ITAR (International Traffic in Arms Regulations) is the US State Department regulation controlling the export of defense articles and defense services listed on the US Munitions List (USML). Applies to any company that manufactures, brokers, or exports these items — or handles technical data related to them.

What are the penalties for ITAR violations?

Civil penalties up to $1.2M per violation. Criminal penalties up to $1M + 20 years imprisonment per violation. Debarment from federal contracting for years. Reputational damage — DDTC publishes settlement agreements. Historic penalties have included $50M+ fines against large defense manufacturers.

How much does ITAR readiness cost?

ITAR Awareness + Basic Compliance Setup: $8-18k. Full ITAR Compliance Program (technical data segregation, US persons rule enforcement, training program, screening procedures): $30-90k. Managed retainer for ongoing compliance: $2-7k/month. DDTC registration fees paid direct to State Dept.

Do IT and cloud providers need to worry about ITAR?

Yes. If your IT/cloud infrastructure hosts, transmits, or provides access to ITAR technical data, you must implement US persons controls. This is why aerospace/defense manufacturers increasingly require GCC High (Microsoft's US-only cloud) — commercial M365/G Suite doesn't meet ITAR technical data controls.

PROTECT · Compliance · ITAR + EAR Export Control

Export control violations are criminal. One non-US person on the wrong drawing is a felony.

Q: ITAR vs EAR — what's the difference?

ITAR (State Dept) covers military/defense articles on the USML. EAR (Commerce Dept) covers dual-use items on the Commerce Control List (CCL). Some items are ITAR, some EAR-controlled at various levels (EAR99 through highest controls), some no license required. Determining which regime applies is a legal analysis for each product/technology.

Q: Do I need to register with DDTC?

Yes, if you manufacture, broker, or export ITAR-controlled defense articles or services. Registration with DDTC (Directorate of Defense Trade Controls) is required BEFORE you engage in ITAR-controlled activities. Registration is annual and involves fees. Even manufacturers who never intend to export must register if the items are USML-listed.

Q: What is the US Persons Rule?

Under ITAR, releasing technical data (drawings, specs, source code, know-how) to a non-US person is an 'export' — even if the release happens on US soil. Common failure modes: non-US person on your engineering team accessing ITAR drawings, cloud storage accessible from abroad, foreign national contractor with system access.

Media Express prepares Chicago-area aerospace and defense manufacturers for ITAR + EAR export control. DDTC registration coordination, technical data segregation, US persons rule enforcement, training programs, and website compliance. Get right before an inspection.

⚜ Free ITAR Readiness Score → See Our Process

↓

⚜ Plain English · Quotable

ITAR (International Traffic in Arms Regulations) is the US State Department regulation controlling defense articles and services on the US Munitions List. Any company manufacturing, brokering, or exporting these items — or handling their technical data — must register with DDTC and follow strict controls. EAR (Export Administration Regulations, Commerce Department) covers dual-use items on the Commerce Control List. Media Express prepares Chicago-area aerospace and defense manufacturers for both regimes: registration, tech data segregation, US persons rule enforcement, and website compliance.

🛡️ Who This Applies To

If you handle defense articles or technical data — you're in scope.

ITAR is not just about physical exports. Handling technical data on defense articles — drawings, specs, engineering data, even source code — on US soil is an export the moment a non-US person can access it.

Aerospace manufacturers — components for defense aviation (F-35, F-16, C-130, Blackhawk, Apache, missiles, satellites)
Defense manufacturers — ground vehicles, weapons systems, radar, communications, protective equipment
Precision machine shops — components for any of the above (CNC parts, castings, forgings, assemblies)
Engineering firms & testing labs handling ITAR-controlled technical data
Universities & research labs conducting defense-related research
IT service providers & cloud vendors hosting defense technical data
Law firms & consultants handling ITAR client matters

🛡️ Two Regimes

ITAR or EAR? Different agencies. Different rules.

The first determination in every export control analysis: which regime applies. Same product can shift between regimes as regulations evolve.

Regime 1

ITAR

Directorate of Defense Trade Controls (DDTC) · State Dept

Governs items on the US Munitions List (USML)
Defense articles + defense services + related technical data
Registration with DDTC required before any activity
Annual registration fees + renewal
US Persons Rule: strictest — release to non-US person on US soil = export
Licenses required for most exports (few exceptions)
Higher penalties + criminal exposure

Regime 2

EAR

Bureau of Industry and Security (BIS) · Commerce Dept

Governs items on the Commerce Control List (CCL)
Dual-use items (commercial + potential military application)
No registration requirement
Classification: ECCN determines license needs
EAR99 items: many exports possible without license
Deemed exports rule applies (similar to ITAR US Persons)
Lower penalties than ITAR but still significant

⚠️ If You Violate

Penalties can be catastrophic.

ITAR/EAR violations are one of the few compliance areas where individual employees face criminal charges. Historic settlements against large defense manufacturers have exceeded $50 million.

⚠️ Real Consequences

ITAR violations carry the most severe penalty structure in US export/compliance law.

