In defense manufacturing, compliance is not optional. It is foundational. Every supplier in the chain must meet strict regulatory requirements that govern how sensitive technical data is handled, how components are produced, and who has access to controlled information. One of the most critical of these regulations is the International Traffic in Arms Regulations—ITAR.
For defense contractors, working with an ITAR-registered machining partner is not just a preference. It is a requirement that directly impacts eligibility, risk exposure, and program continuity.
Yet the distinction between ITAR registered and non-registered suppliers is often misunderstood. Many procurement teams assume that any machine shop with AS9100D certification is automatically qualified to handle defense work. Others use the terms “ITAR registered” and “ITAR certified” interchangeably—not realizing that one of those terms doesn’t actually exist in the eyes of the U.S. government. And perhaps most critically, many underestimate the personal and corporate liability that flows from a single ITAR violation—whether intentional or not.
In this article, we’ll explain what ITAR registration actually means for a CNC machining facility, what defense contractors should demand from their manufacturing partners, and how compliance is maintained across the full manufacturing lifecycle—from quoting through final delivery.
Explore our precision CNC machining services for defense and aerospace applications →
1. What ITAR Actually Is—and Who Must Register
ITAR stands for International Traffic in Arms Regulations. It is a set of U.S. government regulations administered by the Directorate of Defense Trade Controls (DDTC) under the Department of State. Its purpose is to control the export and handling of defense-related articles, services, and technical data, preventing sensitive defense technologies from being accessed by unauthorized individuals or transferred outside of approved channels.
The scope of ITAR extends far beyond finished weapons systems. It applies to components, drawings, specifications, CAD models, manufacturing processes, inspection data, and even the G-code that drives CNC machines—any technical information tied to items on the United States Munitions List (USML).This means a machine shop that never touches a completed defense article may still handle ITAR-controlled technical data every day—and is therefore subject to the full weight of the regulations.
Who Must Register
The Arms Export Control Act requires that any person who engages in the United States in the business of manufacturing, exporting, temporarily importing, or furnishing defense services is required to register with the DDTC.The DDTC registration requirement is triggered by manufacturing defense articles on the U.S. Munitions List—regardless of whether the company ever exports those items. A manufacturer who never exports a single item is still required to register if they produce defense articles.As the DDTC makes explicit in 22 CFR §122.1, engaging in such a business requires only one occasion of manufacturing or exporting or temporarily importing a defense article or furnishing a defense service.
This means that for a CNC machine shop that produces parts for defense applications—even components that are one sub-tier removed from the prime contractor—ITAR registration is not optional. It is a legal obligation.
The Cost of Registration
ITAR registration is an annual requirement. Manufacturers must submit Form DS-2032 through the DDTC’s DECCS portal, along with the applicable registration fee—typically approximately 2,250peryearforanewTier1registration.Therenewalfeeisapproximately2,750. Compliance also requires an investment in secure systems, personnel training, and ongoing audit readiness.For machine shops that are serious about defense work, these costs are part of doing business. For contractors evaluating potential suppliers, verifying that a shop’s DDTC registration is current and valid is a critical step in the supplier qualification process.
2. “ITAR Registered” vs. “ITAR Certified”—Why the Distinction Matters
One of the most persistent misunderstandings in defense manufacturing is the idea that a machine shop can be “ITAR certified.” Technically, there is no such thing as being ITAR Certified—at least not in the eyes of the U.S. Government.
The terms ITAR-registered and ITAR-compliant are not interchangeable. A machine shop becomes ITAR-registered by enrolling with the U.S. Department of State’s DDTC. This legal status grants the authority to manufacture defense articles. Registration alone, however, does not define a shop’s security practices. Compliance requires the active implementation of all security procedures mandated by law—managing a Technology Control Plan, vetting all personnel, and implementing the physical and digital security measures that protect controlled technical data from unauthorized access.
Why does this distinction matter so much? Because it creates a liability chain that defense contractors cannot afford to ignore. A non-registered shop operates illegally when handling ITAR-controlled parts or technical data. A registered-only shop that has not implemented the full compliance framework creates a security liability. Customers must verify that a manufacturing partner meets both standards—registration and active compliance—for total project security.
