An ITAR facility is any location where your company manufactures, stores, tests, repairs, or digitally accesses items or technical data on the United States Munitions List, and the requirements for running one are set by the activity happening inside, not by any government designation of the building itself. To operate one lawfully, you register with the Directorate of Defense Trade Controls, secure the space and its data, control who can see what based on whether they qualify as a U.S. person, capture all of that in a written technology control plan, and keep records for at least five years. The core ITAR facility requirements below apply the same way to a ten-person machine shop as to a major prime contractor. The regulations do not scale down.
What Turns a Space Into an ITAR Facility
No agency issues an “ITAR facility” certificate. The label follows the work. If your company designs, builds, tests, repairs, stores, or digitally accesses USML items or technical data, or performs defense services for foreign persons, the space where that happens is an ITAR facility and must comply.1eCFR. Part 120 – Purpose and Definitions
Who Counts as a U.S. Person
Almost every access decision inside the facility turns on this definition. A U.S. person means a U.S. citizen, a lawful permanent resident, an individual classified as a “protected individual” under federal immigration law, or an entity incorporated in the United States. Federal, state, and local government entities also qualify.2eCFR. 22 CFR 120.62 – U.S. Person Everyone else is a foreign person for ITAR purposes.
Deemed Exports
ITAR’s definition of export goes well beyond shipping something overseas. Releasing or disclosing controlled technical data to a foreign person inside the United States counts as an export to every country where that person holds citizenship or permanent residency.3eCFR. 22 CFR 120.17 – Export This is the “deemed export” rule, and it is what drives most of the physical, digital, and personnel controls inside a compliant facility.
A foreign-national engineer at a desk in your U.S. office cannot view ITAR-controlled drawings on a shared drive without an authorization from DDTC. Letting that person glance at a schematic in a meeting, forwarding a controlled attachment, or issuing network credentials that reach controlled files can each be an unauthorized export.
Physical Security
ITAR does not publish a single checklist, but it does expect controls proportional to what you handle. Restricted entry points, visitor logs, and surveillance are baseline. DDTC’s compliance guidelines recommend that foreign-person visitors always wear badges clearly identifying them as non-U.S. persons, and that foreign-national employees carry visually distinct identification as well, so that anyone in the facility can tell at a glance whether the person next to them is authorized to see what is on their screen or workbench.4Bureau of Political-Military Affairs Directorate of Defense Trade Controls. ITAR Compliance Program Guidelines
Tangible defense articles need secure storage when they are not in use. Depending on classification, that could mean locked cabinets, dedicated vaults, or restricted-access floors. Unclassified ITAR items still carry the export restrictions; “unclassified” is not “uncontrolled.”
Information Security and Encryption
Controlled technical data on your network needs access controls limiting visibility to authorized U.S. persons, plus network segmentation that keeps that data away from systems reachable by anyone else. When unclassified technical data is stored or transmitted via the cloud, ITAR requires end-to-end encryption using cryptographic modules that meet FIPS 140-2 or a successor standard, at 128-bit security strength or higher. The means of decryption cannot be shared with any third party, and the data cannot be intentionally stored in or sent to countries on the State Department’s proscribed list.5eCFR. 22 CFR 120.54 – Activities That Are Not Exports, Reexports, Retransfers, or Temporary Imports
Personnel Screening
If you employ foreign nationals or host foreign visitors, you must screen them for substantive contacts with countries on the State Department’s restricted list. Substantive contacts include regular travel to those countries, ongoing relationships with their nationals, maintaining a residence there, or receiving compensation from entities there. Employees with such contacts are presumed to present a diversion risk unless DDTC determines otherwise. Screening records must be kept for five years and produced on DDTC request.6eCFR. 22 CFR 126.18 – Exemptions Regarding Intra-Company, Intra-Organization, and Intra-Governmental Transfers to Employees Who Are Dual Nationals or Third-Country Nationals
The Technology Control Plan
A technology control plan (TCP) is the internal document that converts ITAR’s broad requirements into specific procedures for your facility. It spells out how controlled data is segregated, who has access, how foreign persons are supervised, and what happens when someone requests restricted material. The Defense Counterintelligence and Security Agency publishes a sample framework most companies build from.
Every employee who interacts with foreign nationals must receive the plan and a briefing on the prohibition against releasing controlled technical data without export authorization. Supervisors confirm that their reports understand the rules, collect signed acknowledgment forms, and verify that U.S. citizen employees know exactly what can and cannot be shared with foreign persons.7DCSA (Defense Counterintelligence and Security Agency). Sample Technology Control Plan (TCP) Foreign persons themselves sign a non-disclosure statement confirming they will not further disclose controlled information to another foreign national or foreign country without DDTC authorization.
