Does ITAR Compliance Satisfy CMMC Requirements?

No. ITAR compliance does not satisfy CMMC requirements. ITAR governs exports, transfers, disclosures, defense services, and technical data subject to U.S. defense export controls. CMMC evaluates whether applicable defense contractors have implemented required cybersecurity safeguards for Federal Contract Information or Controlled Unclassified Information. An organization can therefore be subject to both. A simple way to understand the distinction is this: ITAR answers whether and how controlled defense articles, services, or technical data may be exported, transferred, disclosed, or accessed. CMMC answers whether applicable contractor information systems adequately protect FCI and CUI. The two programs can affect the same organization and sometimes the same information, but they serve different regulatory purposes. Following one does not automatically establish compliance with the other.

Does ITAR Compliance Help With CMMC?

Yes, in some areas. A mature ITAR compliance program may already require an organization to think carefully about who can access controlled technical data, how information is transferred, how personnel are authorized, how records are maintained, and how unauthorized disclosures are prevented. Those practices can support CMMC readiness. For example, established access restrictions, user provisioning processes, personnel authorization records, information-handling procedures, and strong security governance may reduce some of the work required when preparing for CMMC. However, operational overlap should not be confused with equivalence. CMMC Level 2 requires implementation of all 110 NIST SP 800-171 Revision 2 security requirements. An ITAR program does not automatically demonstrate that those security requirements have been implemented or assessed. Current CMMC guidance continues to use the 110 Rev. 2 requirements as the Level 2 baseline.

What Is ITAR Compliance?

The International Traffic in Arms Regulations, commonly called ITAR, implement U.S. defense trade controls administered by the Department of State through the Directorate of Defense Trade Controls. ITAR is found in 22 CFR Parts 120–130 and works with the Arms Export Control Act to regulate defense articles, defense services, technical data, and related activities subject to the U.S. Munitions List. DDTC describes ITAR compliance as involving obligations such as registration where required, recordkeeping, and obtaining licenses or other approvals before controlled exports or other regulated activities occur.

What Does ITAR Regulate?

ITAR regulates specified defense articles, defense services, technical data, and associated export-control activities. Depending on the circumstances, regulated activity can include exporting or temporarily importing defense articles, providing defense services, transferring controlled technical data, brokering, reexporting, or retransferring controlled items or information. The United States Munitions List identifies categories of defense articles and related technical information subject to the ITAR. ITAR is therefore fundamentally an export-control regime. Its purpose and legal structure are different from a cybersecurity assessment program such as CMMC.

Who Does ITAR Apply To?

ITAR applicability depends on the activities an organization performs and the articles, services, or technical data involved. Organizations involved in manufacturing defense articles, exporting or temporarily importing controlled articles, brokering, providing defense services, or handling and transferring ITAR-controlled technical data may have obligations under the regulations. For example, 22 CFR § 122.1 requires registration for many persons engaged in the United States in manufacturing, exporting, temporarily importing defense articles, or furnishing defense services, subject to specified exemptions. This does not mean every DoD or DoW contractor is automatically subject to ITAR. A contractor’s ITAR obligations depend on the actual work, information, items, services, transactions, and export-control classifications involved.

Does DDTC Registration Mean You Are ITAR Compliant?

No.

DDTC registration should not be treated as an ITAR compliance certificate. The regulations state that registration primarily provides the U.S. Government with information about persons involved in specified manufacturing and exporting activities. Registration does not provide export rights or privileges and is generally a prerequisite to obtaining licenses or other approvals where those are required. DDTC guidance goes even further, explaining that registration does not constitute certification of ITAR compliance or prove the effectiveness of an organization’s internal compliance program. An organization’s broader ITAR responsibilities can include determining jurisdiction and classification, keeping required records, screening parties, obtaining required licenses or agreements, managing controlled technical data, complying with authorization conditions, controlling unauthorized releases, and maintaining an effective export compliance process. Registration is therefore one possible compliance obligation, not evidence that every ITAR requirement has been satisfied.

Is ITAR a Cybersecurity Certification?

No.

ITAR is an export-control regulatory regime rather than a cybersecurity certification framework. Protecting technical data from unauthorized disclosure is clearly important to ITAR compliance, and DDTC guidance encourages organizations involved in defense trade to establish and maintain effective compliance programs. ITAR also contains provisions dealing with the secure transmission and storage of technical data. However, ITAR does not establish a cybersecurity framework equivalent to the 110 security requirements in NIST SP 800-171 Revision 2. A company can therefore have a sophisticated export-control compliance program while still having substantial CMMC cybersecurity work to complete.

