ITAR data handling comes down to three controls: know which of your files are technical data, let only authorized people reach them, and keep every copy, backup and access path under your control. Drawings, inspection plans and measurement records for defense articles often fall inside that scope. This guide shows what counts as controlled data, who may see it, how cloud services fit, and how quality teams can keep inspection records defensible.
TL;DR
- Technical data is information needed to design, produce, test or maintain a defense article. Drawings, instructions and documentation are included.
- Letting a foreign person view or access unencrypted technical data counts as an export, even inside the United States, unless it is authorized.
- For cloud use, confirm where data and backups sit, who can administer the system, and who holds the encryption keys.
- Treat logging, role-based access and revision control as part of the compliance program, not as extras.
- Civil penalties under 22 CFR Part 127 can reach the greater of $1,271,078 or twice the transaction value per violation.
Table of Contents
- What counts as ITAR-controlled technical data
- Who may access ITAR technical data
- Safeguards DDTC expects
- Using cloud services with ITAR data
- Vetting a cloud provider before you upload
- Authorizations and exemptions
- Inspection records under ITAR
- What mishandling can cost
- Put your inspection records in one controlled place
- FAQ
- Sources
What counts as ITAR-controlled technical data
Under 22 CFR 120.33, technical data is information, other than software, that is required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles. The definition names blueprints, drawings, photographs, plans, instructions and documentation.
For a machine shop or quality department, that definition reaches further than most people expect. A ballooned drawing of a USML part is a drawing. An inspection plan that spells out how to measure a controlled component is an instruction. A first article report that reproduces nominal dimensions, tolerances and process notes can carry the same information as the drawing itself.
How to tell whether your data is covered
Start with the U.S. Munitions List (USML). One university export-control office notes that if a commodity contains an ITAR-controlled part or component, the commodity is also controlled, whether or not its purpose is inherently military. That matters for subassemblies built for prime contractors, where the end item may be hidden from you.
When you cannot tell, you have two practical routes:
- Ask your customer or prime contractor in writing how the part and its drawings are classified. Keep the answer with the contract file.
- Submit a commodity jurisdiction request to the Directorate of Defense Trade Controls (DDTC), which the same source describes as the route for items in doubt.
Until you have an answer, handle the file as controlled. Downgrading is easy later. Undoing an unauthorized release is not.
Who may access ITAR technical data
The rule is simple to state and easy to break by accident. Access by a foreign person to unencrypted technical data is an export. 22 CFR Part 120 treats a release of technical data to a foreign person inside the United States as a deemed export to every country where that person holds citizenship or permanent residency.
The same part makes clear that handing over access information, such as a decryption key, can be a violation if the person is not already authorized to receive the underlying data. Encryption does not rescue you if the wrong person holds the key.
Foreign-person employees and visitors
DDTC guidance on licensing foreign persons employed by a U.S. person says a regular employee who is a foreign person needs DDTC authorization, such as a DSP-5 license, before reaching ITAR-controlled defense articles or technical data. Employers are also expected to maintain internal controls that prevent unauthorized access.
In practice that means three questions for every user account on any system that holds controlled files:
- Is this person a U.S. person, or do we hold an authorization covering this data?
- Does their role actually require this program, part family or document set?
- Can we show, from logs, who opened what and when?
The second question is where site-aware role-based access in manufacturing earns its keep. Scoping roles to a plant, area, line or cell keeps a floor inspector on one program from browsing another.
Safeguards DDTC expects
DDTC compliance guidance recommends that organizations set security policies for file sharing, travel with mobile devices and encryption, keep IT logs that restrict access to authorized personnel, and use training and intrusion detection. It also warns that cyber theft can be treated as an unauthorized export, so a breach is a compliance event as well as a security one.
The same guidance covers electronic records. Systems should reproduce records on paper legibly and store them so that changes, the person who made them and the time are recorded. That is an audit trail requirement, and it lines up with what quality teams already build for AS9100 and AS9102 work.
A working safeguard set for a quality department looks like this:
| Control | What it means on the shop floor |
|---|---|
| Access by role | Inspectors see only the programs they work on |
| Citizenship verification | HR or the export compliance officer confirms status before access is granted |
| Encryption in storage and transit | Drawings, CMM exports and reports are never emailed in the clear |
| Audit logging | Every view, download, edit and share is recorded with user and time |
| Revision control | Only the released revision is available, and superseded files are locked |
| Device policy | Controlled files are not synced to personal phones or home computers |
| Training | Inspectors and planners know what a deemed export is |
Revision discipline is part of this. A superseded drawing sitting in an inbox is an uncontrolled copy of technical data. Our practical plan for revision control in manufacturing walks through how to keep one released version in circulation.
