The International Traffic in Arms Regulations (ITAR) govern the export and handling of U.S. Munitions List (USML) defense articles and technical data. U.S. entities that manufacture, export, provide defense services, or control ITAR-defined technical data must comply with 22 CFR 120–130.

ITAR jurisdiction is typically identified through USML classification and contractual language referencing ITAR or DDTC registration. If your contracts reference ITAR (22 CFR 120–130), export controls likely apply.

ITAR violations may result in significant civil penalties, criminal liability, loss of export privileges, and reputational damage. Enforcement actions are issued by the U.S. Department of State.

No. ITAR is a federal export control regulation. CMMC is a cybersecurity certification framework required for certain Department of Defense contracts. While cybersecurity supports ITAR safeguards, the regulations are separate.

No. This framework is intended for internal evaluation and planning. It does not constitute legal advice or a formal compliance determination. Organizations should consult qualified export counsel for legal guidance.