What Does CMMC Require?

CMMC focuses on whether defense contractors and subcontractors have implemented applicable cybersecurity safeguards for government information handled in nonfederal environments. Current CMMC guidance separates requirements according to the sensitivity of the information involved.

What Information Does CMMC Protect?

CMMC primarily addresses Federal Contract Information and Controlled Unclassified Information. FCI is nonpublic information provided by or generated for the government under a contract to develop or deliver a product or service, subject to the exclusions in the FAR definition. CUI is information that the government creates or possesses, or that another entity creates or possesses for or on behalf of the government, where law, regulation, or government-wide policy requires or permits safeguarding or dissemination controls. Current CMMC guidance describes Level 1 as protection for FCI and Level 2 as broad protection for CUI.

How CMMC Level 1 and Level 2 Work

CMMC Level 1 uses the 15 safeguarding requirements associated with FAR 52.204-21. Level 2 uses all 110 security requirements contained in NIST SP 800-171 Revision 2. In the current 2026 Phase I environment, Level 1 uses an annual self-assessment and applicable Level 2 requirements use a self-assessment every three years, along with required affirmations. The broader CMMC compliance requirements explain how the different levels, information types, and assessment requirements fit together.

Why CMMC Is Different From ITAR

CMMC is focused on cybersecurity implementation and verification. An assessment may evaluate whether systems are properly configured, access is restricted, authentication is implemented, logs exist, security processes operate consistently, documentation matches the environment, and objective evidence supports claimed implementation. ITAR asks different questions. For example, an ITAR analysis might ask whether technical data is controlled, whether a proposed recipient is authorized, whether a release constitutes an export or retransfer, and whether a license, agreement, exemption, or other authorization applies. A contractor handling information subject to both programs must answer both sets of questions.

ITAR vs. CMMC: What Are the Main Differences?

The important takeaway is that ITAR and CMMC can produce similar operational security practices while addressing different legal risks. An access-control process, for example, may help support both programs. But the reason access is restricted and the standard against which that restriction is evaluated can be different.

Where Do ITAR and CMMC Requirements Overlap?

The strongest overlap is operational rather than regulatory. Organizations subject to both programs often benefit from designing security and compliance processes that account for cybersecurity requirements and export-control restrictions at the same time.

Access to Sensitive Information

Both programs make access to sensitive information an important issue. For CMMC Level 2, access controls come from NIST SP 800-171 and address areas such as authorized users, system access, privileged functions, remote connectivity, and the protection of CUI. For ITAR, the issue is whether controlled technical data is being exported, released, reexported, or retransferred to a person who is authorized to receive it. The same identity platform or access-control system may support both compliance programs, but the legal basis for the restrictions remains different.

Identity and Personnel Management

An organization subject to both CMMC and ITAR may benefit from strong identity and personnel processes. Unique user accounts, carefully managed privileges, timely removal of terminated users, documented authorization, and controlled administrative access can all reduce risk. However, ITAR should not be described as universally requiring the same authentication mechanisms as CMMC. For example, strong authentication may be a sensible safeguard for protecting ITAR-controlled data, but ITAR itself does not create the complete NIST SP 800-171 authentication framework that applies to CMMC Level 2.

Protecting Technical Data

Technical data can create one of the clearest areas of overlap. ITAR controls when and how regulated technical data may be exported, released, reexported, or retransferred. If that same information is CUI in an environment subject to CMMC Level 2, NIST SP 800-171 establishes the cybersecurity requirements used to protect it. This means a contractor may need both an export-control basis for allowing someone to receive information and a cybersecurity environment capable of protecting that information from unauthorized access.

Documentation and Recordkeeping

Both programs create substantial documentation needs, although the documents serve different purposes. CMMC preparation commonly includes an SSP, policies and procedures, asset information, network diagrams, CUI flows, assessment evidence, and POA&M documentation where permitted. An ITAR compliance program can involve registration records, jurisdiction or classification documentation, licenses and other authorizations, transaction records, screening information, agreements, and internal export-control procedures. The same compliance team may help manage both sets of records, but one set does not replace the other.

Is ITAR-Controlled Technical Data Also CUI?

Sometimes, but not automatically. This distinction is one of the most important points for organizations trying to understand ITAR CMMC compliance.

