By Alaa Negeda 
Win More Federal Contracts
See how GovOps360 reduces RFP prep time by up to 65%
ITAR Meaning: What the Regulation Covers
ITAR stands for the International Traffic in Arms Regulations. It is a body of federal regulation, codified at 22 CFR parts 120 through 130, that controls the export of defense articles, defense services and the technical data behind them. It is administered by the Directorate of Defense Trade Controls, part of the State Department, and it is authorized by the Arms Export Control Act at 22 U.S.C. 2778.
The single most expensive misunderstanding in this area is treating ITAR as something a company obtains. Buyers ask for it that way, capture teams answer that way, and the regulation itself says the opposite. Registration with DDTC does not confer any export rights or privileges. It is a disclosure obligation and a precondition, not a permission.
This guide covers which law authorizes ITAR, what counts as a defense article, a defense service and technical data, who must register with DDTC and what that costs, why ITAR certification does not exist, how registration and licensing work, what a deemed export is, how ITAR differs from the EAR, where export control overlaps with CUI, and what violations cost.
The ITAR meaning that matters to a contractor is narrower than the acronym suggests. ITAR is not an agency, a certification, a clearance or a standard. It is a set of rules in the Code of Federal Regulations, and the question it answers is: may this item, this drawing or this piece of assistance leave United States control, and on what terms.
The regulation covers four things people often treat as one. It covers items on the United States Munitions List. It covers technical data about those items, which is where most contractors actually encounter it. It covers defense services, meaning assistance furnished to foreign persons. And it covers brokering, the arranging of transactions in defense articles by third parties.
The word “export” in ITAR is also broader than shipping. Sending a controlled drawing by email is an export. Showing it on a screen during a video call is an export. Letting a foreign national employee read it at a desk in Ohio is an export. Short definitions for the terms used throughout this article are in the GovCon glossary.
That last case has its own name, the deemed export, and its own section below.
Which Regulation ITAR Is, and What Law Authorizes It
ITAR sits at 22 CFR parts 120 through 130. The authorizing statute is the Arms Export Control Act, 22 U.S.C. 2778, which gives the President authority to control the export and import of defense articles and defense services and to designate which items are covered. That authority is delegated to the Secretary of State and exercised through the Directorate of Defense Trade Controls, usually written as DDTC.
The parts divide the subject cleanly, and knowing which part answers which question saves a great deal of time:
- Part 120. Purpose and definitions. Every argument about scope ends up here.
- Part 121. The United States Munitions List itself.
- Part 122. Registration of manufacturers and exporters.
- Part 123. Licenses for the export and temporary import of defense articles.
- Part 124. Agreements, offshore procurement and other defense services.
- Part 125. Licenses for the export of technical data and classified defense articles.
- Part 126. General policies and provisions, including the exemptions.
- Part 127. Violations and penalties.
- Part 128. Administrative procedures.
- Part 129. Registration and licensing of brokers.
- Part 130. Political contributions, fees and commissions.
A component maker lives mostly in parts 120, 121, 122 and 125. A company that never touches hardware but does touch drawings still lives in 125.
What Counts as a Defense Article or a Defense Service
A defense article is defined at 22 CFR 120.31 as any item or technical data designated in section 121.1. The definition reaches further than finished hardware. It includes technical data in any physical form, models and mockups, and unfinished products such as forgings, castings, extrusions and machined bodies that are clearly identifiable as defense articles by their mechanical properties, material composition, geometry or function. It excludes basic marketing information on function or purpose and general system descriptions.
That exclusion is narrower than marketing teams assume. A capability sheet is generally outside it. A dimensioned cutaway is not, and neither is the machining drawing attached to an RFQ.
A defense service is defined at 22 CFR 120.32 in three prongs: furnishing assistance, including training, to foreign persons in the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing or use of defense articles; furnishing controlled technical data to foreign persons; and military training of foreign units and forces.
A defense service can therefore be delivered without anything leaving the country and without anything being sold. An engineer answering a foreign colleague’s question about assembling a controlled part is potentially furnishing one.
What the USML Is
The United States Munitions List is at 22 CFR 121.1, organized into twenty-one categories numbered I through XXI, from firearms and ammunition through aircraft, spacecraft, military electronics, submersibles and toxicological agents.
