Compliance
ITAR Compliance Support for Defense and Manufacturing Organizations
IT controls for organizations handling defense articles and technical data under 22 CFR 120-130. Access controls, not export licensing.
NorthStar helps organizations that handle defense articles and technical data design, implement, and operate the IT controls their ITAR program depends on, including access by U.S. persons, encryption, and logging. The International Traffic in Arms Regulations are 22 CFR parts 120 through 130. They implement section 38 of the Arms Export Control Act (22 U.S.C. 2778) and are administered by the Department of State through the Directorate of Defense Trade Controls (22 CFR 120.1). We are not a certifying body, we do not file registrations or licenses with DDTC, and this page is not a promise that DDTC or any other authority will find your organization in compliance. The summary below is general information, not legal or export-control advice. Your organization remains responsible for its own ITAR compliance determinations, including whether an item or dataset is controlled and whether a license or other approval is required. For the controlling text, read 22 CFR parts 120 through 130 on the electronic Code of Federal Regulations and the DDTC public portal.
What 22 CFR 120-130 covers
This is a plain-language map of the ITAR. It is not a substitute for the regulations themselves.
Who administers ITAR
Section 38 of the Arms Export Control Act (22 U.S.C. 2778) authorizes control of the export and import of defense articles and defense services. That authority is implemented in 22 CFR parts 120 through 130 and is administered by the Department of State through the Directorate of Defense Trade Controls (22 CFR 120.1). For the current text, use the electronic Code of Federal Regulations and the DDTC public portal. The eCFR is a regularly updated unofficial compilation, which is also how DDTC describes it.
Defense articles and the USML
ITAR controls defense articles, defense services, and related technical data described on the United States Munitions List in 22 CFR Part 121. Whether a particular item or dataset is on the USML is a legal determination. NorthStar does not classify items against the USML and does not request a commodity jurisdiction determination from DDTC.
Technical data and deemed exports
Technical data is defined in 22 CFR 120.33 and includes information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles, other than software as defined in 22 CFR 120.40(g). An export is not limited to a shipment leaving the United States. Under 22 CFR 120.50(a)(2), releasing or otherwise transferring technical data to a foreign person in the United States is a deemed export. That is why access controls and logging matter as much as whether data is sent abroad.
U.S. persons and foreign persons
The ITAR defines these terms in 22 CFR 120.62 and 120.63. A U.S. person includes a lawful permanent resident as defined by 8 U.S.C. 1101(a)(20) or a protected individual as defined by 8 U.S.C. 1324b(a)(3), and also includes entities organized to do business in the United States. It is not limited to U.S. citizens, and it does not include a foreign person as defined in 22 CFR 120.63. Access controls should be designed around those definitions. Your organization, with counsel, remains responsible for deciding who is a U.S. person in your environment.
Registration and licenses
Any person who engages in the United States in the business of manufacturing or exporting or temporarily importing defense articles, or furnishing defense services, is generally required to register with DDTC under 22 CFR Part 122, subject to the exemptions in that part. Licenses and other approvals for exports, temporary imports, agreements, and technical data are addressed in Parts 123, 124, and 125. NorthStar does not file DDTC registrations, license applications, technical assistance agreements, or manufacturing license agreements.
Violations and penalties
Conduct that violates the Arms Export Control Act or the ITAR, and the sanctions that may be imposed, are addressed in 22 CFR Part 127. Criminal penalties for willful violations are prescribed by 22 U.S.C. 2778(c), as described in 22 CFR 127.3. Civil penalties may also be imposed under 22 CFR 127.10 and are periodically adjusted for inflation. This page does not quote a dollar amount, because those maxima change. If this summary and the regulation differ, the regulation controls.
How NorthStar helps
We help you implement and document IT controls that support an ITAR program. We do not certify ITAR compliance, file licenses or registrations with DDTC, or determine whether your data is controlled.
Access control and need-to-know
Identity, authentication, and access design that limits technical data to the people your organization has authorized, including access by U.S. persons as your organization and its counsel define that population.
Encryption and logging
Encryption and audit logging for systems that store or transmit technical data. Some encrypted transmissions and storage of unclassified technical data are excluded from the definition of an export when the conditions in 22 CFR 120.54 are met, including end-to-end encryption, FIPS 140-2 or comparable strength, no intentional storage in a country listed in 22 CFR 126.1, decryption means that are not provided to a third party, and an authorized intended recipient. Those conditions are specific. Encryption is not a blanket exception, and your organization, with counsel, has to determine whether 22 CFR 120.54 applies to a given system or transfer.
GCC High evaluation and migration
Help evaluating whether Microsoft 365 GCC High is an appropriate environment for export-controlled data, and planned migration when it is. GCC High is one environment companies use for that data. Moving there does not, by itself, satisfy ITAR.
Monitoring and incident support
Monitoring and incident support when technical data may be involved, so you have a record of access and a clear path for response.
Documentation of IT controls
Help documenting the technical and administrative IT controls your compliance program depends on, so you have evidence of how access, encryption, and logging are actually implemented.
Related services
ITAR work sits alongside defense-contractor, cloud, and security support already on this site.
Primary sources
Read the controlling text and official agency guidance. The eCFR is a regularly updated unofficial compilation, which is also how DDTC describes it. If this page and a source differ, the source controls.
Frequently Asked Questions
This page is general information about the International Traffic in Arms Regulations, 22 CFR parts 120 through 130. It is not legal or export-control advice, does not create an attorney-client relationship, and is not a substitute for counsel or for reading the regulations. Your organization remains responsible for its own compliance determinations, including USML coverage, registration, and licensing. NorthStar helps you design, implement, and operate IT controls and documentation. NorthStar is not a regulator or a certifying body, does not file registrations or licenses with the Directorate of Defense Trade Controls, and does not guarantee any licensing, enforcement, or audit outcome.
About the author
Ken Satkunam, CISM
President & Founder, NorthStar Technology Group
Ken has spent over 25 years in IT leadership, serving in roles from technical support to CIO for organizations as large as 23,000 employees. He founded NorthStar Technology Group in 2000 to help regulated organizations build secure, compliant, and operationally resilient technology environments. Ken holds the Certified Information Security Manager (CISM) credential from ISACA and is the co-author of the Amazon best-seller "Cyber Attack Prevention." He has been quoted in industry publications including eWeek and DM News, and NorthStar has been recognized on the Inc. 5000 list in both 2024 and 2025.
Talk through IT controls for ITAR-controlled technical data
We can review how technical data is stored, who can access it, and whether a government cloud environment belongs in the plan. Your organization remains responsible for its own ITAR compliance determinations.