The International Traffic in Arms Regulations (ITAR) are the US rules that control the export and import of defense articles, services, and technical data listed on the US Munitions List (USML). They are administered by the Directorate of Defense Trade Controls (DDTC) within the US Department of State and codified at 22 CFR Parts 120 to 130. ITAR exists to keep military-critical technology from reaching foreign adversaries, and its default posture is restrictive: if an item is on the USML, you assume it is controlled.
What is ITAR?
It is the export-control regime for things that are inherently military. That covers physical hardware like weapons and military aircraft, but just as importantly it covers technical data and defense services, including drawings, specifications, software, and know-how tied to USML items. Sharing that data with a foreign person, even inside the United States, counts as an export. Purely commercial and dual-use items are handled under the separate EAR regime instead.
Who has to comply with ITAR?
Any US company or person that manufactures, exports, brokers, or handles defense articles or defense services: aerospace and defense primes, their subcontractors, and technology developers whose work touches USML items. Manufacturers must register with DDTC. Because the regulation reaches technical data and access, the obligation flows down the supply chain, so a small machine shop building a USML component carries the same access-control duties as the prime it supplies. See defense contracting.
Why does ITAR matter for cybersecurity?
Because ITAR compliance is largely an access-control problem. The rule is that only authorized US persons may see ITAR-controlled technical data, so you have to prove that unauthorized foreign nationals cannot reach the systems, files, and networks that hold it. That means identity-based access control, network segmentation, encryption of controlled data, and logging that shows who accessed what. A misconfigured share or an unmanaged remote session can be an export violation, not just an IT lapse.
How does ITAR relate to CMMC and NIST 800-171?
They reinforce each other. NIST SP 800-171 defines the safeguards for controlled unclassified information, and CMMC verifies that defense contractors actually implement them. ITAR technical data is a category of information those safeguards protect, so a contractor building a compliant CUI enclave is usually building much of what ITAR data protection requires at the same time. DFARS ties these obligations into defense contracts.
How is ITAR different from the EAR?
Different lists, different agencies, different defaults. ITAR (State/DDTC) governs defense articles on the US Munitions List and starts from a restrictive posture. The EAR (Commerce/BIS) governs commercial and dual-use items on the Commerce Control List, with more room for license exceptions. A single program can involve both, so exporters classify each item and route it to the correct regime before sharing or shipping.
In practice
A US aerospace manufacturer building military aircraft components has to keep every stage, from design files to production data, inside an environment only authorized US persons can reach. That typically means encrypting USML technical data, restricting access on a need-to-know basis, logging and monitoring for unauthorized attempts, and vetting any partner or subsidiary before granting access. The vetting and the technical controls have to hold across the whole supply chain, not just inside one company.
Keeping ITAR technical data away from unauthorized persons is fundamentally about identity-based access control and segmentation, though ITAR itself is a legal regime and no product makes you compliant on its own.