Using cloud services with ITAR data
Cloud use is allowed, but only when the arrangement keeps the data out of foreign hands. Georgia Tech's Office of General Counsel explains that a provider's receipt of effectively encrypted technical data is not an export when the U.S. owner uploads it, it sits on U.S.-based servers, only U.S. persons administer it, and the owner controls access. It also cautions that not every cloud service is ITAR compliant.
What the large infrastructure providers publish
The major infrastructure providers each describe a U.S.-only environment for controlled data, and each puts the compliance program on the customer.
- AWS says customers should use AWS GovCloud (US), which is physically in the United States and limits AWS personnel access to U.S. citizens. It points to S3 server-side encryption, key management through KMS or CloudHSM, CloudTrail logging and identity controls limited by individual, time and location. Customers remain responsible for their own applications and compliance program.
- Microsoft states that Azure Government runs in dedicated U.S. regions operated by screened U.S. persons, and says customers remain responsible for their own export-control compliance.
- Google Cloud's documentation for ITAR Assured Workloads requires an ITAR folder, eligible services only, regional endpoints, and no technical data in error messages, metadata, resource identifiers or labels.
The last point deserves attention from QA teams. Filenames and part labels are metadata. If your naming convention puts controlled dimensions or program details in a file title, you may have placed technical data where access rules do not reach.
Encryption as a path outside the export definition
DDTC's rule on activities that are not exports says unclassified technical data is not a controlled event when it is secured with end-to-end encryption and is not intentionally sent to, or stored in, a country restricted under section 126.1 or the Russian Federation. The Federal Register notice explains the definitions of release and access information that sit behind this.
AWS describes how it reads these conditions in a February 2025 post on allied data sharing: FIPS 140-2 validated encryption using AES-128 or stronger, no provider access to the decryption keys, and no intentional routing through a proscribed country. This is a narrow pathway with exact technical conditions. Have your export compliance officer or counsel confirm it applies before you rely on it.
Vetting a cloud provider before you upload
The SBIR program's ITAR tutorial gives a plain test: before using cloud services, confirm the provider keeps data and backups only in the U.S. and has no foreign-national employees with access to the controlled technical data. If you are uncertain, do not put ITAR data in that resource. Unless you hold a specific license or exemption, avoid providers that store data or backups abroad or give system access to foreign nationals.
Turn that into a vendor questionnaire:
- Where are production data, backups and disaster-recovery copies stored, by country?
- Who can administer the system or read the database, and are they U.S. persons?
- Does support staff access customer data, and from where?
- Which subprocessors touch the data, and where are they located?
- Who holds the encryption keys, and can the vendor read the data?
- Can the vendor deploy on-premise or in a private U.S. environment if your contract requires it?
- What audit logs can you export, and for how long are they kept?
Get the answers in writing and file them with your export compliance records. A sales deck is not evidence.
Deployment choice is often the deciding factor for defense work. Our comparison of on-premise versus cloud QA software for defense manufacturing lays out when each model fits.
Authorizations and exemptions
Sharing ITAR technical data with a foreign person normally requires a DDTC license or other written approval. Under 22 CFR Part 127, it is unlawful to export or attempt to export a defense article or technical data requiring a license without first obtaining that license or written approval.
Some exemptions exist. One that comes up for engineers is the 125.4(b)(9) exemption, which lets a U.S. person traveling abroad take technical data for their own use provided it is secured against unauthorized release. Exemptions have conditions, and each use should be reviewed and recorded by your empowered official before the trip, not after.
Inspection records under ITAR
Quality documents are where controlled data quietly spreads. A single part can generate a ballooned drawing, a CMM export, a first article report, a nonconformance record, a certificate and a shared PDF. Every one may be technical data.
Some habits keep that spread under control:
- Keep one system of record. Inspection documentation scattered across shared drives, email and personal laptops is hard to restrict. Our guide to inspection documentation best practices covers how to centralize it.
- Link results to the drawing revision. When drawing dimensions are detected and traced to evidence, your report shows exactly which controlled revision was measured.