A part is either described by a USML entry or it is not. There is no partial listing and no self-certification, and where the answer is unclear the mechanism is a commodity jurisdiction request to DDTC, not an internal memo.
What Counts as Technical Data
Technical data is defined at 22 CFR 120.33. It covers information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles. It also covers classified information relating to USML and 600 series items, information covered by an invention secrecy order, and software directly related to defense articles.
Two exclusions matter. Technical data does not include general scientific, mathematical or engineering principles commonly taught in schools, colleges and universities, and it does not include information in the public domain as defined at 22 CFR 120.34. Neither is a wide door: publishing something yourself does not put it in the public domain for ITAR purposes.
Who Must Register With DDTC
22 CFR 122.1(a) states the rule directly: any person who engages in the United States in the business of manufacturing or exporting or temporarily importing defense articles, or furnishing defense services, is required to register. Two clauses in it are the ones companies miss.
- One occasion is a business. The regulation says that engaging in such a business requires only one occasion of manufacturing, exporting, temporarily importing or furnishing a defense service. A single job is enough.
- Manufacturing alone triggers it. The section states that a manufacturer who does not engage in exporting must nevertheless register. A machine shop that only ever ships to a prime down the road is still in scope if what it makes is on the USML.
Section 122.1(b) sets out four exemptions: officers and employees of the United States Government acting in an official capacity; persons whose pertinent business activity is confined to the production of unclassified technical data only; persons all of whose manufacturing and export activities are licensed under the Atomic Energy Act of 1954, as amended; and persons who engage only in the fabrication of articles for experimental or scientific purpose, including research and development.
Note what is not on that list. There is no small business exemption, no revenue threshold and no exemption for subcontractors. Registration is unrelated to the federal entity registration in SAM.gov, which does not touch export control at all.
What DDTC Registration Costs
Fees are set at 22 CFR 122.3 and are tiered by how much licensing activity the registrant actually generates:
- Tier 1, $3,000 per year. New registrants, and renewing registrants who did not receive a favorable determination during the twelve month period ending 90 days before expiration.
- Tier 2, $4,000 per year. Renewing registrants with five or fewer favorable determinations in that period.
- Tier 3, $4,000 plus $1,100 per determination above five. Renewing registrants with more than five favorable determinations in that period.
DDTC publishes reduced fee arrangements for 501(c)(3) organizations and low value exporters on its own site. The planning point is that a company with no export activity still pays $3,000 a year to hold a registration it may never use, so registering is a real decision, not a formality.
There Is No Such Thing as ITAR Certification
This is the section worth sending to whoever asked whether the company is “ITAR certified.” The answer is in 22 CFR 122.1(c), and it is unusually blunt for a regulation.
Registration, the section says, is primarily a means to provide the United States Government with necessary information on who is involved in certain manufacturing and exporting activities. Registration does not confer any export rights or privileges. It is generally a precondition to the issuance of any license or other approval.
Three things follow from that sentence, and each one changes how a capture team should answer the question.
- There is no certificate to send. A registrant receives a registration code and an expiration date. There is no scored assessment, no audit, no certifying body and no logo.
- Being registered permits nothing. A registered company that exports a defense article without a license or an applicable exemption has committed the same violation an unregistered one would have.
- The buyer usually means something else. What a prime asking about ITAR normally wants to know is whether you are registered where registration is required, whether your workforce and facilities can handle technical data without an unlicensed release, and whether you have an export compliance program that would survive a look. Answer those three.
The honest reply to “are you ITAR certified” is that no such certification exists, followed by the registration status and the controls that actually apply. A confident yes tells a prime’s compliance function something untrue, which is worse than the awkward correction.
How to Register With DDTC
Registration is filed electronically through the Defense Export Control and Compliance System, DECCS, on the DDTC website. The mechanics are set out at 22 CFR 122.2.
- Create the DECCS account and enroll the organization. Access is per person, so set the account structure up before the filing, not during it.
- Complete the Statement of Registration, Department of State form DS-2032. This is the registration document itself.
- Have it signed by a U.S. person senior officer. The regulation gives examples: chief executive officer, president, secretary, partner, member, treasurer, general counsel. The signer must have authority to execute the document.