This is why defense contractors should verify not just that a supplier appears on the DDTC’s registration database, but that they can demonstrate the implementation of their compliance program: documented security procedures, personnel training records, physical access controls, and a verifiable data security architecture. As the DDTC emphasizes, “registration is only the first step in ITAR compliance. Being ITAR registered does not ensure that companies are ITAR compliant.”
Read our full guide on what AS9100D certification means for aerospace parts →
3. Data Security: The Core of ITAR Compliance
For machine shops, ITAR compliance must be embedded into quoting, programming, machining, inspection, and delivery. It cannot be treated as a one-time registration or an afterthought.
The reason is straightforward: in CNC machining, the technical data required to produce defense components is itself ITAR-controlled. This includes CAD models, engineering drawings with tolerances and specifications, material specifications tied to defense applications, G-code and setup instructions that drive the CNC machines, and inspection reports and process documentation.If this data is accessible to unauthorized individuals—including foreign nationals who do not meet the definition of a “U.S. person”—a deemed export has occurred, and an ITAR violation has been committed.
Digital Security: Protecting Controlled Technical Information
ITAR-compliant manufacturers must implement a comprehensive digital security architecture. This includes end-to-end encryption for all ITAR-controlled technical data—both at rest (stored on servers) and in transit (transmitted via email, file sharing, or cloud platforms).Data classified as ITAR-controlled must be accessible only to verified U.S. persons, with access controlled at the file, folder, and system level.
Role-based access controls (RBAC) ensure that employees can only access the specific technical data required for their job function.Network segmentation isolates systems that handle ITAR-controlled data from general business networks, guest Wi-Fi, and production equipment that does not require access to sensitive information—a requirement reinforced by NIST 800-171 Practice 3.13.3.
Multi-factor authentication (MFA) is required for any system that processes, stores, or transmits controlled technical information.Manufacturers handling ITAR-controlled data almost always meet the definition of Controlled Unclassified Information (CUI), which triggers CMMC Level 2 requirements for cybersecurity controls.
Physical Security: Controlling the Shop Floor
Cybersecurity alone is insufficient. ITAR-controlled technical data exists in physical form on every shop floor: printed drawings, setup sheets, inspection travelers, and even coolant-soaked work instructions. Physical security protocols are equally essential.
Printed ITAR technical data and devices containing controlled files must be stored in locked cabinets or secure rooms where access is limited to verified U.S. persons.Documents should be clearly marked with appropriate ITAR-specific labels and export warning statements. Obsolete documents must be destroyed to DoD-compliant standards—not simply discarded in general waste.The shop floor itself must have controlled access: only authorized U.S. persons may enter areas where ITAR-controlled work is being performed or where controlled technical data is present.
At Alternate Finishing, an ITAR-registered metal finishing service provider, “access to ITAR technical data that is stored on AFI’s network is strictly role-based.” Employees must use multi-factor authentication to log in, and access is granted only on a need-to-know basis. Physical copies of controlled documents are logged upon printing, and obsolete documents are shredded with equipment that meets DoD standards.
The CNC-Specific Challenge
CNC machine shops face a particular compliance challenge: legacy machine controllers running end-of-life operating systems that cannot be patched, production networks that cannot simply be air-gapped because they require connectivity for file transfers, and shop-floor workflows where the same computer used to program a defense part may also be used for commercial work.
The solution is not to secure each CNC controller individually—that is often impossible with legacy equipment. Instead, manufacturers secure the network itself: segmenting CUI environments from production networks using VLANs and firewall rules, deploying USB governance that disables generic thumb drives across the enterprise and only allows approved encrypted media with specific serial numbers, and implementing media control logs that track every file transfer.These controls ensure that technical data flowing to and from CNC controllers is protected, even when the controllers themselves cannot be directly secured.
Upload your CAD securely for an ITAR-compliant DFM review →
4. Personnel Management: Who Can Access Your Data
The most fundamental ITAR requirement may also be the most consequential for daily shop-floor operations: access to ITAR-controlled technical data is restricted to U.S. persons only.This seemingly simple requirement cascades through every aspect of a machine shop’s operations—hiring, training, shift assignment, and even visitor management.
What Is a “U.S. Person” Under ITAR?
Under 22 CFR §120.62, a U.S. person is defined as a lawful permanent resident as defined by 8 U.S.C. 1101(a)(20), a protected individual as defined by 8 U.S.C. 1324b(a)(3), or any corporation, business association, partnership, society, trust, or any other entity incorporated to do business in the United States—as well as governmental entities. This definition explicitly excludes any foreign person.
