Protect Defense Data and Prepare for CMMC Level 2
ITAR compliance is more than a registration form or an export license. It is an ongoing system for identifying controlled defense articles, technical data, and defense services; limiting access to authorized people; screening parties and destinations; maintaining records; and obtaining the right authorization before a controlled transfer occurs.
For many small and midsize companies in the Defense Industrial Base, ITAR obligations also overlap with cybersecurity requirements. If your organization receives Controlled Unclassified Information (CUI), a CMMC assessment may evaluate whether your systems protect that information in accordance with the CMMC requirements specified in your DoD solicitation or contract. ITAR and CMMC are separate frameworks, but both can affect how you manage people, technology, vendors, data, and evidence.
CMMC IT Support is a San Diego-based consultancy that helps Department of Defense contractors and subcontractors plan, implement, and maintain CMMC Level 2 compliance. If you need a practical roadmap for protecting sensitive defense information, request a quote or schedule a free compliance call, call 858-483-8770, or email info@cmmcitsupport.us.
What Is ITAR Compliance?
The International Traffic in Arms Regulations, found in 22 CFR Parts 120–130, implement U.S. controls over defense articles and defense services. The U.S. Munitions List (USML) in Part 121 identifies categories of defense articles and related technical data. The Directorate of Defense Trade Controls (DDTC), within the U.S. Department of State, administers these controls.
In practical terms, ITAR compliance means understanding what your organization handles, who may access it, where it may go, and what approval is required before a transfer. An export can involve more than shipping hardware across a border. Depending on the facts, releasing controlled technical data to a foreign person—including through visual, oral, or electronic access—may create an export-control issue.
Important: DDTC registration is not an export license and does not certify that a company is “ITAR certified.” Registration is one obligation for covered parties; authorizations, recordkeeping, screening, training, and transaction-specific controls may also apply.
Who Needs to Consider ITAR Requirements?
A company should evaluate ITAR whenever its work involves an article, service, or technical data that may be on the USML. Common examples include:
Manufacturers of defense articles, even when their current work is performed domestically.
Exporters or temporary importers of USML-controlled hardware or technical data.
Organizations furnishing defense services, including certain assistance or training to foreign persons.
Brokers arranging or facilitating covered defense transactions.
Subcontractors, machine shops, engineering firms, managed service providers, and cloud or collaboration vendors that may receive controlled technical data.
Universities and research organizations participating in defense-related programs where exclusions do not apply.
ITAR applicability is fact-specific. A DoD contract does not automatically make every piece of information ITAR-controlled, and CUI is not automatically ITAR technical data. Classification should be based on the USML, the Export Administration Regulations where relevant, contract markings and data clauses, and any authoritative jurisdiction or classification determination.
Core ITAR Compliance Requirements
- Determine Jurisdiction and Classification
Start by identifying your products, software, technical data, services, and activities. Map each item or activity to the applicable USML category or Export Control Classification Number when appropriate. If jurisdiction remains uncertain after a careful review, a Commodity Jurisdiction request may be appropriate. Accurate classification drives every control that follows.
- Register With DDTC When Required
Under ITAR Part 122, persons engaged in the United States in the business of manufacturing, exporting, or temporarily importing defense articles, or furnishing defense services, may have a registration obligation. Brokers have separate requirements under Part 129. Registration generally must be kept current, and material changes may trigger notification duties. Because registration does not itself authorize exports, licensing and exemption analyses remain separate.
- Build a Written, Risk-Based Compliance Program
DDTC strongly advises parties engaged in defense trade to establish and maintain a documented compliance program tailored to the business, regularly reviewed, and supported by management. A usable program should assign an empowered owner and address:
Jurisdiction and classification procedures.
Registration, licensing, agreements, provisos, and exemption controls.
Restricted-party, end-user, end-use, and destination screening.
Foreign-person access, visitor controls, remote work, and international travel.
Technology controls for email, file sharing, backups, cloud platforms, endpoints, and administrative access.
Employee onboarding, role-based training, reporting, investigations, corrective action, and voluntary disclosures when appropriate.
Recordkeeping, audits, management reviews, and periodic updates when regulations or business operations change.
- Obtain the Correct Authorization Before a Controlled Activity
Exports, reexports, retransfers, temporary imports, defense services, and brokering activities can require licenses, agreements, or other DDTC approvals unless a valid exemption applies. Exemptions are conditional; eligibility and every procedural requirement must be documented before relying on one. Screen the parties, end use, destination, ownership, and transaction facts before release.
- Protect Technical Data and Maintain Records
Access controls should follow the data. Identify repositories containing controlled technical data, restrict permissions by role and authorization, review privileged access, retain required records, and monitor transfers. Encryption is valuable, but encryption alone does not resolve nationality, authorization, destination, or licensing questions.
How ITAR Compliance and CMMC Level 2 Compliance Work Together
ITAR and CMMC solve different problems. ITAR is an export-control regime. CMMC verifies implementation of cybersecurity requirements for contractor information systems that process, store, or transmit Federal Contract Information (FCI) or CUI. For CMMC Level 2 compliance, the current CMMC program incorporates the 110 security requirements from NIST SP 800-171 Revision 2. Depending on the solicitation or contract, Level 2 may require a self-assessment or a certification assessment by an authorized C3PAO.
The overlap is operational. A well-designed environment can help an organization:
Limit controlled information to an accurately defined assessment and authorization boundary.
