITAR and do you have an established compliance program with all required controls in place?’”

— Mark Bleckley, Associate Director - Van Andel Global Trade Center

Read more: What It Really Means to be ITAR Compliant: Why You Should Stop Saying You Are ITAR Certified

2. Classify your sensitive ITAR data. 

"Classifying items under the USML and CCL requires a thorough understanding of the regulations and the specific criteria outlined in each list... Seek advice from export control experts or legal professionals who specialize in this area. They can provide guidance on interpreting the lists, understanding the criteria, and determining the appropriate classification."

— Darren Osborne, President - Govology.com; Former Counselor and Program Manager - APEX Accelerator Procurement

Read more: Understanding the Classification of Export-Controlled Items: ITAR’s U.S. Munitions List and EAR’s Commerce Control List

With this in mind, however, classifying sensitive data is often a task much easier said than done — even with expert help. Ergo, implementing a data classification solution for ITAR compliance that enables the efficient and secure sharing of sensitive information is paramount. Fortra's Data Classification identifies ITAR data, heightens awareness around how it is stored and transmitted, facilitates streamlined auditing, and enhances your organization's existing security measures.

3. Use a checklist. 

“An ITAR compliance checklist is a tool used by arms suppliers to easily determine if they are ITAR compliant, establish an identification system for ITAR-controlled products, and implement an effective ITAR compliance program.” 

— Jona Tarlengco, Researcher - Safety Culture 

Read more: Top 3 ITAR Compliance Checklists

Following these tips and best practices will ensure ITAR compliance, even as the regulations are updated and refined.

Frequently Asked Questions

International Traffic in Arms Regulations (ITAR) establish controls regarding the export and import of defense-related items and services that appear on the United States Munitions List (USML). ITAR is meant to limit access to specific technologies and their associated data resources. ITAR compliance requires ITAR-regulated organizations to only share items in the USML with U.S. personnel unless otherwise authorized by the U.S. Department of State.

Organizations need to understand the requirements for ITAR compliance related to the items on the USML they handle. Organizations need to take the necessary steps to protect ITAR data, including:

  1. End-to-end data encryption
  2. Key management to retain control over decryption keys
  3. Access control to prevent unauthorized foreign access to ITAR data
  4. Data loss prevention (DLP) to identify ITAR data and enforce access controls and encryption
  5. Persistent protection of ITAR data that prevents foreign access to regulated email attachments

The following countries are on the ITAR Proscribed Countries List (22 CFR 126.1) as of 7/30/2024.

  1. Afghanistan
  2. Belarus
  3. Burma
  4. Central African Republic
  5. China (PRC)
  6. Cyprus
  7. Cuba
  8. Democratic Republic of Congo
  9. Ethiopia
  10. Eritrea
  11. Haiti
  12. Iran
  13. Iraq
  14. Lebanon
  15. Libya
  16. Nicaragua
  17. North Korea
  18. Russia
  19. Somalia
  20. South Sudan
  21. Sudan
  22. Syria
  23. Venezuela
  24. Zimbabwe

The most common ITAR compliance violations include:

  1. Willful failure to comply with ITAR.
  2. Misrepresentations or omissions when addressing items or data that fall under ITAR guidelines.
  3. Oversight or accidental mistakes that put ITAR data at risk.

Here are some substantial differences between ITAR and Export Administration Regulations (EAR):

  1. ITAR is administered by the U.S. Department of State and EAR is administered by the U.S. Department of Commerce.
  2. ITAR only covers military items. EAR covers commercial items that may have military applications.
  3. ITAR is intended solely to ensure U.S. security. EAR balances national security with commercial and research objectives.

Under ITAR 22 CFR §122.1, ITAR applies to any person in the United States who engages in the business of manufacturing, exporting, or temporary importing of defense articles, or furnishing defense services. Organizations should review the USML to determine if they need to adopt ITAR compliance.

The cost of applications made to the Directorate of Defense Trade Controls (DDTC) follows a three-tier structure:

Tier I: $2,250 per year if the DDTC has not reviewed, adjudicated, or issued a response to any application within the past 90 days.

Tier 2: $2,750 per year if the DDTC has reviewed, adjudicated, or issued a response to at least one but no more than 10 applications in the past 12 months.

Tier 3: $2,750 plus additional fees based on the number of applications if the DDTC has reviewed, adjudicated, or issued a response to more than 10.

Data Protection and Export Control Compliance

Learn how Digital Guardian applies context-aware data protection 
to proactively support export control compliance

GET THE GUIDE
Related Solutions
Compliance ITAR
Related Content
Don't Fall Behind; Get The Latest Security Insights Delivered To Your Inbox Each Week

Recommended Resources