If your supply chain touches defense hardware, you have probably heard the term ITAR. But for engineers and procurement managers who are not compliance specialists, the specifics can be murky. What exactly does ITAR registration require? Who needs it? And what is the real risk of working with a machine shop that does not have it?
This article breaks down ITAR registration in plain language, explains how it applies to precision machining for defense programs, and outlines what procurement teams should be asking when they qualify a new machining partner for defense and aerospace work.
| Need an ITAR-registered, AS9100D-certified machining partner for your defense program? Request a quote from Whalley Precision. |
What is ITAR?
ITAR stands for the International Traffic in Arms Regulations. It is a set of U.S. federal regulations administered by the State Department’s Directorate of Defense Trade Controls (DDTC) that governs the export, import, and transfer of defense-related articles, services, and technical data.
The regulations are based on the Arms Export Control Act (AECA) and exist to ensure that U.S. defense technology does not end up in the hands of adversaries or unauthorized foreign nationals. ITAR covers a wide range of items, from complete weapon systems down to individual components and the technical drawings used to manufacture them.
For machine shops, the critical point is this: if you manufacture, refurbish, or handle parts that fall under the U.S. Munitions List (USML), or if you work with technical data related to those parts, ITAR applies to your operation regardless of whether you are exporting anything.
Who Needs to Be ITAR Registered?
Any U.S. company that manufactures, exports, imports, or brokers defense articles or services that fall under the USML is required to register with the DDTC. This includes machine shops that produce components for defense primes, subcontractors, and government programs.
Registration is not optional for companies in this space. It is a legal requirement. The DDTC maintains a registry, and registration must be renewed annually. Failure to register or comply with ITAR requirements can result in significant civil and criminal penalties, including fines of up to $1 million per violation and debarment from future defense contracts.
Common scenarios where a machine shop must be ITAR registered:
- Manufacturing components that appear on the USML, even as a subcontractor several tiers removed from the prime.
- Receiving technical drawings or specifications that contain controlled technical data, such as CAD files or manufacturing specs for defense hardware.
- Employing foreign nationals who would have access to controlled hardware or data, which constitutes a “deemed export” under ITAR rules.
- Storing or transmitting controlled technical data electronically, including via email or shared drives.
What the U.S. Munitions List Covers
The USML is organized into 21 categories covering a broad range of defense articles. Several of these categories are directly relevant to precision machining:
- Category I: Firearms and related articles
- Category IV: Launch vehicles, guided missiles, ballistic missiles, rockets, torpedoes, bombs, and mines
- Category VIII: Aircraft and related articles, including airframes and propulsion components
- Category X: Personal protective equipment and military training equipment
- Category XI: Military electronics
- Category XV: Spacecraft systems and related articles
Machined components that are specifically designed or modified for any of these categories fall under ITAR jurisdiction. This includes housings, brackets, structural members, actuator components, munitions parts, and many other precision machined items that appear in defense system assemblies.
ITAR vs. EAR: What is the Difference?
A common source of confusion for engineers and procurement managers is the distinction between ITAR and the Export Administration Regulations (EAR), which are administered by the Commerce Department’s Bureau of Industry and Security (BIS).
ITAR covers items on the USML that are specifically designed for military or defense use. State Department jurisdiction. Most stringent controls.
EAR covers dual-use items on the Commerce Control List (CCL) that have both commercial and military applications. Commerce Department jurisdiction. Generally less restrictive than ITAR, but still requires licensing for certain exports.
The practical difference for a machine shop: if you are producing a component that was specifically designed for a military platform, ITAR almost certainly applies. If you are producing a commercial component that could theoretically be used in a military application but was not designed for one, EAR may apply instead. In ambiguous cases, the State Department’s commodity jurisdiction (CJ) process can determine which set of regulations governs a specific item.
When in doubt, the safer assumption is ITAR. The consequences of misclassifying a controlled item under EAR when it should be under ITAR are severe.
What ITAR Registration Means for a Machine Shop
ITAR registration is not simply a certificate that a shop hangs on the wall. It imposes a set of ongoing compliance obligations that affect daily operations:
- Access controls. Controlled technical data and hardware must be protected from unauthorized access, including access by foreign nationals. Shops must implement physical and digital security measures to prevent unauthorized disclosure.
- Employee screening. Shops must verify the citizenship and work authorization status of employees who will have access to ITAR-controlled items or data. Access by foreign nationals to controlled items or data without a license constitutes a deemed export violation.
- Recordkeeping. ITAR requires detailed records of transactions involving controlled items and data, including what was produced, for whom, and when. These records must be retained for a minimum of five years.
- Technical data controls. Drawings, specifications, CAD files, and other technical data related to USML items must be handled, stored, and transmitted in ways that prevent unauthorized access. This includes email systems, cloud storage, and file sharing platforms.
- Subcontractor flow-down. If a shop uses subcontractors for any work on ITAR-controlled programs, those subcontractors must also be ITAR registered and compliant. Compliance cannot be delegated away.
