So you want to get "ITAR certified"? Here's the thing—there's no official ITAR certification like there is with CMMC. What you actually need is to register with DDTC (the Directorate of Defense Trade Controls under the State Department). That's what people call "ITAR certification" in the industry, and you have to do it before you can get export licenses or legally handle controlled items.
This guide takes you through the whole DDTC registration process—who needs to do it, what you actually need to prepare, the costs, the timeline, and what happens after you're approved. If you're making USML items, exporting them, or handling the related technical data, this is what you need to read.
Who Needs ITAR Registration?
The regulation is clear: if you're in the business of making, exporting, or providing services related to defense articles, you have to register. That means you if you:
- Manufacture defense articles — including components, parts, and technical data on the USML, even if you never export them
- Export defense articles — shipping USML items, technical data, or software outside the U.S.
- Broker defense articles — arranging or facilitating sales between other parties
- Provide defense services — training, consulting, or engineering services related to USML items
- Store or transmit technical data — hosting USML-controlled data in cloud systems or networks
Here's the kicker: you have to register even if you never export anything. A small machine shop in Ohio making F-35 components? They need DDTC registration even if they never ship overseas. Just making USML items triggers it.
Not Sure If You Need Registration?
If you're unsure whether your products fall under the USML, a commodity jurisdiction (CJ) request to DDTC can provide a formal determination. This costs nothing and takes 4-6 weeks.
ITAR Compliance Checklist →ITAR Certification Requirements
Before you submit to DDTC, get these things in order:
Legal Entity Requirements
- U.S. company: You need to be incorporated or organized under U.S. law. If you're foreign-owned, you can register through a U.S. subsidiary, but you'll need to disclose that.
- UEI number: Get a Unique Entity Identifier (it used to be called a DUNS number) from SAM.gov. Don't have one? Register there first—takes about a week.
- Empowered Official (EO): Pick a U.S. citizen employee to be your EO. This person signs off on licenses and is personally responsible for ITAR compliance. They have to be a direct employee, not a contractor or outside counsel.
Compliance Infrastructure
- Technology Control Plan (TCP): A documented plan describing how you control access to ITAR-controlled technical data. This should cover physical security, IT security, personnel screening, and visitor procedures.
- Foreign Person Screening Process: Procedures for screening employees, visitors, and business partners against the DDTC Debarred Parties List, BIS Denied Persons List, and OFAC SDN List.
- Record-Keeping System: ITAR requires you to maintain records of all controlled activities for a minimum of 5 years. This includes export licenses, technical data transmissions, and screening results.
- Training Program: Employees who handle ITAR-controlled items or data must receive compliance training. DDTC doesn't prescribe a specific curriculum, but training should cover USML classification, deemed exports, and reporting obligations.
Step-by-Step DDTC Registration Process
Here's how it actually works. Budget 4-8 weeks from application to approval (depending on complexity and how backed up DDTC is).
Step 1: Create a DDTC Account (Day 1)
Sign up on the DDTC website. Use your exact legal company name (match it to your articles of incorporation), your UEI, and your EO's info. This is critical: if your company name doesn't match SAM.gov exactly, you'll get delayed. It happens constantly.
Step 2: Complete Form DS-2032 (Days 1-5)
This is the main registration form. Fill in:
- Company legal name, address, and all DBA names
- UEI number and EIN (Tax ID)
- Empowered Official name, title, and contact information
- Specific USML categories that apply to your products or services
- Foreign ownership or control disclosures (if any)
- Any prior ITAR violations or pending enforcement actions
- Names and addresses of all senior officers, partners, and directors
Be careful with the USML categories. Pick too many and you'll get additional scrutiny. Pick too few and you'll have to amend later (which means another waiting period). When in doubt, talk to an ITAR attorney.
Step 3: Pay the Registration Fee (Day 5)
Send your payment with the application. Check the costs section below for the amount. They take checks, wire transfers, or ACH—no credit cards.
Step 4: DDTC Review Period (Weeks 2-6)
DDTC reviews your stuff against various databases and might ask for more info. Typical requests:
- Clarification on USML category selections
- Additional foreign ownership documentation
- Explanation of previous compliance issues
- Updated officer or director information
If DDTC asks for something, answer within 30 days. Miss that window and you start all over.
Step 5: Registration Approval (Weeks 4-8)
When you're approved, you get a registration code and you're in their system. Now you can apply for licenses and operate legally. Your registration lasts one year, so renew it annually. DDTC reminds you 60 days before it expires.
Need Help With ITAR Compliance?
The right compliance software can automate screening, track technical data access, and generate audit-ready records.
Compare Compliance Software →ITAR Registration Costs
DDTC registration fees changed significantly in recent years. Here's the current fee structure:
| Fee Type | Amount | When Due |
|---|---|---|
| Initial Registration (Tier 1 — manufacturers who don't export) | $2,250/year | With DS-2032 submission |
| Initial Registration (Tier 2 — exporters with < $500K in sales) | $2,750/year | With DS-2032 submission |
| Initial Registration (Tier 3 — exporters with > $500K in sales) | $2,750+/year | With DS-2032 submission |
| Annual Renewal | Same as initial tier | Before expiration date |
| Amendment (change of address, officers, USML categories) | No fee | Within 5 days of change |
The registration fee is just the beginning. Real-world total costs for getting ITAR-compliant typically include:
| Cost Component | Small Company (<50 employees) |
Mid-Size Company (50-250 employees) |
|---|---|---|
| DDTC Registration Fee | $2,250 - $2,750 | $2,750+ |
| ITAR Attorney (initial setup) | $5,000 - $15,000 | $15,000 - $40,000 |
| Compliance Software | $3,000 - $8,000/year | $10,000 - $30,000/year |
| Employee Training | $2,000 - $5,000 | $5,000 - $15,000 |
| Physical Security Upgrades | $1,000 - $10,000 | $10,000 - $50,000 |
| IT Security (encryption, access controls) | $3,000 - $12,000 | $15,000 - $60,000 |
| Total First-Year Cost | $16,250 - $52,750 | $57,750 - $197,750 |
7 Common ITAR Registration Mistakes
Here's what trips people up:
- Company name mismatch. Your DDTC registration name must exactly match your SAM.gov and state incorporation records. Even minor differences (LLC vs. L.L.C.) can trigger a rejection.
