--- title: "ITAR Compliance Guide for CNC Machine Shops: What Registration Requires, What OEM Buyers Should Verify, and How Small Shops Actually Do It (2026)" description: "A practical ITAR compliance guide written by an ITAR-registered CNC machine shop (CAGE 9V9P0). Covers DDTC registration, the 5 operational controls, common myths, OEM supplier due diligence, and a 32-point downloadable qualification checklist." lang: en json-ld: | [ { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://www.olympusmachining.com/#organization", "name": "Olympus Machining LLC", "url": "https://www.olympusmachining.com", "logo": "https://storage.googleapis.com/gpt-engineer-file-uploads/SFKHg3gA6NVscESUCStAZeugW5B3/social-images/social-1762640845290-Olympus-Machining-Gear-Logo_Logo-ONLY.png", "description": "Olympus Machining LLC is a precision CNC machining shop located in Hanover, Pennsylvania, providing CNC milling and CNC turning services for OEMs and manufacturers nationwide.", "telephone": "+17176345094", "email": "info@olympusmachining.com", "address": { "@type": "PostalAddress", "streetAddress": "639 Frederick St, Suite 1", "addressLocality": "Hanover", "addressRegion": "PA", "postalCode": "17331", "addressCountry": "US" }, "sameAs": [ "https://www.google.com/maps/place/Olympus+Machining+LLC" ], "hasCredential": [ { "@type": "EducationalOccupationalCredential", "name": "ITAR Registration — DDTC", "credentialCategory": "Government Registration", "recognizedBy": { "@type": "Organization", "name": "U.S. Directorate of Defense Trade Controls (DDTC)" } }, { "@type": "EducationalOccupationalCredential", "name": "CMMC Level 1 Compliance", "credentialCategory": "Compliance Certification" } ] }, { "@type": [ "LocalBusiness", "ManufacturingBusiness" ], "@id": "https://www.olympusmachining.com/#localbusiness", "name": "Olympus Machining LLC", "image": "https://storage.googleapis.com/gpt-engineer-file-uploads/SFKHg3gA6NVscESUCStAZeugW5B3/social-images/social-1762640845290-Olympus-Machining-Gear-Logo_Logo-ONLY.png", "description": "Olympus Machining LLC is a precision CNC machining shop located in Hanover, Pennsylvania. We provide CNC milling, CNC turning, and prototype-to-production machining services for OEMs and manufacturers nationwide.", "address": { "@type": "PostalAddress", "streetAddress": "639 Frederick St, Suite 1", "addressLocality": "Hanover", "addressRegion": "PA", "postalCode": "17331", "addressCountry": "US" }, "telephone": "+17176345094", "email": "info@olympusmachining.com", "url": "https://www.olympusmachining.com", "priceRange": "$$", "areaServed": "United States", "aggregateRating": { "@type": "AggregateRating", "ratingValue": "5.0", "reviewCount": "15", "bestRating": "5", "worstRating": "1" }, "review": [ { "@type": "Review", "author": { "@type": "Person", "name": "Michael R." }, "reviewRating": { "@type": "Rating", "ratingValue": "5", "bestRating": "5" }, "reviewBody": "Olympus Machining delivered precise aluminum components for our robotics end-of-arm tooling on time and at a fair price." }, { "@type": "Review", "author": { "@type": "Person", "name": "Sarah T." }, "reviewRating": { "@type": "Rating", "ratingValue": "5", "bestRating": "5" }, "reviewBody": "We needed ITAR-compliant machining for defense hardware and Olympus Machining handled it professionally." }, { "@type": "Review", "author": { "@type": "Person", "name": "Dave K." }, "reviewRating": { "@type": "Rating", "ratingValue": "5", "bestRating": "5" }, "reviewBody": "Great CNC shop for prototype work. They provided DFM feedback that saved us time and cost." } ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Olympus Machining CNC Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "@id": "https://www.olympusmachining.com/cnc-milling#service", "name": "CNC Milling Services", "url": "https://www.olympusmachining.com/cnc-milling", "provider": { "@id": "https://www.olympusmachining.com/#organization" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "@id": "https://www.olympusmachining.com/cnc-turning#service", "name": "CNC Turning