Meeting these requirements takes real investment in processes, systems, and training. It is one of the reasons that not every machine shop pursues ITAR registration, and why ITAR registration is a meaningful signal when qualifying a defense machining partner.
| View Whalley Precision’s full compliance credentials, including ITAR registration, CMMC Level 2 Self-Assessment, AS9100D, and FAA, EASA, and UKCAA repair station certification: whalleyprecision.com/certifications |
Why ITAR Compliance Matters When Qualifying a Supplier
For procurement managers and supply chain teams at defense primes and subcontractors, supplier ITAR compliance is not a nice-to-have. It is a qualification requirement. Working with a non-registered shop on a USML-covered program exposes your organization to liability and audit risk, regardless of whether the non-compliance originated with your supplier rather than your own operation.
The key risks of working with a non-ITAR-registered machining partner:
- Violation liability. If a non-registered shop manufactures ITAR-controlled parts on your behalf, your organization may share liability for the violation even if you were unaware of the compliance gap.
- Technical data exposure. Sharing controlled drawings or specifications with a non-registered shop constitutes an unauthorized disclosure of ITAR-controlled technical data, which is itself a violation.
- Program disruption. Discovery of a non-compliant supplier mid-program can require re-sourcing, retesting, and reporting to the government customer, causing significant delays and cost overruns.
- Audit exposure. Defense auditors and DCAA reviewers increasingly scrutinize supplier qualification records. A non-compliant supplier in your supply chain is a finding waiting to happen.
Qualifying ITAR-registered suppliers at the start of a program is far less expensive than dealing with the consequences of a compliance gap after work has begun.
Whalley Precision and ITAR
Whalley Precision is ITAR registered and operates in full compliance with DDTC requirements. Our certifications also include AS9100D and ISO 9001:2015 quality management system registration, FAA repair station certification with EASA (European Union Aviation Safety Agency) and UKCAA (UK Civil Aviation Authority) bilateral recognition, and CMMC Level 2 Self-Assessment for cybersecurity.
CMMC Level 2 compliance is increasingly relevant for defense suppliers. The Cybersecurity Maturity Model Certification program requires defense contractors to implement specific cybersecurity practices that protect Controlled Unclassified Information (CUI). Whalley Precision has completed a CMMC Level 2 Self-Assessment, meaning the 110 security practices required by NIST SP 800-171 have been implemented and documented internally. This is distinct from a C3PAO (third-party assessed) certification, which involves an independent assessor audit. As DoD contract requirements evolve, Whalley continues to monitor CMMC rulemaking and is positioned to meet escalating requirements.
Together, these credentials reflect a compliance posture built for defense supply chain requirements at every tier. Our capabilities span 3, 4, and 5-axis CNC milling, turning, and mill-turn operations, with experience machining the exotic alloys, tight tolerances, and complex geometries that defense programs demand.
Frequently Asked Questions
What is ITAR registration?
ITAR registration is the process by which U.S. companies that manufacture, export, or broker defense articles and services listed on the U.S. Munitions List register with the State Department’s Directorate of Defense Trade Controls. Registration is required by law and must be renewed annually. It is distinct from obtaining export licenses, which are required for specific transactions involving controlled items.
Does ITAR apply to machine shops?
Yes, if the shop produces components that fall under the USML or handles technical data related to USML items. This includes shops that serve as second or third-tier subcontractors to defense primes. The registration requirement applies to manufacturers of defense articles regardless of whether they are directly exporting anything.
What happens if a supplier is not ITAR registered?
Working with a non-registered supplier on a USML-covered program creates compliance exposure for your organization. Sharing controlled technical data with a non-registered company is itself a violation. Depending on the circumstances, civil penalties can reach $1 million per violation and criminal penalties can include imprisonment. Non-compliant suppliers also create audit findings and can disrupt program timelines if discovered mid-execution.
What is the difference between ITAR and CMMC?
ITAR governs the physical manufacture, export, and transfer of defense articles and services on the U.S. Munitions List. CMMC (Cybersecurity Maturity Model Certification) governs the cybersecurity practices used to protect Controlled Unclassified Information (CUI) in the defense industrial base. The two are complementary rather than overlapping. A defense machine shop typically needs both: ITAR registration to legally manufacture and handle controlled hardware and data, and CMMC compliance to meet DoD cybersecurity requirements for handling CUI in digital form. CMMC Level 2 can be met through self-assessment for many programs, while certain contracts will require third-party C3PAO assessment.
Defense Machining Starts with the Right Compliance Foundation
ITAR registration is the baseline requirement for any machine shop operating in the defense supply chain. It signals that a shop has made the investment in the access controls, recordkeeping, personnel screening, and technical data management that defense programs require. Combined with AS9100D quality management certification and CMMC Level 2 Self-Assessment, it forms the foundation that defense primes and subcontractors rely on when qualifying precision machining partners.
Whalley Precision brings all of these credentials together with decades of experience machining complex, tight-tolerance components from demanding materials for aerospace, defense, and other regulated industries.
| Contact Whalley Precision today to discuss your defense machining program, or submit a request for quote and our team will follow up promptly. |