- Wrong USML categories. Selecting every category "just to be safe" flags your application for enhanced review. Only select the categories that specifically apply to your current products or services.
- No Empowered Official. Some companies try to designate an outside consultant or attorney as their EO. This is not permitted — the EO must be a direct U.S. citizen employee with authority to bind the company.
- Forgetting deemed exports. Companies focus on physical exports and forget that sharing technical data with foreign national employees constitutes a deemed export requiring a license.
- Missing the renewal deadline. Registration expires after one year. If you miss the renewal window, your registration lapses and you must re-register from scratch — including paying a new registration fee and waiting through the full review cycle.
- No Technology Control Plan. While not technically required at the time of registration, DDTC expects registrants to have a TCP in place. If they audit you and you don't have one, you'll face enforcement action.
- Undisclosed foreign ownership. If your company has any foreign ownership or control — including foreign investors, board members, or parent companies — you must disclose this on the DS-2032. Failure to disclose is a separate violation with its own penalties.
Consider an ITAR Consultant
For your first registration, an experienced ITAR attorney or consultant can prevent costly mistakes and speed up the process significantly. Most charge a flat fee for registration assistance.
How to Choose a Consultant →What Happens After Registration?
Registration is just the beginning. To actually stay compliant:
Ongoing Compliance Requirements
- Annual renewal: Renew your registration before it expires each year. Set a calendar reminder for 90 days before expiration.
- Amendment notifications: Report changes to officers, addresses, or USML categories within 5 business days.
- Screening updates: Run denied party screenings on all employees and business partners regularly — at minimum quarterly.
- Record keeping: Maintain all export and compliance records for 5 years minimum.
- Voluntary disclosures: If you discover a potential violation, file a voluntary disclosure with DDTC promptly. Self-disclosure is a significant mitigating factor in enforcement actions.
- Training refresher: Conduct annual ITAR compliance training for all employees who handle controlled items or data.
Export License Applications
Once registered, you can apply for export licenses through DDTC's online system. Each license application requires specific details about the end-user, end-use, and the articles being exported. Processing times vary from 2 weeks to 6+ months depending on the destination country and items involved.
ITAR Registration vs. CMMC Certification
Defense contractors often need both ITAR registration and CMMC certification, but they serve different purposes:
| Aspect | ITAR Registration | CMMC Certification |
|---|---|---|
| Regulator | State Department (DDTC) | Department of Defense (DoD) |
| Purpose | Export control of defense articles | Protection of Controlled Unclassified Information (CUI) |
| Who needs it | Manufacturers/exporters of USML items | DoD contractors handling CUI |
| Assessment | Self-registration (government review) | Third-party assessment (C3PAO) |
| Cost | $2,250-$2,750/year (registration only) | $20,000-$100,000+ (assessment + remediation) |
| Renewal | Annual | Every 3 years |
| Timeline | 4-8 weeks | 6-18 months |
If you're a defense contractor who both manufactures USML items and handles CUI under DoD contracts, you'll need both. The good news: many of the cybersecurity controls required for CMMC (especially around access control and data protection) overlap with ITAR's technical data protection requirements. Learn more about CMMC compliance →
ITAR Training Requirements
DDTC doesn't prescribe training, but auditors expect you to have one. Minimum topics:
- ITAR basics: What ITAR is, what the USML covers, and why it matters
- Deemed exports: How sharing technical data with foreign nationals constitutes an export
- Classification: How to identify ITAR-controlled items and technical data in your workplace
- Reporting obligations: When and how to report potential violations
- Penalties: Civil and criminal consequences of non-compliance
- Company-specific procedures: Your Technology Control Plan, screening procedures, and escalation contacts
Training should be conducted at onboarding and refreshed annually. Keep records of who was trained, when, and what was covered — you'll need these for audit purposes.
Frequently Asked Questions
How long does ITAR registration take?
The typical timeline is 4-8 weeks from submission to approval. Simple applications (small companies, domestic manufacturing only) tend to be on the faster end. Applications involving foreign ownership, multiple USML categories, or prior violations take longer.
Can I export while my registration is pending?
No. You cannot apply for export licenses or engage in any controlled export activity until your registration is approved. Plan accordingly — if you have an upcoming contract requiring exports, start the registration process well in advance.
Do I need ITAR registration for EAR-controlled items?
No. EAR (Export Administration Regulations) items are administered by the Bureau of Industry and Security (BIS), not DDTC. If your items are classified under the Commerce Control List (CCL) rather than the USML, you don't need DDTC registration — but you may need BIS licenses for certain exports.
What happens if I let my registration lapse?
If your registration expires, you cannot legally engage in any activity that requires registration. You'll need to submit a new registration application and wait through the full review cycle. During the lapse, any ongoing export licenses become invalid. Set multiple reminders well before your renewal date.
Can a sole proprietor get ITAR registered?
Yes, but the sole proprietor must be a U.S. citizen and must serve as the Empowered Official. The same requirements apply — you need a UEI number, a Technology Control Plan, and the registration fee.
Is ITAR registration public?
DDTC does not publish a public list of registered companies. However, your registration status may be shared with other government agencies and can be verified by potential business partners or prime contractors through DDTC directly.