- Track lots and serials. The chain from material to finished part is easier to defend with batch traceability. Broken traceability is like a broken chain: one missing link and the whole record fails under audit.
- Sign electronically with attribution. Approvals with identity and timestamp support the audit trail DDTC expects. See our compliance guide to electronic signatures in manufacturing.
- Share reports by controlled link, not attachment. Interactive sharing with permissions lets you revoke access. An emailed PDF cannot be recalled.
- Plan retention. Decide how long records stay available and who may see them. Our record retention guide for ISO 13485 shows how to build a schedule; apply the same discipline to ITAR-related files and confirm periods with your compliance officer.
What mishandling can cost
The penalties are large enough to justify the effort. Part 127 provides for a civil penalty of up to the greater of $1,271,078 or twice the value of the transaction per violation of the Arms Export Control Act section 2778, as published in the 2025 regulation text. That amount is adjusted periodically, so check the current eCFR text. Willful violations can bring criminal fines or imprisonment on conviction. Illegal-export attempts can lead to seizure and forfeiture, and administrative debarment generally lasts three years.
For a small machine shop, debarment may matter more than the fine. Losing the ability to work on defense programs ends the business model.
Our perspective on ITAR data in quality systems
We see the same pattern in regulated plants. The shop has a sound export policy on paper, but its inspection data lives in spreadsheets, shared folders and email threads that no policy reaches. Controlled drawings get ballooned in one tool, measured in another and sent to a customer as an attachment. Each hop is a place where access control and logging disappear.
Our view is that the quality system should be the controlled environment. When ballooned drawings, measurement results, out-of-tolerance flags, batch records and report sharing sit in one platform with role-based permissions, you have one place to restrict, log and audit. That is why we offer both cloud and on-premise deployment, so sensitive programs can match the deployment to the contract.
We also tell customers plainly: no software makes you compliant by itself. Your export compliance officer decides who is authorized, which data is controlled and which hosting model your contracts allow. Our job is to give that decision a platform that enforces it and records it. Ask every vendor, us included, for written answers on data location, administrators, subprocessors and key control.
Michael Chen
Put your inspection records in one controlled place
If your team is still moving ballooned drawings and CMM results between folders and inboxes, QA-Report brings ballooning, measurement validation, report generation and role-based access into one platform. The Free plan costs $0 per month, Basic is $49.99 per month and PRO is $149.99 per month. On-Premise and Enterprise Solutions are priced on request. See QA-Report plans and pricing to match a plan to your deployment needs, or review CMM inspection software for automated reports if measurement import is your first step.
Before you load any ITAR-controlled drawing into any tool, confirm the deployment and access model with your export compliance officer.
FAQ
Is a drawing of a defense part always ITAR technical data?
If the drawing is required for the design, production, testing or maintenance of a defense article, it falls within the technical data definition. Your customer's classification and the USML decide the matter. When in doubt, treat it as controlled and request a commodity jurisdiction determination.
Can a non-U.S. employee see ITAR files if they work in our U.S. plant?
Not without authorization. A release to a foreign person inside the United States is a deemed export. DDTC expects a license such as a DSP-5 for foreign-person employees who need access, plus internal controls that block everything else.
Is encrypting the data enough to use any cloud service?
No. Encryption helps, but the conditions matter: who holds the keys, where the data and backups sit, and who administers the system. Georgia Tech's counsel notes that not every cloud service is ITAR compliant. Verify each provider in writing.
Do ITAR rules apply to a quality management platform?
They apply to the data you put in it, not to a category of software. If inspection reports and drawings contain technical data, the platform must support U.S.-person-only access, logging and an acceptable hosting arrangement. Choose a deployment your compliance officer approves.
Sources
- eCFR: 22 CFR 120.33, Technical data
- eCFR: 22 CFR Part 120, Purpose and Definitions
- eCFR: 22 CFR Part 127, Violations and Penalties
- University of Arkansas: ITAR compliance
- DDTC: Licensing of foreign persons employed by a U.S. person
- DDTC: Compliance guidelines
- AWS: ITAR compliance
- Microsoft: Azure export controls white paper
- Google Cloud: ITAR Assured Workloads
- Georgia Tech Office of General Counsel: Export control FAQs
- SBIR: ITAR tutorial
- Federal Register: Definition of activities that are not exports
- Federal Register: Revisions to definition of export
- AWS: Allies can share data and remain compliant