In practical terms, this means that in an ITAR-compliant machine shop, every programmer, machinist, quality inspector, and shipping clerk who handles defense-related parts or data must be a U.S. citizen or lawful permanent resident. Foreign nationals—even those legally present in the United States on work visas—cannot access ITAR-controlled technical data without explicit authorization from the DDTC.
Training and Accountability
Personnel management extends beyond hiring. ITAR compliance requires that every employee with access to controlled technical data receive documented training on the regulations, the specific security procedures applicable to their role, and the consequences of non-compliance.This training must be repeated at defined intervals, and records must be maintained for audit.
For defense contractors evaluating CNC suppliers, a reasonable question to ask is: “Can you show me your ITAR training records for the employees who will handle our parts?” A supplier that cannot produce this documentation is not operating a mature compliance program—regardless of whether they appear in the DDTC registration database.
5. Facility Access and Supply Chain Control
ITAR compliance extends beyond the four walls of the machine shop. DDTC-registered manufacturers must maintain rigorous control over who enters their facility, and they must flow down compliance requirements to every sub-tier supplier who touches ITAR-controlled parts or data.
Physical Facility Access
ITAR-compliant manufacturers must control facility access: only authorized U.S. persons may enter areas where ITAR-controlled work is performed. This means documented visitor logs, escorted access for non-U.S. persons who may have legitimate reasons to be in the facility (equipment technicians, auditors), and physical separation of ITAR and non-ITAR work areas where practical. A defense contractor’s technical representative should be able to walk into an ITAR-compliant shop and verify these controls: Are visitors escorted? Are controlled work areas marked? Are drawings and setup sheets for defense parts secured when not in active use?
Supply Chain Accountability
The ITAR compliance obligation does not stop at the prime contractor’s door. The regulations extend throughout the entire supply chain, affecting companies that may never deliver directly to the Department of Defense.This comprehensive scope means that subcontractors at multiple tiers must maintain equivalent compliance standards.
For defense contractors, this has a direct operational implication: a CNC machining partner that subcontracts work to non-registered shops creates an ITAR violation. The regulations establish a “see something, say something” obligation, requiring companies to monitor their entire supply chain for potential compliance issues.When evaluating a CNC supplier for defense work, the question is not just “Are you ITAR registered?” but “Do your sub-tier suppliers meet the same standards, and can you document it?”
6. ITAR Compliance and Related Frameworks
ITAR registration is not the only requirement that defense contractors should expect from their machining partners. The most capable defense manufacturers maintain a layered compliance framework that addresses quality, cybersecurity, and export control simultaneously.
ITAR and AS9100D: Complementary, Not Redundant
A common misconception is that AS9100D certification covers ITAR requirements. This is incorrect. AS9100D is a quality management standard for the aerospace industry, incorporating ISO 9001:2015 with over 100 additional requirements for configuration management, risk management, and product safety. ITAR is an export control regulation governing who may access defense-related technical data and how it must be protected.
Missile defense contractors require AS9100 Rev D certification as the baseline quality standard, ITAR registration for handling defense articles, and CMMC Level 2 or Level 3 compliance for protecting Controlled Unclassified Information.These three frameworks address fundamentally different risks: AS9100D ensures the parts meet specification; ITAR ensures the parts and their technical data are handled lawfully; and CMMC ensures the digital systems used to produce the parts are secured against cyber threats.
ITAR and CMMC
ITAR-governed technical data is almost always classified as Controlled Unclassified Information (CUI). This means that manufacturers handling ITAR-controlled content must comply with both ITAR personnel restrictions (U.S. persons only) and CMMC Level 2 requirements for handling CUI.
CMMC Level 2 incorporates all 110 NIST SP 800-171 controls.These include access control (limiting system access to authorized users), audit and accountability (creating and protecting system audit records), configuration management (establishing and maintaining baseline configurations), identification and authentication (verifying the identity of users and devices), incident response (establishing an operational incident-handling capability), risk assessment (periodically assessing risk to organizational operations), and system and communications protection (monitoring, controlling, and protecting communications at system boundaries).
The practical implication for defense contractors is that an ITAR-registered CNC supplier who has not implemented these cybersecurity controls may be compliant with export regulations but non-compliant with DoD cybersecurity requirements. The supplier must meet both standards.