Remote Work and Cloud Access
Remote access to ITAR data is possible, but the configuration matters. When an employee reaches controlled data from a home office or while traveling, the transmission avoids being treated as an export only if it uses end-to-end encryption with FIPS 140-2 (or successor) compliant modules at 128-bit strength or higher, with decryption keys never shared with third parties.8Federal Register. International Traffic in Arms Regulations: Creation of Definition of Activities That Are Not Exports, Reexports, Retransfers, or Temporary Imports The data cannot be intentionally stored in or sent from any country on the proscribed list or from the Russian Federation. Data merely in transit over the internet is not considered “stored,” so incidental routing through foreign servers does not automatically trigger an export as long as the other conditions hold. Standard commercial VPNs and cloud platforms often fall short without added configuration.
Registering With DDTC
Before you can lawfully manufacture, export, temporarily import, or broker defense articles or furnish defense services, you must register with the Directorate of Defense Trade Controls at the State Department.9U.S. Department of State Directorate of Defense Trade Controls. Registration Registration is a prerequisite for any export license application.
Annual fees are tiered based on your use of the licensing system:
- Tier 1, $3,000 per year, for new registrants and those with no favorable license determinations in the prior 12-month review period.
- Tier 2, $4,000 per year, for registrants with five or fewer favorable determinations in that period.
- Tier 3, calculated, for registrants with more than five favorable determinations: $4,000 plus $1,100 for each determination above five.
The review period ends 90 days before your current registration expires.10eCFR. Part 122 – Registration of Manufacturers and Exporters
The Empowered Official
Every registered company must designate at least one empowered official to sign license applications and other DDTC requests. That person must be a U.S. person, directly employed in a management or policy-level position, and formally authorized in writing to act on the company’s behalf.11eCFR. 22 CFR 120.67 – Empowered Official They must understand the criminal, civil, and administrative penalties for ITAR violations, hold independent authority to investigate any proposed export, verify the legality of a transaction, and refuse to sign without facing retaliation. It is not a rubber-stamp role.
Ongoing Compliance Obligations
Registration is the starting line. Several obligations continue for as long as you hold ITAR-controlled materials or data.
Records of all export-related activity, including license applications, approvals, and documentation for exports made under exemptions, must be kept for five years from the expiration of the license or approval, or from the transaction date for exemption exports. Electronic records must be stored in a system that prevents undetected alteration and can reproduce legible paper copies on demand.12eCFR. 22 CFR 122.5 – Maintenance of Records by Registrants
Changes to your company’s name, address, ownership, legal structure, board of directors, or senior officers must be reported to DDTC in writing within five days of the event. The notification must be signed by a senior officer such as the CEO, president, or general counsel.13eCFR. 22 CFR 122.4 – Notification of Changes in Information Furnished by Registrants
DDTC’s compliance guidelines call for periodic internal audits to verify the integrity of your program, including random document reviews and process tracing.14Directorate of Defense Trade Controls (DDTC). Compliance Program Guidelines No fixed frequency is set.
If You Discover a Violation
Reporting a possible violation to DDTC before the government finds it can significantly reduce penalties. DDTC treats voluntary disclosure as a mitigating factor in deciding administrative consequences.15eCFR. Part 127 – Violations and Penalties The process runs in two steps: notify DDTC’s Office of Defense Trade Controls Compliance immediately after discovery, then submit a full written disclosure within 60 days identifying who, what, when, where, why, and how, describing corrective actions, and explaining how those actions will prevent recurrence.16U.S. Department of State, Directorate of Defense Trade Controls. Report a Violation
DDTC weighs whether the export would have been authorized if properly applied for, whether the violation was intentional or inadvertent, prior violation history, the quality of the existing compliance program, and whether senior management authorized the disclosure. A disclosure submitted without senior management’s knowledge and approval is not treated as voluntary.
Penalties for Non-Compliance
Anyone who willfully violates the Arms Export Control Act or makes a material misstatement in a registration, license application, or required report faces up to $1,000,000 in fines per violation and up to 20 years in prison.17Office of the Law Revision Counsel. 22 USC 2778 – Control of Arms Exports and Imports The State Department can impose civil fines of up to $1,271,078 per violation, or twice the value of the transaction, whichever is greater, and civil penalties do not require proof of willfulness.18eCFR. 22 CFR 127.10 – Civil Penalty
A criminal conviction triggers statutory debarment, barring the person from participating directly or indirectly in any ITAR-regulated export activity. The standard debarment period is three years from conviction. Reinstatement can be sought beginning one year after debarment, subject to interagency review and a finding that appropriate corrective steps were taken.19Federal Register. Bureau of Political-Military Affairs; Statutory Debarment Under the Arms Export Control Act and the International Traffic in Arms Regulations Where there is probable cause to believe defense articles are being exported unlawfully, those articles and any vehicle, vessel, or aircraft involved are subject to seizure and forfeiture.15eCFR. Part 127 – Violations and Penalties
Those figures are per-violation maximums, and a single investigation often surfaces dozens or hundreds of separate violations. DDTC consent agreements in major cases have carried penalties in the tens of millions of dollars along with mandatory compliance monitoring and remedial measures that reshape operations for years.