ITAR Compliance
Export-controlled data, US-person access, and a program that proves it.
Compliance Gauge designs the environment and the compliance program for organizations handling ITAR technical data.
What it is
The International Traffic in Arms Regulations control the export of defense articles and technical data on the United States Munitions List. For most manufacturers, ITAR compliance is an IT problem as much as a legal one: technical data must be stored in the US, accessible only to US persons, and every access must be controllable and demonstrable. Cloud services that are not US-sovereign can constitute an export.
Who needs it
- Aerospace and defense manufacturers and suppliers
- Engineering firms working with USML-listed designs
- Companies with foreign-national employees or overseas offices
- Organizations already pursuing CMMC Level 2 with ITAR data in scope
What we do
- ITAR data identification and DDTC registration support
- US-persons access enforcement through identity and conditional access
- US-sovereign cloud design: Microsoft GCC High, Azure Government
- Technology control plan, visitor and screening procedures
- Employee training and recordkeeping
- Integration with your CMMC or NIST 800-171 program to avoid duplicate controls
The same four steps, every framework.
Scoped gap assessment
Inventory, data-flow mapping and a scored findings list with a cost to close.
Remediation plan
Every gap gets an owner, a fix and a date on the plan of action.
Implementation and evidence
Our engineers close the gaps; evidence is captured control by control.
Mock audit, then the real one
We run it the way the assessor will, then sit beside you for the real thing.
Frequently asked questions
Is storing ITAR data in the cloud an export?
It can be. Technical data in a cloud where non-US persons or non-US data centers can access it is a deemed export. US-sovereign services such as Microsoft GCC High and Azure Government are designed to avoid this.
Who counts as a US person under ITAR?
US citizens, lawful permanent residents and certain protected individuals. Employees on work visas are not US persons and require an export license before accessing ITAR technical data.
Do we need to register with DDTC?
Any US manufacturer or exporter of defense articles or services listed on the USML must register with the Directorate of Defense Trade Controls, whether or not they export.
Does ITAR require a specific IT standard?
ITAR does not prescribe technical controls, but the access, residency and recordkeeping requirements are typically met by implementing NIST 800-171 within a US-sovereign environment, which also satisfies CMMC.
Can ITAR and CMMC be handled together?
Yes, and they should be. The same enclave and control set serve both; we integrate the ITAR technology control plan with your SSP.
Find out where you stand on ITAR.
A scoped gap assessment gives you a compliance score, a findings list and a cost to close — before you commit to anything.