ITAR and DFARS
While ITAR focuses on export control and data handling, DFARS adds another layer of requirements for defense contractors. DFARS-compliant machining partners must demonstrate secure handling of CUI, cybersecurity measures aligned with DoD requirements, and full traceability and documentation across production processes.
For defense contractors, working with suppliers who understand both ITAR and DFARS requirements is essential to maintaining compliance across the entire program lifecycle. A supplier that is ITAR registered but cannot demonstrate DFARS-compliant cybersecurity controls may create a compliance gap that exposes both the supplier and the contractor to liability.
Read about our quality certifications and what they mean for your parts →
7. The Consequences of Non-Compliance
The penalties for ITAR violations are severe by design—structured to ensure that non-compliance is never the economically rational choice.
Civil penalties can reach up to 1,271,078perviolation,ortwicethevalueofthetransaction,whicheverisgreater.Criminalpenaltiesincludefinesupto1,000,000 per violation, imprisonment for up to 20 years, or both.In practice, the fines in high-profile cases often exceed these statutory maximums because multiple violations and related statutes compound.
The consequences extend beyond financial penalties. Debarment—prohibition from participating in future government contracts—can effectively terminate a manufacturing business whose revenue depends on defense work. Loss of export privileges can prevent a company from shipping any product internationally, even non-defense products. And reputational damage in the defense community—where trust is the currency of long-term business relationships—can be irreparable.
Real-World Enforcement
ITAR enforcement is not theoretical. A 400,000fineagainstDarlingIndustries—asmallmachineshop—servedasawarningthattheDDTCdoesnotlimitenforcementtolargedefenseprimes.[reference:33]Inamoredramaticcase,3DSystemsCorporationfaceda20 million civil penalty for violations of U.S. export control laws, with half suspended contingent on the company investing $10 million in remedial compliance measures.
Perhaps most sobering for defense contractors evaluating supplier risk: the regulations establish that ignorance of ITAR requirements does not excuse violations. The DDTC expects registered companies to understand and comply with the regulations proactively, not to discover them after a violation has occurred.
8. What This Means for Your Parts: A Checklist for Defense Contractors
When evaluating a CNC machining partner for ITAR-controlled defense work, use this checklist to assess their compliance maturity:
Registration and Legal Status
- Current DDTC registration verified (request registration number and verify independently on the DDTC portal)
- Registration renewed within the required annual cycle
- Organization understands the distinction between registration and compliance
Data Security
- End-to-end encryption for all ITAR-controlled technical data (at rest and in transit)
- Role-based access controls limiting technical data to authorized personnel
- Network segmentation isolating CUI-handling systems from general business and production networks
- Multi-factor authentication on all systems processing controlled technical data
- Secure file transfer protocols for receiving CAD files and transmitting inspection data
Personnel Management
- All personnel with access to ITAR-controlled data verified as U.S. persons
- Documented ITAR training program with records available for audit
- Visitor access controls: escort policies, logs, and restrictions on non-U.S. person access to controlled areas
Physical Security
- Controlled access to manufacturing areas where ITAR work is performed
- Secured storage for printed technical data and controlled documents
- Documented procedures for handling, marking, and destroying controlled materials
Supply Chain Control
- Sub-tier suppliers handling ITAR-controlled parts or data are themselves ITAR registered
- Compliance requirements flowed down to all external providers
- Documented process for evaluating and monitoring supplier compliance
Quality Framework
- AS9100D certification held directly by the manufacturing facility
- Full material and process traceability from raw stock to finished part
- First Article Inspection per AS9102 for new or changed parts
- CMMC Level 2 (or higher) compliance for cybersecurity controls
Get a free DFM review for your defense project with compliance documentation →
How Baosheng Supports Defense Manufacturing Compliance
Baosheng Industry recognizes that our position as a China-based manufacturer and the operational requirements of ITAR create distinct compliance pathways for defense contractors sourcing internationally. Our approach is designed to support your compliance requirements through partnership models that align with U.S. export control regulations.
For defense contractors sourcing ITAR-controlled components, Baosheng’s AS9100D and ISO 9001:2015 certified manufacturing facility provides the documented quality, traceability, and process control that aerospace and defense programs require. We maintain rigorous material traceability from certified mills, complete First Article Inspection documentation per AS9102, and full inspection data packages—all within a quality management system audited annually by accredited certification bodies.