Civil penalties: up to $1.2M per violation (ITAR), $364k+ per violation (EAR)
Criminal penalties: up to $1M and 20 years imprisonment per violation (ITAR)
Debarment from federal contracting (multi-year exclusion)
Public settlement agreements (DDTC publishes consent decrees)
Loss of primes and OEM contracts — primes drop violators immediately
Insurance coverage exclusions for willful violations
Personal criminal liability for engineers, managers, executives
Voluntary self-disclosure typically leads to lighter penalties — NOT disclosing is often worse

⚜ How We Help

The 5-step ITAR readiness path.

Structured, phased approach with fixed pricing at each phase. Coordinates DDTC registration and referral to specialized ITAR legal counsel where warranted.

Free Readiness Assessment (15 min)

15-question quiz identifies ITAR/EAR exposure, DDTC registration status, US persons rule risks, and top-priority gaps.

Scope + Gap Analysis (2-3 weeks)

Maps current state against ITAR + EAR requirements, technical data flows, workforce US persons status. Determines DDTC registration needs. Roadmap with phased pricing.

Documentation + Technical Data Segregation (8-12 weeks)

Technology Control Plan (TCP). Access-controlled document repositories (US persons only). Screening procedures. Employee ITAR training program. Vendor NDAs with US persons certification. Website removal of ITAR-controlled details.

Technical Remediation (parallel)

GCC High migration coordination (via partner). Physical access controls to ITAR areas. Network segmentation. Cloud vendor US persons certification. Foreign national contractor policies.

Ongoing Program (Retainer)

Annual TCP refresh. Ongoing employee training. USML/CCL classification support for new products. Voluntary self-disclosure guidance if issues found. DDTC registration renewals.

💰 What It Costs

Fixed pricing at every phase.

ITAR readiness is more expensive than most compliance regimes because penalties are much higher — and remediation involves specialized legal counsel and technical infrastructure.

Foundation

ITAR Awareness

$8,000 – $18,000

One-time, 4-6 weeks

ITAR/EAR exposure assessment
DDTC registration coordination
Basic Technology Control Plan (TCP)
US persons rule policies
Employee awareness training kit
Website review + ITAR-sensitive content removal

Most Manufacturers

Full Compliance

ITAR Compliance Program

$30,000 – $90,000

Phased over 4-8 months

Everything in Foundation
Full Technology Control Plan (TCP)
Technical data segregation architecture
GCC High migration coordination (via partner)
Physical access controls to ITAR areas
Employee screening procedures
Full training program (year 1)
Vendor management with US persons certification
Referral to specialized ITAR legal counsel

Ongoing Retainer

Managed ITAR

$2,000 – $7,000/mo

Recurring, month-to-month

Annual TCP refresh
Ongoing training
USML/CCL classification for new products
DDTC registration renewals
Website + compliance monitoring
Voluntary self-disclosure guidance
Compliance-ready hosting included

Above are typical Illinois market rates. Media Express pricing is more accessible — we build once and reuse across clients, so you don't pay for someone else's discovery work. Contact us for a personalized quote based on your exact situation.

⚜ Free Consultation →

❓ Common Questions

FAQ.

ITAR vs EAR — what's the difference?

ITAR (State Dept) governs USML items — military/defense specific. EAR (Commerce Dept) governs CCL items — dual-use commercial + potential military. ITAR has stricter penalties and registration requirements.

Do I need to register with DDTC?

Yes if you manufacture, broker, or export ITAR-controlled items or services. Registration is required BEFORE any activity, annual, with fees. Applies even if you never intend to export.

What is the US Persons Rule?

Releasing technical data to a non-US person is an "export" — even if it happens on US soil. Common failures: non-US person on engineering team, cloud storage accessible abroad, foreign national contractor.

What are the penalties?

Civil: up to $1.2M per violation. Criminal: up to $1M + 20 years imprisonment per violation. Debarment from federal contracting. Public settlements. Personal criminal liability for individuals.

How much does readiness cost?

Foundation: $8-18k. Full Compliance Program: $30-90k. Managed retainer: $2-7k/mo. DDTC registration fees paid direct to State Dept.

Do IT/cloud providers need to worry?

Yes. If your infrastructure hosts, transmits, or provides access to ITAR technical data, you must implement US persons controls. Why aerospace/defense increasingly require GCC High — commercial M365/G Suite doesn't meet ITAR technical data controls.

What if I discover a past violation?

Voluntary self-disclosure to DDTC typically leads to significantly lighter penalties. NOT disclosing (and being caught later) is much worse. Consult specialized ITAR legal counsel immediately — Media Express coordinates referrals.

📚 Related Terms

Also worth understanding.

Ready to see where you stand?

Take the free 15-question Compliance Readiness Assessment. Instant PDF report with your ITAR/EAR exposure, DDTC registration status, and top-priority actions.

⚜ Take Free Assessment → 📞 773-800-1520

Media Express LLC · Chicago IL · Est. 1995 · Independent · 31+ years

Media Express LLC prepares aerospace and defense businesses for ITAR + EAR export control compliance. Media Express is not a law firm and does not provide legal advice on export control matters. For legal analysis, disclosures, and license applications, Media Express coordinates referrals to specialized ITAR/EAR legal counsel.