Services", "url": "https://www.olympusmachining.com/cnc-turning", "provider": { "@id": "https://www.olympusmachining.com/#organization" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "@id": "https://www.olympusmachining.com/prototype-to-production#service", "name": "Prototype to Production Machining", "url": "https://www.olympusmachining.com/prototype-to-production", "provider": { "@id": "https://www.olympusmachining.com/#organization" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "ITAR Registered CNC Machining", "provider": { "@id": "https://www.olympusmachining.com/#organization" } } } ] } } ] }, { "@context": "https://schema.org", "@graph": [ { "@type": [ "LocalBusiness", "ManufacturingBusiness" ], "@id": "https://www.olympusmachining.com/#organization", "name": "Olympus Machining LLC", "alternateName": "Olympus Machining", "url": "https://www.olympusmachining.com", "logo": { "@type": "ImageObject", "url": "https://www.olympusmachining.com/images/olympus-logo.png", "width": 300, "height": 100 }, "image": "https://www.olympusmachining.com/images/olympus-machining-headquarters-hanover-pa.jpg", "description": "Olympus Machining LLC is a U.S.-based precision CNC machining shop in Hanover, Pennsylvania, providing CNC milling, CNC turning, and prototype-to-production machining services for OEMs and manufacturers nationwide.", "telephone": "+1-717-634-5094", "email": "info@olympusmachining.com", "address": { "@type": "PostalAddress", "streetAddress": "639 Frederick St, Suite 1", "addressLocality": "Hanover", "addressRegion": "PA", "postalCode": "17331", "addressCountry": "US" }, "geo": { "@type": "GeoCoordinates", "latitude": 39.8007, "longitude": -76.9836 }, "areaServed": { "@type": "Country", "name": "United States" }, "priceRange": "$$", "sameAs": [ "https://www.google.com/search?sca_esv=2f4ed381b998a4d8&sxsrf=AE3TifODgJgBq4b1RAZEZnaHSJwX6ZOvSg:1767447357236&kgmid=/g/11kr8nzb2c&q=Olympus+Machining+LLC&shndl=30&shem=ptotplc,shrtsdl&source=sh/x/loc/uni/m1/1&kgs=100779a69d016c62&utm_source=ptotplc,shrtsdl,sh/x/loc/uni/m1/1", "https://www.instagram.com/olympusmachining/" ], "knowsAbout": [ "CNC Milling", "CNC Turning", "Precision CNC Machining", "Prototype Machining", "Short-Run Production", "Robotics Machining", "Quality Assurance", "First Article Inspection", "ITAR Compliance" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "CNC Machining Services", "itemListElement": [ { "@type": "OfferCatalog", "name": "CNC Milling Services", "url": "https://www.olympusmachining.com/cnc-milling" }, { "@type": "OfferCatalog", "name": "CNC Turning Services", "url": "https://www.olympusmachining.com/cnc-turning" }, { "@type": "OfferCatalog", "name": "Precision CNC Machining", "url": "https://www.olympusmachining.com/precision-cnc-machining" }, { "@type": "OfferCatalog", "name": "Prototype to Production", "url": "https://www.olympusmachining.com/prototype-to-production" }, { "@type": "OfferCatalog", "name": "Robotics & Automation Machining", "url": "https://www.olympusmachining.com/robotics-automation-machining" } ] } }, { "@type": "WebSite", "@id": "https://www.olympusmachining.com/#website", "name": "Olympus Machining", "url": "https://www.olympusmachining.com", "publisher": { "@id": "https://www.olympusmachining.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": "https://www.olympusmachining.com/?s={search_term_string}", "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://www.olympusmachining.com/resources/itar-compliance-guide-for-cnc-machine-shops#webpage", "name": "ITAR Compliance Guide for CNC Machine Shops: What Registration Requires, What OEM Buyers Should Verify, and How Small Shops Actually Do It (2026)", "description": "A practical ITAR compliance guide written by an ITAR-registered CNC machine shop (CAGE 9V9P0). Covers DDTC registration, the 5 operational controls, common myths, OEM supplier due diligence, and a 32-point downloadable qualification checklist.", "url": "https://www.olympusmachining.com/resources/itar-compliance-guide-for-cnc-machine-shops", "isPartOf": { "@id": "https://www.olympusmachining.com/#website" }, "about": { "@id": "https://www.olympusmachining.com/#organization" }, "inLanguage": "en-US" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://www.olympusmachining.com" }, { "@type": "ListItem", "position": 