ITAR compliant cloud storage requirements come down to three non-negotiables: the servers holding your technical data must sit inside the United States, only verified U.S. persons can access that data at any layer of the stack, and encryption must be structured so the cloud provider itself cannot read your files. Miss any one of these and a routine upload can qualify as an unauthorized arms export, with civil penalties reaching $1,271,078 per violation and criminal exposure up to 20 years in prison.1eCFR. 22 CFR 127.10 – Civil Penalty
What Data Actually Falls Under ITAR
Before you configure anything, you need to know what you are protecting. ITAR defines “technical data” as any information needed to design, develop, produce, manufacture, assemble, operate, repair, test, maintain, or modify a defense article listed on the U.S. Munitions List. That reaches blueprints, drawings, photographs, plans, instructions, documentation, and software directly related to those articles.2eCFR. 22 CFR 120.33 – Technical Data Format is irrelevant. A CAD file, a PDF test report, and a maintenance manual are all technical data if the underlying subject is on the Munitions List.
The definition carves out general scientific or engineering principles taught in schools, information already in the public domain, and basic marketing materials describing a defense article’s function in general terms.2eCFR. 22 CFR 120.33 – Technical Data Companies get burned by assuming their files fit one of those exclusions without doing the analysis. A detailed performance specification is not a textbook, even when both describe the same technology.
When classification is genuinely unclear, the Directorate of Defense Trade Controls will issue a formal ruling through a Commodity Jurisdiction request.3U.S. Department of State – Directorate of Defense Trade Controls. Commodity Jurisdictions Getting classification wrong at the outset means applying the wrong compliance framework to your entire cloud operation, and that mistake tends to compound quietly until an audit surfaces it.
Why Cloud Storage Is a Deemed Export Problem
Under ITAR, an “export” includes releasing or transferring technical data to a foreign person inside the United States. The regulations call this a deemed export, and it applies to every country where that foreign person holds citizenship or permanent residency.4eCFR. 22 CFR Part 120 – Purpose and Definitions – Section 120.50 An engineer with dual citizenship in France accessing your files from a desk in Virginia counts as an export to France.
Cloud storage amplifies this risk in a way on-premises storage does not. When your data sits on a provider’s servers, every administrator, support technician, and subcontractor with backend access is a potential export recipient. If any of them are foreign nationals and can view unencrypted data, you have an unauthorized export. Automated systems do not sidestep the rule either: if a provider’s analytics or monitoring tools process your plaintext technical data and foreign-national employees can view those results, the deemed export analysis is the same.
Who Qualifies as a U.S. Person
ITAR restricts technical data access to “U.S. persons.” A U.S. person is a lawful permanent resident as defined by federal immigration law, or a “protected individual,” which includes U.S. citizens, nationals, refugees, asylees, and certain individuals granted temporary residence. The definition also covers corporations, partnerships, trusts, and other entities incorporated in the United States, plus federal, state, and local government bodies.5eCFR. 22 CFR 120.62 – U.S. Person
Verifying status for your own workforce means reviewing identity and work-authorization documents. Every U.S. employer already completes Form I-9 for each hire, examining documents that establish identity and employment authorization.6U.S. Citizenship and Immigration Services. I-9, Employment Eligibility Verification For ITAR purposes, that alone is not enough. A person on a temporary work visa can be fully authorized to work in the United States and still be a foreign person under ITAR. Confirm actual citizenship, permanent residency, or protected individual status for anyone who will touch controlled data, and extend that check to third-party consultants, IT support staff, and managed service providers with administrative access to your environment.
Server Location and Provider Environments
Controlled data must live on servers physically located within the United States, and only U.S. persons can access it.7Google Cloud Documentation. Data Boundary for ITAR This requirement reaches every layer of the stack: the physical hardware, the hypervisor, the network management plane, and the support staff who troubleshoot incidents. A data center in Ohio staffed partly by foreign-national administrators fails the test even though the building sits on U.S. soil.
The major cloud providers address this through dedicated government environments. AWS GovCloud and Microsoft Azure Government are the most widely used platforms marketed for ITAR workloads, each operating isolated regions with access restricted to screened U.S. persons. Google Cloud offers an ITAR control package through its Assured Workloads product. Choosing one of these does not automatically make you compliant. You still have to configure the environment correctly, manage your own encryption keys, and verify that nothing in your usage routes data through non-compliant regions or services.
Encryption That Keeps the Provider Blind
Encryption is what prevents the cloud provider from becoming an inadvertent recipient of your technical data. If the provider can decrypt and view your files, its employees are “accessing” that data in ITAR terms, and any foreign nationals among them create a deemed export. The practical fix is customer-managed encryption keys: you generate and hold the keys, the provider stores only ciphertext, and no one at the provider can read the plaintext.
AES-256 remains the standard for data at rest. Cryptographic modules should be validated under FIPS 140-3, which replaced FIPS 140-2 as the active validation standard. Existing FIPS 140-2 validated modules can still be used in new systems until September 21, 2026, after which they move to a historical list and are only acceptable in existing deployments.8NIST Computer Security Resource Center. Cryptographic Module Validation Program If you are building a new compliant environment in 2026, plan around FIPS 140-3 validated modules rather than swapping cryptographic components within months of deployment.