- Attach proof of standing. Documentation demonstrating that the registrant is incorporated or otherwise authorized to do business in the United States.
- Complete the certifications. The signing officer certifies whether the entity or its leadership has faced charges or convictions under the specified statutes or foreign export laws, and discloses foreign ownership or control.
- Pay the fee for the applicable tier. Set by 22 CFR 122.3, as above.
Foreign ownership or control is a disclosure, not a disqualification, but it is the item most likely to turn a filing into a conversation. Assemble that picture before starting rather than in the middle of a form.
How Long Registration Takes
The regulation publishes no committed processing time, so any number quoted online is somebody’s experience rather than a rule. What it does give you is a hard window on the renewal side: 22 CFR 122.2 requires renewal submissions at least 30 days but no earlier than 60 days prior to the expiration date.
That window is the date to schedule against. It is narrow, it repeats every year, and a lapsed registration takes the licensing pipeline down with it. Treat 60 days as the trigger and 30 days as the deadline.
When You Need an Export License
If an activity is an export of a defense article, technical data or a defense service, it needs a license or an exemption. There is no third option and no de minimis quantity.
The licenses are filed in DECCS and the common ones are easy to keep straight:
- DSP-5. Permanent export of unclassified defense articles and related unclassified technical data. This is the workhorse, and it is also the form used for technical data releases.
- DSP-73. Temporary export of unclassified defense articles, for demonstrations, trials and trade shows where the item comes back.
- DSP-61. Temporary import of unclassified defense articles, for repair or evaluation work performed in the United States.
- Part 124 agreements. A technical assistance agreement or manufacturing license agreement, rather than a license, is the instrument for ongoing defense services and for transferring manufacturing know-how.
Exemptions live in part 126 and elsewhere in the subchapter, and every one of them is conditional. The exemption added for Australia and the United Kingdom at 22 CFR 126.7 is a good illustration of how tightly drawn these are. Using it requires that the activity take place within the territory of Australia, the United Kingdom or the United States; that the parties be registered United States persons, government departments or agencies, or entities identified as Authorized Users through the DDTC website; that the article not appear in supplement no. 2 to part 126; and that value limits under 22 CFR 123.15 be respected.
Read that as a checklist, not a paragraph: four conditions, all of which must hold, any one of which a supplier change can falsify. An exemption claimed without checking every element is an unlicensed export with paperwork attached.
What a Deemed Export Is, and Why It Reaches Into Hiring
22 CFR 120.50(a)(2) includes in the definition of export: releasing or otherwise transferring technical data to a foreign person in the United States. That is a deemed export. No shipment, no border, no customs form. The release itself is the export.
Section 120.50(b) then states the rule that surprises people. Any release in the United States of technical data to a foreign person is deemed to be an export to all countries in which the foreign person has held or holds citizenship or holds permanent residency. Not one country. Every country on that person’s record.
The definitions behind it are worth reading directly. 22 CFR 120.62 defines a U.S. person by reference to lawful permanent residence under 8 U.S.C. 1101(a)(20) or protected individual status under 8 U.S.C. 1324b(a)(3), and includes entities incorporated to do business in the United States and federal, state and local government entities. 22 CFR 120.63 defines a foreign person as anyone who is not a U.S. person. Working lawfully in the United States on a visa does not make someone a U.S. person for this purpose.
That is where this stops being an export topic and becomes an operations topic. Every one of the following is a release:
- A controlled drawing attached to an email that reaches a distribution list with one foreign person on it.
- A screen shared in a design review with a supplier engineer on the call.
- A repository whose read access includes a contractor working from outside the country.
- A cloud administrator with unrestricted access to a folder of controlled files, whether or not they ever open one.
- An onboarding process that grants the standard shared drive before anyone made an export determination.
How to handle this compliantly is a licensing and access control question to run with export counsel, because the employment law rules on collecting and using citizenship information run alongside the ITAR rules and are not identical to them. The point from the regulation itself is not in dispute: access to technical data is an export decision, and it has to be made before access is granted.