When ITAR Technical Data Can Be Export-Controlled CUI

The federal CUI Registry includes an Export Controlled category. The National Archives describes this category as covering certain unclassified information involving items, technology, software, and other information whose export could affect U.S. national security or nonproliferation objectives. The category specifically references items identified under ITAR and the U.S. Munitions List. That creates a clear situation in which export-controlled defense information can also fall within the CUI framework. Controlled Technical Information is another CUI category relevant to defense contractors. The CUI Registry describes it as technical information with military or space application that is subject to controls on access, use, release, disclosure, or dissemination.

Is All ITAR Data Automatically CUI?

No.

Information does not become CUI merely because it is controlled under ITAR. CUI status depends on the applicable government authority and the circumstances under which the information is created, possessed, provided, or generated. The CUI framework specifically concerns government information, including information created or possessed for or on behalf of the government, that is subject to safeguarding or dissemination controls. An organization may therefore possess commercially generated ITAR-controlled technical data without every piece of that information automatically becoming CUI. Contractors should identify the regulatory and contractual basis for each information type rather than using ITAR and CUI as interchangeable labels.

Is All CUI Subject to ITAR?

No.

The federal CUI Registry contains many categories unrelated to defense export controls. As a result, a contractor can encounter three different situations. Information may be ITAR-controlled without triggering applicable CMMC requirements. Information may be CUI protected under CMMC but unrelated to ITAR. Or information may simultaneously be export-controlled and subject to CMMC cybersecurity obligations. The third situation is why aerospace, defense manufacturing, engineering, and technology organizations frequently need to coordinate export-control and cybersecurity programs.

Why ITAR Compliance Alone Does Not Satisfy CMMC Level 2

ITAR compliance can support good security practices, but it does not provide the structured cybersecurity implementation required by CMMC Level 2.

ITAR Does Not Replace the 110 NIST SP 800-171 Requirements

CMMC Level 2 uses all 110 security requirements from NIST SP 800-171 Revision 2. Those requirements address cybersecurity areas extending well beyond determining whether technical data may be exported. They cover topics such as access control, audit and accountability, configuration management, identification and authentication, incident response, risk assessment, security assessment, system integrity, media protection, and communications protection. An ITAR compliance program does not automatically prove that all 110 requirements have been implemented.

ITAR Does Not Replace a CMMC Assessment

Being registered with DDTC or maintaining an ITAR compliance program does not produce a CMMC status. Similarly, an export license or approved technical assistance agreement is not a CMMC certification. CMMC has its own assessment and affirmation structure. In current Phase I, applicable Level 1 and Level 2 self-assessments remain in place.

ITAR Does Not Replace CMMC Scoping

CMMC requires an organization to identify the information systems and assets associated with the relevant assessment scope. Depending on the environment and level, that analysis may involve CUI assets, security protection assets, specialized assets, cloud services, external providers, users, facilities, and network boundaries. An export-control data inventory may help with this work, but it is not automatically the same thing as a CMMC assessment scope.

ITAR Does Not Replace the System Security Plan

An SSP describes the information system, boundaries, operating environment, connections, and implementation of applicable NIST SP 800-171 security requirements. That document has a specific cybersecurity purpose. An ITAR compliance manual may address export authorization, screening, recordkeeping, foreign-person access, classification, and handling procedures, but it does not automatically provide the system-level description expected for CMMC Level 2.

ITAR Does Not Replace SPRS Requirements

Applicable DoD cybersecurity assessment information and CMMC affirmations are managed through the government’s cybersecurity assessment process, including SPRS where required. ITAR compliance does not replace those submission requirements. For contractors subject to DFARS NIST assessment requirements, the DoD also uses SPRS to maintain applicable assessment information. Current DFARS policy requires contractors subject to NIST SP 800-171 through DFARS 252.204-7012 to have a current applicable assessment at award.

ITAR Does Not Replace CMMC Evidence Requirements

An organization can have excellent written export-control procedures and still have cybersecurity gaps. For example, a policy might correctly prohibit unauthorized disclosure of technical data while the underlying environment lacks adequate logging, endpoint management, configuration controls, vulnerability management, or other NIST-required safeguards. CMMC readiness requires the contractor to demonstrate implementation through objective evidence, not merely show that an export-control policy exists.

Does CMMC Compliance Satisfy ITAR Requirements?

No.

