A comprehensive ITAR Internal Compliance Program (ICP) is essential for effective ITAR management and is heavily considered in DDTC enforcement decisions. (1) Internal Compliance Program (ICP) Elements per DDTC Compliance Program Guidelines: (a) Management Commitment - written commitment + Board approval + CEO endorsement + tone-at-the-top; (b) Risk Assessment - identification of ITAR-related risks + per business + per geography + per product + per partner; (c) Empowered Official - per 22 CFR 120.67 + US person + authority + access to records + management reporting line; (d) Policies and Procedures - written + comprehensive + reviewed annually + tracked changes; (e) Classification - jurisdictional determination per item + USML categorisation + EAR coordination; (f) Restricted Party Screening - per shipment + per party + against Specially Designated Nationals (SDN) + Denied Parties + Entity List + Statutorily Debarred Parties List; (g) End-Use End-User screening + verification; (h) Licensing Workflow - submission + approval + amendment + closure; (i) Recordkeeping - 5-year per 22 CFR 122.5 + 123.22 + 129.6 + 130.16; (j) Training - annual ITAR awareness for all + role-based for compliance personnel + records of completion; (k) Internal Reporting - whistleblower mechanism + reporting channels; (l) Audits + Self-Assessments - annual internal audit + ITAR Compliance Review + remediation tracking; (m) Voluntary Disclosure procedure when violations detected; (n) Corrective Action and Continuous Improvement. (2) Empowered Official per 22 CFR 120.67: (a) US person; (b) authority to inquire into proposed exports; (c) authority to commit the company; (d) access to ITAR records; (e) reporting line to senior management; (f) US-based; (g) trained on ITAR; (h) typically Chief Compliance Officer + General Counsel + Trade Compliance Manager. Smaller entities may designate Chief Executive Officer + Chief Financial Officer + or other senior officer. (3) 5-Year Recordkeeping per multiple ITAR sections: comprehensive records of (a) registration; (b) licenses + applications; (c) MLAs + TAAs + Distribution Agreements; (d) export transactions + Commercial Invoice + Packing List + Bill of Lading + AES filing; (e) Statement of Registration; (f) Brokering activities; (g) Political contributions + Part 130 reports; (h) End-User End-Use Verification; (i) Voluntary disclosures + amendments; (j) Audit reports; (k) Training records; (l) Personnel records; (m) Foreign person access logs; (n) Technology Control Plans; (o) Department of Defense DD-254 + Facility Clearance documentation. (4) Training Programs: (a) Annual ITAR Awareness for All Employees - covering ITAR basics + USML + Deemed Export Rule + violations + reporting; (b) Role-Based Training - for engineers + sales + procurement + legal + HR + IT + senior management; (c) Specialised Training - for International Trade Compliance personnel + Empowered Official + Export Coordinators; (d) Refresher Training - annual + on policy changes; (e) Training Records + Completion Tracking + Sanctions for Non-Completion; (f) New Hire Onboarding + Foreign Person Onboarding. (5) IT Systems + Cloud for ITAR Data: (a) US-based data centres + cloud regions only; (b) US Person admins for hyperscaler cloud; (c) Microsoft 365 GCC High (Government Community Cloud High) + AWS GovCloud (US) + Google Workspace for Government + Oracle Cloud for Government for ITAR-compliant SaaS; (d) DoD Impact Level (IL) 5 for ITAR-controlled + IL 6 for classified; (e) FedRAMP High Baseline; (f) Customer-managed encryption keys (BYOK/HYOK); (g) Multi-Factor Authentication; (h) NIST SP 800-171 Controlled Unclassified Information (CUI) controls + CMMC 2.0 Level 2-3; (i) Software development environments (Microsoft GCC High + AWS GovCloud) for ITAR-related code; (j) Air-gapped or isolated networks for highest sensitivity; (k) Email + collaboration platform US-only + ITAR-compliant. (6) Supply Chain + Subcontractor Controls: (a) supplier due diligence + ITAR awareness; (b) ITAR provisions in subcontract; (c) Restricted Party screening of suppliers; (d) flow-down clauses; (e) ITAR record-keeping by subcontractors; (f) audit rights; (g) supplier ITAR training where needed; (h) supplier breach notification. (7) Coord with Other Export Control Regimes: (a) Export Administration Regulations (EAR) 15 CFR 730-774 administered by Department of Commerce Bureau of Industry and Security (BIS) - for dual-use items per Commerce Control List (CCL) + Export Control Classification Number (ECCN) + dual-use exports controlled but less restrictive than ITAR; (b) Office of Foreign Assets Control (OFAC) Department of Treasury - economic sanctions + embargoes + SDN List + 50 Percent Rule; (c) Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies; (d) Missile Technology Control Regime (MTCR); (e) Australia Group (chemical/biological); (f) Nuclear Suppliers Group (NSG); (g) UN Security Council arms embargoes; (h) AUKUS Pillar 2 (Australia + UK + US trilateral); (i) Five Eyes intelligence sharing; (j) NATO Standardization Office (NSO); (k) US Title 10 Armed Forces + Title 18 Crimes; (l) Foreign Corrupt Practices Act (FCPA); (m) CFIUS Committee on Foreign Investment in the United States. (8) Industry Best Practices: (a) Society for International Affairs (SIA); (b) American Bar Association (ABA) Section of International Law; (c) Department of Commerce BIS Best Practices for Industry; (d) DDTC Industry Outreach + Industry Days; (e) Defense Industrial Base (DIB) cybersecurity. Coordinates with all aforementioned export control regimes + DOJ + FBI + DHS + IRS + SEC + Department of Defense + Department of Commerce + Department of State + Department of Treasury. ITAR Compliance Program applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.