ITAR Certification Guide: How to Get ITAR Registered in 2026

Looking for how to get ITAR certified? There's no single "ITAR certification" the way there's a CMMC certification. Instead, companies that manufacture, export, or broker defense articles must register with the Directorate of Defense Trade Controls (DDTC) under the State Department. This registration is what people commonly call "ITAR certification," and it's mandatory before you can apply for export licenses or perform any controlled activity.

This guide walks you through the entire DDTC registration process from start to finish: who needs to register, what the requirements are, how much it costs, how long it takes, and what to do after you're registered. If you're a defense contractor, subcontractor, or manufacturer touching anything on the U.S. Munitions List (USML), this is your roadmap.

Who Needs ITAR Registration?

Under 22 CFR § 122.1, any person or company that engages in the business of manufacturing or exporting defense articles or furnishing defense services must register with DDTC. Specifically, you must register if you:

• ✓ Manufacture defense articles — including components, parts, and technical data on the USML, even if you never export them
• ✓ Export defense articles — shipping USML items, technical data, or software outside the U.S.
• ✓ Broker defense articles — arranging or facilitating sales between other parties
• ✓ Provide defense services — training, consulting, or engineering services related to USML items
• ✓ Store or transmit technical data — hosting USML-controlled data in cloud systems or networks

A critical point: manufacturers must register even if they only sell domestically. A small machine shop in Ohio making components for an F-35 subassembly needs DDTC registration even if the shop never exports a single item. The manufacturing activity itself triggers the requirement.

ITAR Certification Requirements

Before you submit your DDTC registration, you need to have these prerequisites in place:

Legal Entity Requirements

• U.S. entity: Your company must be incorporated or organized under U.S. law. Foreign-owned companies can register through a U.S. subsidiary, but additional disclosures are required.
• DUNS/UEI number: You need a Unique Entity Identifier (formerly DUNS number) from SAM.gov. If you don't have one, register at SAM.gov first — it takes 7-10 business days.
• Empowered Official (EO): You must designate a U.S. citizen employee as your Empowered Official. This person has the legal authority to sign export license applications and is personally accountable for ITAR compliance. They cannot be a contractor or consultant — they must be a direct employee.

Compliance Infrastructure

• Technology Control Plan (TCP): A documented plan describing how you control access to ITAR-controlled technical data. This should cover physical security, IT security, personnel screening, and visitor procedures.
• Foreign Person Screening Process: Procedures for screening employees, visitors, and business partners against the DDTC Debarred Parties List, BIS Denied Persons List, and OFAC SDN List.
• Record-Keeping System: ITAR requires you to maintain records of all controlled activities for a minimum of 5 years. This includes export licenses, technical data transmissions, and screening results.
• Training Program: Employees who handle ITAR-controlled items or data must receive compliance training. DDTC doesn't prescribe a specific curriculum, but training should cover USML classification, deemed exports, and reporting obligations.

Step-by-Step DDTC Registration Process

Here's the exact process to get ITAR registered. The entire process takes 4-8 weeks from start to finish, depending on the complexity of your application and DDTC's current backlog.

Step 1: Create a DDTC Account (Day 1)

Go to the DDTC website and create an account in their online registration system. You'll need your company's legal name exactly as it appears on your articles of incorporation, your UEI number, and the Empowered Official's information. Make sure the company name matches your SAM.gov registration exactly — mismatches are the #1 cause of processing delays.

Step 2: Complete Form DS-2032 (Days 1-5)

The Statement of Registration (DS-2032) is the core registration form. You'll provide:

• Company legal name, address, and all DBA names
• UEI number and EIN (Tax ID)
• Empowered Official name, title, and contact information
• Specific USML categories that apply to your products or services
• Foreign ownership or control disclosures (if any)
• Any prior ITAR violations or pending enforcement actions
• Names and addresses of all senior officers, partners, and directors

Take your time with the USML category selection. Claiming too many categories invites extra scrutiny. Claiming too few means you'll need to amend your registration later (which triggers another review cycle). Consult an ITAR attorney if you're uncertain about classification.

Step 3: Pay the Registration Fee (Day 5)

Submit payment along with your registration. See the cost breakdown below for current fee amounts. Payment is by check, wire transfer, or ACH — DDTC does not accept credit cards.

Step 4: DDTC Review Period (Weeks 2-6)

DDTC reviews your application against multiple databases and may request additional information. Common requests include:

• Clarification on USML category selections
• Additional foreign ownership documentation
• Explanation of previous compliance issues
• Updated officer or director information

Respond to any DDTC requests within 30 days. Letting a request expire means starting over from scratch.

Step 5: Registration Approval (Weeks 4-8)

Once approved, DDTC issues a registration code and your registration appears in their system. You can now apply for export licenses and are legally authorized to engage in controlled activities. Your registration is valid for one year and must be renewed annually — DDTC sends a renewal notice 60 days before expiration.