The reverse is also true: CMMC compliance does not satisfy ITAR. A CMMC assessment verifies cybersecurity safeguards. It does not determine ITAR jurisdiction, classify items under the USML, provide DDTC registration, issue export licenses, authorize foreign-person access, satisfy brokering requirements, or replace export-control recordkeeping. DDTC makes clear that registration itself does not grant export rights and that licenses or other approvals may be required for controlled activities. A contractor with strong CMMC cybersecurity controls could therefore still violate ITAR if controlled technical data is released to an unauthorized recipient. Cybersecurity authorization and export authorization are different concepts.

When Does a Defense Contractor Need Both ITAR and CMMC?

The easiest way to understand the relationship is through practical scenarios.

Scenario 1: DoD Contractor Handling CUI and ITAR Technical Data

Suppose a defense manufacturer receives CUI under a contract and that environment also contains ITAR-controlled technical data. Both sets of obligations may apply. The contractor may need to implement applicable NIST SP 800-171 and CMMC safeguards while separately controlling exports, disclosures, access, and transfers under ITAR. Strong cybersecurity does not remove the export-control requirement, and export-control compliance does not remove the cybersecurity requirement.

Scenario 2: Company Handles CUI but No ITAR-Controlled Data

A contractor can handle CUI that has nothing to do with ITAR. The federal CUI Registry includes numerous categories unrelated to export control. In that situation, applicable NIST SP 800-171 and CMMC requirements may still apply even though ITAR does not.

Scenario 3: Company Handles ITAR-Controlled Items but No Applicable DoD CUI

The opposite can also occur. A business may manufacture or export USML-controlled articles or handle ITAR technical data without having a contract that creates applicable CMMC Level 2 obligations. The company could therefore have ITAR responsibilities without needing CMMC Level 2 for that particular activity.

Scenario 4: Subcontractor Receives Export-Controlled CUI

A subcontractor may receive information that is both CUI and export controlled. In this situation, cybersecurity requirements can flow down through the defense supply chain while the organization also remains responsible for applicable ITAR obligations. Prime contractors and subcontractors should pay particular attention to what information is actually being shared and what requirements accompany it. The CMMC flow-down requirements explain how cybersecurity obligations can move through the supply chain.

Do ITAR and CMMC Have the Same Access Control Requirements?

No.

Both programs care about unauthorized access, but they approach the problem differently.

How CMMC Controls User Access

At CMMC Level 2, NIST SP 800-171 establishes structured access-control requirements for CUI environments. These requirements address areas including authorized users and devices, least privilege, privileged functions, remote access, wireless and mobile access, external systems, information flow, and other system-level access concerns. Identification, authentication, and audit requirements work alongside those access controls to create a broader cybersecurity system.

How ITAR Controls Access to Technical Data

ITAR focuses on whether a person is legally authorized to receive controlled technical data. A disclosure to a foreign person can constitute a controlled activity requiring authorization, depending on the circumstances. DDTC compliance material states that oral, visual, or documentary disclosure of technical data to foreign persons requires appropriate authorization unless a qualifying exemption applies. The organization therefore needs to understand both who can technically access information and whether that person is legally authorized to receive it.

Does ITAR Require Only U.S. Persons to Access Technical Data?

Not as an absolute rule. The common statement that “ITAR means U.S. persons only” is an oversimplification. Foreign persons can receive or access ITAR-controlled technical data when the applicable release is properly authorized or a qualifying exemption or other authorization applies. DDTC guidance specifically addresses licensing mechanisms for foreign-person employees who require access to ITAR-controlled defense articles or technical data. The more accurate rule is that organizations must prevent unauthorized access or release and determine whether the relevant foreign-person disclosure is authorized.

Does ITAR Require U.S.-Only Cloud Storage?

Not as a universal rule. ITAR contains specific provisions for properly secured unclassified technical data. DDTC’s guidance on ITAR § 120.54 explains that sending, taking, or storing unclassified technical data can, under specified conditions, fall outside the definition of an export, reexport, retransfer, or temporary import when the information is properly secured using qualifying end-to-end encryption and other regulatory conditions are satisfied. This means “all ITAR data must always be on servers physically located in the United States” is too broad. However, the rule is conditional. It does not mean any foreign cloud architecture automatically complies with ITAR. The treatment depends on factors such as whether the information is unclassified, the encryption approach, where the information is sent or stored, who can access it in unencrypted form, and applicable restricted-country provisions. Organizations should evaluate these questions carefully against current ITAR requirements rather than relying on a simple “ITAR-compliant cloud” label.

