Skip to content
LastAwarded
Guide

ITAR, EAR, and DFARS basics

Three sets of rules follow defense parts around: export controls on the data, export controls on the item, and contract clauses on the order. Here is what each one means for a small shop. This is orientation, not legal advice.

Not legal advice

Export control law carries serious penalties and turns on facts about your parts, your people, and your customers. Use this page to learn the vocabulary, then talk to an export compliance professional or attorney before you decide anything.

ITAR in plain English

The International Traffic in Arms Regulations, ITAR, govern defense articles, defense services, and related technical data. The list of what counts is the United States Munitions List. The rules are administered by the Directorate of Defense Trade Controls, DDTC, at the Department of State.

Two points surprise new shops. First, if you manufacture defense articles, you are generally required to register with DDTC even if you never ship anything outside the country. Registration is a filing and a fee, renewed yearly. Check the current requirements and fee on the DDTC site. Second, technical data counts. A drawing for a defense article is itself controlled. Giving a foreign national access to that drawing, even at your own plant, can be an export.

ITAR does not stop you from doing defense work. It requires you to know what is controlled, control who sees it, and get a license before anything controlled leaves the country or reaches a foreign person.

EAR in plain English

The Export Administration Regulations, EAR, cover items that are not on the Munitions List but still have military or strategic uses, along with most commercial items. They are administered by the Bureau of Industry and Security, BIS, at the Department of Commerce. Items are classified with an Export Control Classification Number, and many military items that moved off the Munitions List in recent years now sit in the EAR under what is often called the 600 series.

Many commercial parts fall under a catch-all category with few restrictions. But a drawing marked with an EAR classification still requires you to control access by destination and, in some cases, by person. The customer who gave you the drawing should be able to tell you its classification. If they cannot, ask before you share it with anyone.

In practice, a small shop meets EAR and ITAR the same way: know the classification of the data you hold, restrict it to people who are allowed to see it, and do not send it anywhere without checking.

Export controlled drawings and how to get them

Most military technical data packages carry a distribution statement and an export control warning. Government systems will not release them to a company that has not been certified through the Joint Certification Program, run by the United States and Canada. You apply with DD Form 2345, describe your business, and certify that you will safeguard the data. Once approved, your certification lets you download controlled drawings from SAM.gov and from DLA's technical data system.

Certification does not make you an ITAR registrant, and ITAR registration does not certify you for JCP. They are separate steps. Many shops need both.

Once you have controlled data, treat it as controlled. Keep it off shared drives that foreign nationals or outside contractors can reach. Mark printed copies. Do not email it to a supplier without confirming they can receive it. When the job is done, keep or destroy it according to the customer's instructions.

DFARS clauses you will see

The Defense Federal Acquisition Regulation Supplement adds Department of Defense rules on top of the FAR. They show up on solicitations and purchase orders as clause numbers. A few appear on almost every defense parts order.

Common DFARS clauses on parts orders

ClauseTopicWhat it means for you
252.225-7048Export-controlled itemsYou are responsible for complying with ITAR and EAR on the work
252.204-7012Safeguarding covered defense informationProtect controlled unclassified information and report cyber incidents; see the CMMC guide
252.204-7019 and 7020NIST SP 800-171 assessmentHave a current self-assessment score on file in the government system
252.204-7021Cybersecurity Maturity Model CertificationHold the CMMC level the contract requires, as the program phases in
252.225-7009Restriction on specialty metalsTitanium, certain steels, and other listed metals must be melted in the United States or a qualifying country
252.225-7001Buy American and Balance of PaymentsDomestic content rules on the end item
252.211-7003Item unique identificationMark qualifying items with a machine readable unique identifier
252.246-7007 and 7008Counterfeit electronic partsDetection and avoidance system and approved sources for electronic parts
252.223-7008Hexavalent chromiumRestrictions on hex chrome in deliverables unless approved

Clause numbers are stable but text and thresholds change. Read the current version on acquisition.gov.

What a small shop actually does

Decide whether you make defense articles. If you machine parts to a drawing for a weapon system, aircraft, or missile, the answer is often yes, and DDTC registration is likely required. Confirm with counsel.

Apply for JCP certification early. It is free and it is the gate to most military drawings.

Write a short technology control plan. Who can see controlled data, where it lives, how it is marked, and what happens when a visitor or a new hire arrives. A few pages is enough for most shops.

Read the specialty metals clause before you buy material for a defense order. Mill certifications must show a compliant melt source, and a bar bought from a distributor without that paperwork can make a finished part undeliverable.

Keep a list of the clauses on each order and what you did to meet them. When a prime's supplier audit or a government review asks, you will have the answer.

See who was last awarded in your NAICS

The free report shows who bought your part category, who won, and what is coming up for recompete.