With 582 CNC machines, 20 years of precision machining experience serving aerospace and defense supply chains, and a facility open to customer audits, we provide the documented quality and process control that defense programs demand—while working with our customers to structure compliant procurement frameworks that meet their regulatory obligations.
We welcome direct communication about your specific defense program requirements. Understanding your compliance needs at the RFQ stage ensures that the manufacturing, documentation, and quality framework are aligned with your program requirements from day one.
Upload your CAD for a free DFM review with AS9100D-compliant documentation →
Frequently Asked Questions (FAQ)
Q1: What is the difference between ITAR registered and ITAR certified?
Answer: “ITAR certified” is a misnomer. Unlike ISO 9001 or AS9100D, ITAR does not have published certification requirements, and there are no independent “ITAR certification” bodies that can grant companies ITAR certification.Companies become ITAR registered by enrolling with the U.S. Department of State’s DDTC. ITAR compliance requires active implementation of all mandated security procedures—registration alone does not make a company compliant.
Q2: Who must register under ITAR?
Answer: Any person who engages in the United States in the business of manufacturing, exporting, or temporarily importing defense articles, or furnishing defense services, is required to register with the DDTC. This applies even if the company never exports—manufacturing a single defense article triggers the registration requirement.Defense articles include components, technical data, and services tied to items on the U.S. Munitions List.
Q3: What are the penalties for ITAR violations?
Answer: Civil penalties can reach up to 1,271,078perviolation,ortwicethevalueofthetransaction,whicheverisgreater.Criminalpenaltiesincludefinesupto1,000,000 per violation, imprisonment for up to 20 years, or both.Additional consequences include debarment from future government contracts, loss of export privileges, and irreparable reputational damage in the defense community.
Q4: How does ITAR affect data security in a CNC machine shop?
Answer: ITAR requires that all controlled technical data—including CAD files, engineering drawings, G-code, inspection reports, and setup instructions—be protected from unauthorized access. This requires end-to-end encryption for data at rest and in transit, role-based access controls limiting data to authorized personnel, network segmentation to isolate CUI-handling systems, multi-factor authentication, and secure file transfer protocols.Physical security measures are equally critical: printed technical data must be stored in locked cabinets, and facility access must be restricted to authorized U.S. persons.
Q5: Who qualifies as a “U.S. person” under ITAR?
Answer: Under 22 CFR §120.62, a U.S. person is defined as a U.S. citizen, a lawful permanent resident, a protected individual as defined by 8 U.S.C. 1324b(a)(3), or any corporation, business association, or other entity incorporated to do business in the United States.Foreign nationals—even those lawfully present in the U.S. on work visas—do not qualify as U.S. persons for ITAR purposes and cannot access ITAR-controlled technical data without explicit DDTC authorization.
Q6: Is AS9100D certification sufficient for defense manufacturing work?
Answer: No. AS9100D is a quality management standard for aerospace manufacturing. ITAR is an export control regulation governing access to defense-related technical data. They address fundamentally different requirements. Missile defense contractors typically require AS9100 Rev D certification as the baseline quality standard, ITAR registration for handling defense articles, and CMMC Level 2 or Level 3 compliance for protecting Controlled Unclassified Information.All three are necessary; none alone is sufficient.
Q7: How do I verify that a CNC shop is genuinely ITAR compliant?
Answer: Request the supplier’s DDTC registration number and verify it independently through the DDTC public portal. Beyond registration, ask for evidence of active compliance: documented ITAR training records for personnel, a written Technology Control Plan or ITAR Compliance Program, descriptions of physical and digital access controls, and evidence that sub-tier suppliers are also compliant. A supplier that can provide this documentation—and welcomes an on-site audit—demonstrates mature compliance.
Q8: How does CMMC relate to ITAR compliance for CNC machine shops?
Answer: ITAR-controlled technical data is almost always classified as Controlled Unclassified Information (CUI). This means manufacturers handling ITAR data must comply with both ITAR personnel restrictions (U.S. persons only) and CMMC Level 2 cybersecurity controls (aligned with NIST SP 800-171).CMMC Level 2 incorporates all 110 NIST controls covering access control, audit and accountability, incident response, risk assessment, and system and communications protection. A CNC shop can be ITAR registered but still non-compliant with CMMC requirements—both standards must be met for complete defense manufacturing compliance.