ITAR vs EAR: Which Regime Applies
The Export Administration Regulations, administered by the Commerce Department, control dual use items. Most contractors touch the EAR long before ITAR, and the two are structurally different in ways that matter.
| ITAR | EAR | |
|---|---|---|
| Administered by | Directorate of Defense Trade Controls, Department of State | Bureau of Industry and Security, Department of Commerce |
| Rulebook | 22 CFR parts 120 to 130 | 15 CFR parts 730 to 774 |
| Control list | United States Munitions List, 22 CFR 121.1, twenty-one categories numbered I to XXI | Commerce Control List, ten categories numbered 0 to 9 and five product groups A to E |
| How an item is identified | By USML category and subcategory | By Export Control Classification Number, built from the category digit, the product group letter and control reason digits |
| Registration | Required of manufacturers, exporters, temporary importers and furnishers of defense services under 22 CFR 122.1 | No general registration requirement |
| Licensing posture | License or exemption required for any export of a listed article, service or its technical data | License requirement depends on the ECCN, the destination country and the end use and end user |
The Commerce Control List structure is set out at 15 CFR 738.2: ten categories from nuclear materials through chemicals, materials processing, electronics, computers, telecommunications and information security, lasers and sensors, navigation and avionics, marine, and aerospace and propulsion, crossed with five product groups separating equipment, test equipment, materials, software and technology.
The burden sits in different places. Under the EAR the work is classification, because many items need no license for many destinations. Under ITAR the item is controlled, full stop, and the work is licensing and access control. One program covering both regimes tends to apply EAR habits to ITAR items, which is the wrong direction to be wrong in.
Where Export Control Overlaps With CUI
Export controlled information is also a category of Controlled Unclassified Information. The NARA CUI Registry carries a category called Export Controlled with the marking abbreviation EXPT. Its description covers unclassified information concerning certain items, commodities, technology, software or other information whose export could reasonably be expected to adversely affect United States national security and nonproliferation objectives, and the authorities it lists include 22 CFR 120.21 and 124.9(a)(5).
The banner follows the usual CUI pattern: CUI//SP-EXPT when handled as CUI Specified, CUI or CUI//EXPT when handled as CUI Basic. Which applies is set by the authority the information falls under, not by preference.
On the contract side, DFARS carries an explicit clause. DFARS 252.225-7048, Export-Controlled Items, defines export controlled items as items subject to the EAR at 15 CFR parts 730 through 774 or the ITAR at 22 CFR parts 120 through 130, and requires the contractor to comply with all applicable laws and regulations regarding export controlled items, including the requirement for contractors to register with the Department of State in accordance with the ITAR.
That clause is worth locating in your own contracts before assuming it is not there. It flows into subcontracts, and a subcontract issued under a task order on an IDIQ carries whatever the base vehicle carried. The registration obligation described earlier can therefore arrive as a contract term rather than as a compliance discovery.
One consequence is worth stating plainly. Because export controlled information is CUI, it inherits the CUI handling regime: marking, safeguarding, dissemination limits and destruction. A company that has stood up CUI handling has done part of the work, not the licensing part, and no amount of CUI hygiene substitutes for a license.
What ITAR Violations Cost
The penalties are set in two places, and both are per violation rather than per incident, which is the detail that turns a filing error into a large number.
- Civil. 22 CFR 127.10(a)(1)(i) sets a civil penalty not to exceed the greater of $1,271,078 or twice the value of the transaction that is the basis of the violation. That figure is adjusted for inflation, so the current amount is the one in the regulation on the day you read it.
- Criminal. 22 U.S.C. 2778(c) provides that a person who willfully violates the section, or any rule or regulation issued under it, may be fined for each violation not more than $1,000,000 or imprisoned not more than 20 years, or both.
Beyond the money, DDTC can deny, revoke or suspend licenses, and settlements commonly impose an oversight period with an external compliance officer and audits. That oversight is usually the more disruptive half.
This article names no companies or settlement amounts, because those figures could not be verified against a primary State Department source. What the regulation does define is the acts, and three of them shape most compliance programs:
- Exporting without a license or a valid exemption. Including the exemption that was valid last year and is not valid for this shipment.
- Releasing technical data to a foreign person. The deemed export, usually through access rather than through a decision.
- Manufacturing USML items without registering. The 22 CFR 122.1(a) obligation that applies even to a company that never exports anything.
DDTC publishes consent agreements, charging letters and orders on its own portal. Reading two or three is a better use of an afternoon than any summary, including this one, because the recitals describe exactly how the control failed.