Encrypt data locally before it leaves your network. Transfer files through secure protocols like SFTP or HTTPS with strong cipher suites. Once the data is in the cloud, verify that access controls actually work: test that users outside the approved list are blocked, not just theoretically excluded by a policy document. Most compliance failures happen not because the platform is inadequate but because the customer misconfigures something that was their responsibility under the shared responsibility model all along.
Audit Logging and Record Retention
Enable automated audit logs that capture every instance of data access, modification, and deletion. Configure real-time alerts for anomalies: access attempts from unrecognized IP addresses, login attempts by unauthorized accounts, and any changes to the access control settings themselves. These logs create the forensic trail for internal reviews and for any investigation the Department of State may conduct.
Federal regulations require registrants to maintain records for at least five years from the expiration of the relevant license or authorization, or from the date of the transaction.9eCFR. 22 CFR 122.5 – Maintenance of Records by Registrants The DDTC can prescribe a longer period case by case. Treat five years as the floor, and make sure log retention accounts for the reality that an investigation can begin years after the activity in question.
Sharing Access with Foreign Partners
If your operations involve disclosing technical data or providing defense services to foreign persons, even allies, you need prior DDTC approval. That approval typically comes through a Technical Assistance Agreement, which authorizes the specific data to be shared and the defense services to be performed.10U.S. Department of State – Directorate of Defense Trade Controls. Agreement Guidance Overseas maintenance or training, releases of manufacturing data to foreign parties, and technical evaluations with foreign persons commonly require a TAA.
A multinational team with a shared cloud workspace can cross this line without noticing. Giving a foreign partner access to a folder of ITAR-controlled schematics without a TAA in place is an unauthorized export, even when everyone involved holds proper clearances in their own country.
A Note on CMMC
Companies handling Controlled Unclassified Information for Department of Defense contracts also face the Cybersecurity Maturity Model Certification. CMMC Level 2 applies to CUI protection and requires compliance with the 110 security requirements in NIST SP 800-171 Revision 2.11Department of Defense Chief Information Officer. About CMMC CMMC and ITAR are separate regimes. An environment that meets ITAR requirements for access control and encryption will cover much of the Level 2 territory, but NIST 800-171 extends into incident response planning and personnel security areas that ITAR does not specifically address.
Destroying ITAR Data at End of Life
Compliance does not end when you stop using a file. When controlled technical data reaches the end of its lifecycle, destruction has to make recovery impossible. The federal standard for media sanitization is NIST Special Publication 800-88 Revision 1, mandatory for federal agencies under FISMA and required for defense contractors handling CUI under DFARS.12NIST Computer Security Resource Center. SP 800-88 Rev. 1, Guidelines for Media Sanitization
NIST 800-88 defines three escalating methods: Clear (overwriting with nonsensitive data), Purge (techniques that resist laboratory recovery), and Destroy (physically rendering the media unusable). For CUI, Destroy is recommended, which means shredding hard drives to particles smaller than 6mm, pulverizing solid-state drives to under 2mm, and incinerating magnetic tapes. In a cloud environment you cannot physically destroy the provider’s hardware, so the combination of customer-managed encryption and cryptographic erasure, meaning permanent deletion of the encryption keys, becomes the primary destruction method. Document every disposal action.
Penalties for Getting It Wrong
Civil penalties can reach $1,271,078 per violation, or twice the value of the transaction, whichever is greater.1eCFR. 22 CFR 127.10 – Civil Penalty Criminal violations carry fines up to $1 million and imprisonment up to 20 years per violation.13U.S. Department of State Directorate of Defense Trade Controls. DDTC Compliance Actions Because penalties apply per violation, a single misconfigured folder accessible to multiple foreign nationals can generate multiple counts.
Convicted persons also face statutory debarment. A debarred individual or company is prohibited from participating directly or indirectly in any defense export activity until the DDTC grants reinstatement and publishes notice in the Federal Register.14U.S. Department of State – Directorate of Defense Trade Controls. Debarred Parties For a defense contractor, that is effectively fatal to the business.
If You Discover a Violation
Reporting a potential violation to the DDTC before they find it can significantly affect the outcome. The regulations explicitly encourage voluntary disclosure, and the DDTC may treat it as a mitigating factor in setting penalties.15eCFR. 22 CFR 127.12 – Voluntary Disclosures Factors weighed include whether the transaction would have been approved if properly licensed, why the violation occurred, the degree of cooperation during the investigation, and whether the company has strengthened its compliance program to prevent recurrence.
Failing to disclose a known violation is treated as an adverse factor. A qualifying disclosure has to come with the knowledge and authorization of senior management; a report filed by a mid-level employee without executive backing does not count.15eCFR. 22 CFR 127.12 – Voluntary Disclosures Disclosure does not guarantee leniency, and violations can still be referred to the Department of Justice for criminal prosecution. Companies that self-report and demonstrate genuine corrective action consistently fare better than those caught in an investigation.