What Additional Cloud Requirements Apply When the Data Is CUI?

When the same information is also CUI under an applicable defense contract, separate cybersecurity obligations may apply. DFARS 252.204-7012 states that when a contractor uses an external cloud service provider to store, process, or transmit covered defense information, it must require and ensure that the provider meets security requirements equivalent to the FedRAMP Moderate baseline and satisfies applicable incident-reporting and related obligations in the clause. CMMC and NIST SP 800-171 responsibilities also need to be considered based on the contractor’s scope and environment. The key takeaway is: A cloud environment capable of supporting ITAR requirements is not automatically CMMC compliant, and a cloud architecture designed for CMMC does not automatically satisfy every ITAR export-control requirement.

What Should You Do If Both ITAR and CMMC Apply?

The strongest approach is to coordinate the two compliance programs without treating them as the same program.

Identify and Classify the Information You Handle

Start by understanding what information exists in the environment. Determine whether the organization handles FCI, CUI, Controlled Technical Information, Export Controlled CUI, ITAR-controlled technical data, or some combination of these categories. Do not classify all sensitive defense information under one label. The legal and contractual requirements can differ significantly depending on the information involved.

Map Where Controlled Information Is Stored, Processed and Transmitted

Once the information has been identified, map its lifecycle. Determine where it enters the organization, which systems process it, where it is stored, how it moves between systems, which users can reach it, whether cloud platforms are involved, and which external service providers interact with the environment. This exercise supports both cybersecurity scoping and better export-control governance.

Identify Who Is Authorized to Access ITAR-Controlled Data

ITAR access should be evaluated based on actual authorization rather than assumptions about nationality alone. Organizations should determine who needs access, whether a proposed release is regulated, and which license, agreement, exemption, or other authorization supports that activity where required. Access controls should then be designed to reflect those decisions.

Assess Your Environment Against NIST SP 800-171

If CMMC Level 2 applies, evaluate the environment requirement by requirement against NIST SP 800-171 Revision 2. Do not assume that existing ITAR safeguards provide full coverage. The assessment should identify technical, procedural, documentation, and evidence gaps across the 110 Level 2 requirements.

Build an Accurate SSP and Supporting Documentation

The SSP should describe the real CUI environment. It should document system boundaries, relevant assets, connections, operating conditions, responsibilities, and how applicable security requirements are implemented. Export-control documentation should remain coordinated with this work where the same systems handle ITAR-controlled data, but the documents should continue to serve their respective compliance purposes.

Address Cybersecurity and Export-Control Gaps Separately

Some remediation projects may support both programs. Improving identity management, restricting sensitive repositories, strengthening account termination processes, or implementing stronger information-transfer controls can provide benefits across both ITAR and CMMC. Still, teams should track why each action is required. An export-control obligation should not be marked complete merely because a NIST control was implemented, and a CMMC requirement should not be marked MET simply because an ITAR policy exists.

Validate CMMC Readiness

Organizations preparing for CMMC should verify scope, NIST SP 800-171 implementation, SSP accuracy, technical configurations, and assessment evidence before relying on a self-assessment or future certification process. CMMC compliance services can support CUI scoping, gap assessment, security implementation planning, documentation, evidence readiness, and preparation for applicable CMMC assessment requirements.

Does the 2026 CMMC Phase II Suspension Change ITAR Requirements?

No.

ITAR operates independently of the CMMC implementation schedule. On July 13, 2026, the Department suspended CMMC Phase II requirements and began a broader review of the CMMC program. Official guidance states that all Phase I self-assessment requirements remain in place. That decision does not suspend ITAR, change DDTC export-control requirements, or remove the need to obtain applicable export authorizations. An organization should therefore continue meeting ITAR obligations regardless of changes to the CMMC rollout.

Does the CMMC Pause Remove NIST SP 800-171 Obligations?

No.

Current Department guidance specifically states that the CMMC Phase II suspension does not eliminate applicable requirements to protect information under DFARS 252.204-7012. During the pause, the Department continues enforcing NIST SP 800-171 Revision 2 through self-assessments and selected government-led assessments. DFARS 252.204-7012 also continues to require applicable covered contractor information systems to meet NIST SP 800-171 requirements and separately states that its safeguarding requirements do not eliminate other legal or regulatory safeguarding obligations. This is particularly relevant for contractors subject to both ITAR and defense cybersecurity requirements because neither compliance obligation cancels the other.

