ITAR
What the International Traffic in Arms Regulations control, who has to register, and the records that prove technical data stayed with the people authorized to see it.
ITAR is the US State Department rule set at 22 CFR parts 120 through 130 that controls defense articles, defense services, and technical data on the United States Munitions List. It governs exports, and it treats releasing technical data to a foreign person inside your own plant as one.
Controls the export of defense articles and technical data on the United States Munitions List, including who may access that data.
US Department of State, Directorate of Defense Trade Controls (DDTC)
Manufacturers, exporters and brokers of defense articles and technical data on the United States Munitions List. 22 CFR Parts 120-130.
Registration with DDTC is required of manufacturers and exporters. There is no ITAR certification for software or for a shop.
Manufacturers, exporters, and brokers of defense articles and related technical data, including subcontractors who never ship anything abroad.
| Requirement | Module | What It Does |
|---|---|---|
| Technical data reaches only authorized people | Engineering | Drawings, specifications, bills of material, and routings sit behind role-based permissions with tenant isolation enforced at the data layer and single sign-on in front of it, so who can open a controlled print is a system setting rather than a folder convention on a network share. That matters because the usual failure is not a shipment; it is a drawing sitting on a drive everyone in the building can browse, with no way to say afterwards who looked at it. Deciding which employees are authorized persons, and screening for foreign-person status, is your call. Once it is made, WorkCell is where it takes effect: the role a person holds decides which controlled prints open for them, and the access list is readable at any time rather than reconstructed after the fact. |
| A record of who touched the data and when | Analytics | Transactions carry an audit trail, so a change to a bill of material, a routing, a revision, or a job is attributable to a user and a timestamp after the fact. ITAR §120.56 counts the use of access information to let a foreign person view unencrypted technical data as a release, which means a credential handed out casually is a compliance event. An audit trail is evidence about your system; it is not an export authorization and it does not substitute for one. |
| One list of who has an account and what it can see | Workforce | Employees exist as records with roles attached, so the population of named users and the permissions each one carries can be read off the system instead of reconstructed from memory when a prime asks. Onboarding and offboarding move the same record. The authorized-person determination behind each role, the technology control plan, and the training that goes with it remain yours to make, document, and defend. |
| The revision the controlled article was actually built to | Engineering | Bills of material and routings are versioned with effective dates, and a change supersedes rather than overwrites, so a job run two years ago still shows the structure and the process it was built against. When a DDTC review or a prime's export audit asks which technical data governed a shipment, the answer is the record on the job rather than an engineer's recollection of which print was current. |
| Where every controlled part went | Inventory | Receiving captures lot and certification, issues to a job preserve the link, and completions assign serials, so a controlled part resolves backward to its material and forward to the shipment that carried it. That genealogy is what answers a retransfer question about a specific unit. It does not classify the part for you: deciding that an item is on the USML, and which category it falls in, is a determination you make. |
| Destination and consignee on the shipment record | Warehouse | Shipments record quantity, lots and serials, the customer, and the ship-to address, which is the commercial half of the file an export review wants to see. The licences, agreements and exemption claims run in your export compliance process and in the government systems built for them, and WorkCell files them against the order and the shipment they authorize so the whole decision reads as one record. |
Under 22 CFR §122.1 anyone in the United States in the business of manufacturing, exporting, or temporarily importing defense articles, or furnishing defense services, registers with DDTC, and a manufacturer who never exports still has to register. Registration is a DS-2032 signed by a US-person senior officer under §122.2, kept current as owners and officers change. §122.1(c) is blunt that registration confers no export rights; it is a precondition to a license, not a substitute for one.
For every export of a defense article, defense service, or technical data, a reviewer wants the specific authorization: a license, another approval, or the exemption claimed, with the facts that made the exemption available. ITAR §120.57 defines those three authorization types separately for a reason: a license is a document bearing the word license issued by DDTC, another approval is a different DDTC document covering a regulated activity, and an exemption is a provision of the subchapter you invoked yourself. The first two the Government issued and can look up. The third rests entirely on your own analysis, which is why an exemption used without the supporting determination on file is the finding that hurts most.
ITAR §120.50(b) deems any release of technical data in the United States to a foreign person an export to every country in which that person has held or holds citizenship or permanent residency. So the question is not only what left the building, but who in the building could open the file. A reviewer asks for the access list, the roles behind it, and the authorization covering each foreign person on it.
ITAR §122.5 obliges registrants to maintain records, and §127.2 lists what counts as an export control document: license applications, Electronic Export Information filings, invoices, purchase orders, bills of lading, airway bills, nontransfer and use certificates, and any other shipping document carrying export information. A false statement or an omitted material fact in any of them is itself a violation, so the file has to be complete, not merely present.
Sending, taking, or storing technical data is not an export if the data is unclassified, secured with end-to-end encryption, protected by cryptographic modules compliant with FIPS 140-2 or comparable strength of at least AES-128, and not intentionally sent to or stored in a §126.1 proscribed country or Russia. §120.54(b) adds that the means of decryption cannot be provided to any third party. WorkCell claims no FIPS validation, so whether a hosted deployment meets that test is your determination to make; an on-premises deployment keeps the data inside your own boundary instead.
Does ITAR apply to us if we never ship anything overseas?
Yes. Under 22 CFR §122.1 a manufacturer of defense articles who does not export still has to register with DDTC, and a single occasion is enough to count as engaging in the business. Releasing technical data to a foreign person inside the United States is itself an export.
Is WorkCell ITAR compliant?
ITAR binds your company, not your vendor, so compliance is something you hold rather than something software confers. What WorkCell brings to it is the controls half: role-based access over technical data with tenant isolation at the data layer, an attributable audit trail on every change, the destination and consignee held against the shipment, and an on-premises deployment option that keeps controlled technical data inside your own perimeter.
Can ITAR technical data be stored in a cloud system at all?
Section 120.54(a)(5) says storing unclassified technical data is not an export when it is end-to-end encrypted with FIPS 140-2 or comparable cryptography, the decryption means go to no third party, and nothing lands in a proscribed country. WorkCell claims no FIPS validation, so that determination is yours.
What is a deemed export, and can our own shop floor create one?
Yes, it can. Section 120.50(b) deems any release of technical data in the United States to a foreign person an export to every country where that person holds or has held citizenship or permanent residency. A green-card holder reading a controlled print at a terminal is the textbook case.
What are the penalties for an ITAR violation?
Criminal, not merely administrative. Under 22 CFR §127.3 a willful violation of section 38 or 39 of the Arms Export Control Act, or of any rule issued under them, carries a fine or imprisonment or both as prescribed by 22 U.S.C. 2778(c). Civil penalties run alongside.
Can WorkCell restrict a drawing to specific employees?
Permissions are role-based and enforced at the data layer with tenant isolation and single sign-on, so access to a drawing or routing is governed by the system and leaves an audit trail. You define the roles and decide who is authorized, and WorkCell holds that decision as the control: the access list is readable at any time, and every open and every change is attributable to a named person.
Keep the records as the work happens.
Export control is your programme to run, not ours to sell you. What WorkCell can do is keep the access, the revision, and the shipment record in one place so the file exists when someone asks for it.