CMMCpedia
Work with me

Terms / What you protect

ITAR

The International Traffic in Arms Regulations, which control defense articles and technical data. Showing that data to a foreign person is an export.

Also called International Traffic in Arms Regulations, 22 CFR 120.

Official Source Material

Section 38 of the Arms Export Control Act (22 U.S.C. 2778), as amended, authorizes the President to control the export and import of defense articles and defense services. The statutory authority of the President to promulgate regulations with respect to exports of defense articles and defense services is delegated to the Secretary of State by Executive Order 13637.

Source: 22 CFR 120.1(a), eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

ITAR is a different regime from CMMC, with a different regulator and much sharper teeth.

The International Traffic in Arms Regulations live at 22 CFR Parts 120 through 130 and are administered by the State Department, not the Defense Department. They control defense articles on the United States Munitions List and the technical data behind them. The Export Administration Regulations, run by the Commerce Department, cover dual-use items instead. An item falls under one regime or the other, never both. Nobody harmonizes these rules with CMMC for you, so you apply them together.

An export happens inside your own building.

Releasing technical data to a foreign person is an export even when nobody leaves the country. Under 22 CFR 120.56 a release includes visual inspection of a defense article that reveals technical data, and oral or written exchanges of technical data in the United States or abroad. Giving a foreign person the means of access counts as well. A password or a decryption key is access information, so handing one over is a release even if no file is opened.

The standard is capability, not evidence of an actual leak.

The question an investigator asks is whether a foreign person could reach the technical data, and whether you can show they could not. That reframes ordinary IT decisions, starting with AC.L2-3.1.1 and who is authorized. A monitoring service with a follow-the-sun staffing model, an outsourced administrator, or an identity account that can grant itself access are all exposures, because each one creates the capability. Build the control so the access cannot happen, and keep the records that show it.

Penalties here are personal, which is why this outranks a compliance schedule.

Export violations carry fines and prison terms for individuals, not just corporate liability. Most of the CUI categories carry no sanctions of that kind. When export-controlled work and a CMMC deadline compete for your attention, the export question is the one to answer first.

What falls short

  • An access review that lists roles without recording U.S. person status. The regulations turn on that status, so it belongs in the record.
  • Support or monitoring provided from outside the United States over systems holding technical data. The provider's administrators hold the capability, which is the violation.
  • A visitor policy that lets a foreign visitor stop and study work in progress. Brisk escorted movement through a controlled area is different from letting someone examine an article.

Edge cases

  • Your data is export-controlled information but not Controlled Unclassified Information. ITAR applies in full and CMMC does not reach it, so protect it under the export program and document why it sits outside your assessment scope.
  • You want to use a commercial cloud service. The cloud carve-out at 22 CFR 120.54 is narrow, requires end-to-end encryption, and excludes storage in proscribed countries. Most companies handling technical data end up in a Government community cloud with U.S. person operations instead.
  • Your company is foreign owned. A U.S. subsidiary that administers the environment, with foreign national access authorized under an agreement, is the usual structure. Get export counsel before you build it.

Over-engineering

  • An export licence application for a data set nobody has classified. Have an export attorney or a program engineering review classify it first, not IT. The answer is often that no licence is needed.
  • A full export compliance department for a shop that does not export and did not design the item. An Export Control Plan, a Technology Control Plan, and basic records are the usual minimum.
  • A separate physical facility for every program. Separating each program's data by access, with a written technology control plan, is the ordinary answer for a small company.