ITAR Registration Costs

DDTC registration fees changed significantly in recent years. Here's the current fee structure:

The registration fee is just the beginning. Real-world total costs for getting ITAR-compliant typically include:

7 Common ITAR Registration Mistakes

These are the errors that cause the most rejections, delays, and compliance headaches:

1. Company name mismatch. Your DDTC registration name must exactly match your SAM.gov and state incorporation records. Even minor differences (LLC vs. L.L.C.) can trigger a rejection.
2. Wrong USML categories. Selecting every category "just to be safe" flags your application for enhanced review. Only select the categories that specifically apply to your current products or services.
3. No Empowered Official. Some companies try to designate an outside consultant or attorney as their EO. This is not permitted — the EO must be a direct U.S. citizen employee with authority to bind the company.
4. Forgetting deemed exports. Companies focus on physical exports and forget that sharing technical data with foreign national employees constitutes a deemed export requiring a license.
5. Missing the renewal deadline. Registration expires after one year. If you miss the renewal window, your registration lapses and you must re-register from scratch — including paying a new registration fee and waiting through the full review cycle.
6. No Technology Control Plan. While not technically required at the time of registration, DDTC expects registrants to have a TCP in place. If they audit you and you don't have one, you'll face enforcement action.
7. Undisclosed foreign ownership. If your company has any foreign ownership or control — including foreign investors, board members, or parent companies — you must disclose this on the DS-2032. Failure to disclose is a separate violation with its own penalties.

What Happens After Registration?

Getting registered is just the starting line. Here's what you need to do to stay compliant:

Ongoing Compliance Requirements

• ✓ Annual renewal: Renew your registration before it expires each year. Set a calendar reminder for 90 days before expiration.
• ✓ Amendment notifications: Report changes to officers, addresses, or USML categories within 5 business days.
• ✓ Screening updates: Run denied party screenings on all employees and business partners regularly — at minimum quarterly.
• ✓ Record keeping: Maintain all export and compliance records for 5 years minimum.
• ✓ Voluntary disclosures: If you discover a potential violation, file a voluntary disclosure with DDTC promptly. Self-disclosure is a significant mitigating factor in enforcement actions.
• ✓ Training refresher: Conduct annual ITAR compliance training for all employees who handle controlled items or data.

Export License Applications

Once registered, you can apply for export licenses through DDTC's online system. Each license application requires specific details about the end-user, end-use, and the articles being exported. Processing times vary from 2 weeks to 6+ months depending on the destination country and items involved.

ITAR Registration vs. CMMC Certification

Defense contractors often need both ITAR registration and CMMC certification, but they serve different purposes:

If you're a defense contractor who both manufactures USML items and handles CUI under DoD contracts, you'll need both. The good news: many of the cybersecurity controls required for CMMC (especially around access control and data protection) overlap with ITAR's technical data protection requirements. Learn more about CMMC compliance →

ITAR Training Requirements

DDTC doesn't mandate a specific ITAR training curriculum, but auditors expect to see a documented training program. At minimum, your training should cover:

• ITAR basics: What ITAR is, what the USML covers, and why it matters
• Deemed exports: How sharing technical data with foreign nationals constitutes an export
• Classification: How to identify ITAR-controlled items and technical data in your workplace
• Reporting obligations: When and how to report potential violations
• Penalties: Civil and criminal consequences of non-compliance
• Company-specific procedures: Your Technology Control Plan, screening procedures, and escalation contacts

Training should be conducted at onboarding and refreshed annually. Keep records of who was trained, when, and what was covered — you'll need these for audit purposes.

Frequently Asked Questions

How long does ITAR registration take?

The typical timeline is 4-8 weeks from submission to approval. Simple applications (small companies, domestic manufacturing only) tend to be on the faster end. Applications involving foreign ownership, multiple USML categories, or prior violations take longer.

Can I export while my registration is pending?

No. You cannot apply for export licenses or engage in any controlled export activity until your registration is approved. Plan accordingly — if you have an upcoming contract requiring exports, start the registration process well in advance.

Do I need ITAR registration for EAR-controlled items?

No. EAR (Export Administration Regulations) items are administered by the Bureau of Industry and Security (BIS), not DDTC. If your items are classified under the Commerce Control List (CCL) rather than the USML, you don't need DDTC registration — but you may need BIS licenses for certain exports.

What happens if I let my registration lapse?

If your registration expires, you cannot legally engage in any activity that requires registration. You'll need to submit a new registration application and wait through the full review cycle. During the lapse, any ongoing export licenses become invalid. Set multiple reminders well before your renewal date.

Can a sole proprietor get ITAR registered?

Yes, but the sole proprietor must be a U.S. citizen and must serve as the Empowered Official. The same requirements apply — you need a UEI number, a Technology Control Plan, and the registration fee.

Is ITAR registration public?

DDTC does not publish a public list of registered companies. However, your registration status may be shared with other government agencies and can be verified by potential business partners or prime contractors through DDTC directly.