Enforce multifactor authentication, least privilege, configuration management, audit logging, incident response, and media protection.
Identify foreign-person access and control remote administration, support, and vendor access.
Produce reliable evidence for a CMMC assessment while supporting export-control procedures.
Flow appropriate security and information-handling requirements to subcontractors and external service providers.
Do not assume that passing a CMMC assessment proves ITAR compliance, or that an ITAR program satisfies CMMC. The strongest approach maps both sets of obligations to the same assets, data flows, people, vendors, policies, and evidence while preserving the legal distinctions.
What to Expect From a CMMC Assessment
A CMMC assessment examines whether required practices are implemented within the defined CMMC assessment scope. For Level 2, evidence may include your System Security Plan (SSP), network and data-flow diagrams, policies, configurations, tickets, logs, screenshots, interviews, and demonstrations. Assessors evaluate objective evidence—not merely written policies.
Preparation typically includes:
Confirming whether the contract requires Level 2 self-assessment or Level 2 C3PAO certification.
Defining the CUI boundary and correctly categorizing in-scope, security-protection, contractor risk-managed, specialized, and out-of-scope assets.
Completing a gap assessment against all applicable Level 2 requirements and assessment objectives.
Remediating technical and procedural gaps and collecting repeatable evidence.
Validating the SSP, policies, plans of action, affirmations, and Supplier Performance Risk System information.
Running a mock assessment before the formal review.
The CMMC acquisition rule became effective November 10, 2025. Under the phased rollout, solicitations increasingly include required CMMC status, and contracting officers verify current status in SPRS before award when the requirement applies. Final Level 2 status is generally current for three years, but annual affirmation of continuous compliance is required. Conditional Level 2 status is limited to 180 days and is available only when regulatory POA&M conditions are met.
How ITAR Consulting Helps Small and Midsize Defense Contractors
Effective ITAR consulting turns a dense regulatory obligation into a workable operating model. Experienced ITAR consultants can help leadership identify risk, coordinate export-control and cybersecurity responsibilities, and create controls employees can follow without stopping legitimate business.
A practical engagement may include:
An ITAR applicability and risk review coordinated with qualified export-control counsel when legal interpretation is required.
Data-flow discovery and identification of systems, users, vendors, and locations that touch technical data.
Policy and procedure development, training, access-control design, and secure collaboration architecture.
A combined ITAR/CMMC gap analysis that avoids duplicate work and conflicting boundaries.
Remediation planning, evidence development, readiness reviews, and ongoing compliance support.
CMMC IT Support focuses on the cybersecurity and operational controls that help DoD contractors protect sensitive information and prepare for CMMC. We can collaborate with your export-control attorney or empowered official so technical safeguards align with the organization’s legal determinations.
Why Choose CMMC IT Support?
Generic templates rarely survive contact with a real network, real production demands, and a formal assessment. CMMC IT Support gives defense contractors a clear, evidence-driven path from uncertainty to readiness. Our team can help you:
Define an efficient CUI and controlled-data environment.
Translate compliance requirements into technical projects and accountable owners.
Develop and organize assessment-ready policies, procedures, diagrams, and evidence.
Prepare for a CMMC Level 2 self-assessment or C3PAO assessment.
Maintain controls after the assessment through monitoring, change management, and periodic review.
Ready to reduce risk and protect your eligibility for DoD work? Request a quote or schedule your free compliance call today. You can also call 858-483-8770 or email info@cmmcitsupport.us.
Frequently Asked Questions
Is there an official ITAR certification?
No government-issued “ITAR certification” generally proves organization-wide compliance. Covered organizations may need DDTC registration and transaction-specific licenses, agreements, or other approvals, but registration is not certification and does not authorize exports.
Does every DoD contractor need ITAR compliance?
No. ITAR applicability depends on whether the organization handles USML-controlled defense articles, technical data, defense services, or covered brokering activities. Review contract information, classifications, activities, parties, and data flows rather than relying only on customer type.
Does ITAR compliance require CMMC Level 2 compliance?
Not automatically. ITAR and CMMC are separate. CMMC Level 2 is typically relevant when a covered DoD contract requires the organization to process, store, or transmit CUI and specifies Level 2 status. A company may need one framework, the other, or both.
Can cloud services store ITAR-controlled technical data?
Potentially, but the organization must evaluate authorization, access by foreign persons, locations, subcontractors, encryption, account administration, incident response, and other regulatory and contractual requirements. A marketing claim that a platform is “ITAR compliant” does not transfer responsibility from the exporter or registrant.
How long does CMMC Level 2 preparation take?
Timing depends on scope, current NIST SP 800-171 implementation, documentation quality, architecture, vendors, and remediation complexity. Starting with a scoped gap assessment produces the most reliable schedule and budget.
Can CMMC IT Support perform the certification assessment?
CMMC IT Support helps organizations prepare and remediate. When a Level 2 certification assessment is required, it must be conducted by an authorized C3PAO. Keeping readiness consulting distinct from the independent assessment helps preserve objectivity.
Take the Next Step
Compliance is easiest to manage before a solicitation, export, foreign-person access request, or assessment deadline creates urgency. Let CMMC IT Support help you build a practical roadmap for ITAR compliance, cybersecurity, and CMMC Level 2 compliance.
Schedule a free compliance call or request a quote | Call 858-483-8770 | Email info@cmmcitsupport.us