Keeping Export-Controlled Work Out of the Capture Stack
A distributed capture team creates the deemed export problem structurally, not through carelessness. It starts with an RFI response that described a capability in more detail than it needed to. Then the technical volume needs the drawing, the drawing gets pasted into the proposal tool, the reviewer opens it on a laptop, the teaming partner asks for it, and the export decision that should have preceded all of it never happened.
The fix is architectural and it is simple to state. Technical data does not belong in the capture stack. Capture tooling holds the record of the pursuit: which opportunity, which agency, which vehicle, who is on the team, what is due, what was submitted, what happened. Controlled technical data belongs in whatever access controlled environment your export compliance program designates, and the capture record should point at it rather than contain it.
Four questions are worth being able to answer about any pursuit on any working day:
- Does this pursuit involve USML items or export controlled technical data, and who decided that?
- Which contract clauses on this vehicle carry export obligations, and do they flow to our subcontractors?
- Is our DDTC registration current, and what is its expiration date against the 60 to 30 day renewal window?
- Who has access to the pursuit workspace, and has anyone been added since the export determination was made?
GovOps360 keeps that record: the opportunity, the vehicle, the team, the clause obligations, the dates and the outcome, in one place where a registration expiry or a new team member is visible before a deadline rather than after. It is a capture system, not a controlled technical data environment, and it should not be used as one. Keep the drawings where your compliance program says they go, and keep the capture record pointing at them. GovFind finds the opportunity. GovOps360 wins it.
See Where GovOps360 Fits Your Pipeline
Bring the states and districts you already sell to, and the cooperative contracts you hold. We will walk through how the coverage gaps and renewal dates would be tracked, and tell you where another tool is the better fit.
Frequently Asked Questions
1. What does ITAR stand for?
2. Is ITAR certification a real thing?
3. Do subcontractors have to register with DDTC?
4. What does DDTC registration cost?
5. What is a deemed export?
6. What is an empowered official?
7. What is the difference between ITAR and EAR?
8. Is export controlled information the same as CUI?
References and Sources
Every regulatory citation in this article was read against the Code of Federal Regulations and the United States Code on 6 September 2026. Registration fees, penalty amounts and definitions are quoted from the sections listed below rather than from secondary summaries.
- 22 U.S.C. 2778, the Arms Export Control Act section authorizing ITAR, and the criminal penalty provision at subsection (c)
- 22 CFR 120.31, the definition of defense article
- 22 CFR 120.32, the definition of defense service and its three prongs
- 22 CFR 120.33, the definition of technical data and its exclusions
- 22 CFR 120.50, the definition of export, including the deemed export and the multiple nationality rule at subsection (b)
- 22 CFR 120.62, the definition of U.S. person, which is what decides whether a release is an export
- 22 CFR 120.67, the definition of empowered official
- 22 CFR 121.1, the United States Munitions List
- 22 CFR 122.1, who must register, the exemptions, and the statement at subsection (c) that registration confers no export rights
- 22 CFR 122.2, the Statement of Registration, form DS-2032, and the renewal window
- 22 CFR 122.3, the registration fee tiers
- 22 CFR 126.7, the Australia and United Kingdom exemption and its conditions
- 22 CFR 127.10, civil penalties
- 15 CFR 738.2, the structure of the Commerce Control List and the ECCN
- DFARS 252.225-7048, Export-Controlled Items, the contract clause that carries the registration requirement
- NARA CUI Registry, Export Controlled category, marking abbreviation EXPT
- The DDTC public portal, DECCS filing and the published consent agreements and charging letters
Related reading: CUI, FOUO and SCIF handling rules covers the marking and safeguarding side of export controlled information, FAR vs DFARS covers the supplement that carries the export clause, and UEI and CAGE registration covers the federal registration that DDTC registration is often confused with.
Alaa Negeda
Senior Solution Architect with 23 years of experience in different Technology sectors. Diligent, forward-thinking, and adaptable to dynamic company, customer, and project needs.
Related Articles
Sep 30,2026 RFP vs RFQ vs RFI: Which Solicitation You Are Looking At and What to Do
Sep 28,2026 DDQ Meaning: What a Due Diligence Questionnaire Asks and How to Answer It
Sep 23,2026