Should Contractors Subject to ITAR Stop CMMC Preparation?

No.

Organizations expecting applicable defense work should continue strengthening CUI protection, verifying NIST SP 800-171 implementation, keeping the SSP current, checking SPRS information, and remediating security deficiencies. At the same time, applicable ITAR compliance should continue independently. The current pause can be used to resolve weaknesses before future CMMC requirements expand rather than waiting for the next implementation milestone. The CMMC Phase 2 suspension provides more detail on what remains required during the 2026 program review.

How Nexeris Helps Contractors Align ITAR-Affected Environments With CMMC

Organizations handling ITAR-controlled information and CUI often have complex security environments because access decisions, cybersecurity requirements, cloud architecture, user identity, and data flows can affect multiple compliance obligations. Nexeris focuses on the cybersecurity and CMMC side of those environments rather than replacing legal export-control analysis. Support can include identifying and scoping CUI environments, conducting NIST SP 800-171 gap assessments, reviewing access-control architecture, developing and validating SSP documentation, planning POA&M remediation, strengthening security architecture, organizing objective evidence, and preparing teams for applicable CMMC assessments. This approach allows contractors to build a cybersecurity environment that supports CMMC while continuing to manage separate ITAR obligations through the appropriate export-control processes and advisors.

Frequently Asked Questions

1. Does ITAR compliance satisfy CMMC requirements?

No.

ITAR and CMMC have different purposes. ITAR regulates defense exports, services, technical data, transfers, disclosures, and related authorization requirements. CMMC verifies cybersecurity safeguards for applicable FCI and CUI environments. ITAR practices may support parts of CMMC readiness, but they do not replace the applicable CMMC security requirements or assessment process.

2. What is the main difference between ITAR and CMMC?

ITAR is an export-control regulatory regime administered by the Department of State through DDTC. CMMC is a cybersecurity assessment program used for applicable defense contractors and subcontractors. ITAR determines whether controlled defense items, services, or technical data may be exported, released, or transferred. CMMC determines whether applicable systems have implemented cybersecurity safeguards required for FCI and CUI.

3. Do ITAR-compliant companies still need CMMC?

They may. If an organization is subject to a contract or solicitation requiring CMMC, existing ITAR compliance does not remove that requirement. A contractor handling both CUI and ITAR-controlled technical data may need to satisfy both programs independently.

4. Is ITAR-controlled technical data considered CUI?

Sometimes, but not automatically. The federal CUI Registry recognizes Export Controlled CUI and specifically references information related to ITAR and the U.S. Munitions List. However, every piece of ITAR-controlled technical data should not automatically be labeled CUI. CUI status depends on the applicable authority, government relationship, contractual context, and information category.

5. Does CMMC compliance satisfy ITAR requirements?

No.

CMMC compliance does not provide export authorization, DDTC registration, USML classification, foreign-person authorization, export licensing, brokering approval, or other ITAR compliance functions. An organization must evaluate and satisfy ITAR separately where it applies.

6. Does ITAR require NIST SP 800-171 compliance?

Not by itself. ITAR does not impose the complete set of 110 NIST SP 800-171 Revision 2 security requirements simply because information is ITAR controlled. However, the same organization or information environment may separately be subject to NIST SP 800-171 through an applicable defense contract, such as one containing DFARS 252.204-7012.

7. Does ITAR require U.S.-only cloud storage?

Not as a universal rule. ITAR § 120.54 provides circumstances in which properly secured, end-to-end encrypted unclassified technical data may be sent, taken, or stored outside the United States without the activity itself constituting an export, reexport, or retransfer, provided the regulatory conditions are satisfied. Organizations still need to evaluate encryption, destination, access, authorization, and other applicable restrictions.

8. Can foreign persons access ITAR-controlled technical data?

Potentially, when properly authorized. ITAR does not establish an absolute rule that a foreign person can never receive controlled technical data. Depending on the circumstances, access may be authorized through a license, agreement, exemption, or another applicable authorization. Unauthorized releases remain prohibited. DDTC guidance specifically provides mechanisms for authorizing certain foreign-person employee access.

9. Does the 2026 CMMC suspension affect ITAR compliance?

No.

The July 13, 2026 suspension affects the CMMC Phase II rollout and does not suspend ITAR. Phase I CMMC self-assessment requirements remain in place, and applicable NIST SP 800-171 and DFARS obligations continue independently. ITAR obligations also remain independently applicable to regulated defense trade activities.