2, "name": "Resources", "item": "https://www.olympusmachining.com/resources/itar-compliance-guide-for-cnc-machine-shops" }, { "@type": "ListItem", "position": 3, "name": "ITAR Compliance Guide for CNC Machine Shops", "item": "https://www.olympusmachining.com/resources/itar-compliance-guide-for-cnc-machine-shops" } ] }, { "@type": "BlogPosting", "@id": "https://www.olympusmachining.com/resources/itar-compliance-guide-for-cnc-machine-shops#article", "headline": "ITAR Compliance Guide for CNC Machine Shops", "description": "A practical ITAR compliance guide written by an ITAR-registered CNC machine shop (CAGE 9V9P0). Covers DDTC registration, the 5 operational controls, common myths, OEM supplier due diligence, and a 32-point downloadable qualification checklist.", "url": "https://www.olympusmachining.com/resources/itar-compliance-guide-for-cnc-machine-shops", "datePublished": "2026-09-15", "dateModified": "2026-09-15", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.olympusmachining.com/resources/itar-compliance-guide-for-cnc-machine-shops" }, "author": { "@type": "Organization", "@id": "https://www.olympusmachining.com/#organization", "name": "Olympus Machining", "url": "https://www.olympusmachining.com" }, "publisher": { "@type": "Organization", "@id": "https://www.olympusmachining.com/#organization", "name": "Olympus Machining", "url": "https://www.olympusmachining.com", "logo": { "@type": "ImageObject", "url": "https://www.olympusmachining.com/images/olympus-logo.png", "width": 300, "height": 100 } }, "isPartOf": { "@id": "https://www.olympusmachining.com/#website" }, "inLanguage": "en-US", "keywords": "ITAR compliance, ITAR registered CNC machine shop, DDTC registration, ITAR technical data, US Person verification, CMMC Level 2, defense supplier qualification, export control CNC machining" }, { "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is ITAR compliance for a CNC machine shop?", "acceptedAnswer": { "@type": "Answer", "text": "ITAR compliance for a CNC machine shop means operating in accordance with the International Traffic in Arms Regulations (22 CFR Parts 120-130) when manufacturing defense articles or handling technical data related to defense articles. For a job-shop-scale CNC operation, this typically requires: registration with the U.S. Directorate of Defense Trade Controls (DDTC), documented U.S. Person verification for employees with access to controlled data, access controls on drawings and models, U.S.-hosted data storage, physical access controls at the shop, and retention of records for a minimum of 5 years per 22 CFR 122.5(a)." } }, { "@type": "Question", "name": "What is the difference between \"ITAR-compliant\" and \"ITAR-registered\"?", "acceptedAnswer": { "@type": "Answer", "text": "\"ITAR-registered\" means the company has filed a DS-2032 statement of registration with DDTC, paid the annual registration fee, and holds a valid DDTC registration code. It is a legally defined status. \"ITAR-compliant\" has no regulatory definition — different suppliers use it to mean different things. OEM buyers should ask for the DDTC registration code as proof of ITAR-registered status; \"ITAR-compliant\" without a registration code is not equivalent." } }, { "@type": "Question", "name": "How much does ITAR registration cost for a small CNC shop?", "acceptedAnswer": { "@type": "Answer", "text": "DDTC registration fees are tiered. The entry tier is approximately $2,250 per year (2026) and applies to registrants with limited licensing activity in the prior year. Higher tiers scale with the number of DDTC applications submitted. In addition to the direct fee, shops should budget for the internal cost of implementing and maintaining the operational controls — access-controlled data storage, personnel documentation procedures, physical access hardware, and annual renewal filings." } }, { "@type": "Question", "name": "How long does ITAR registration take?", "acceptedAnswer": { "@type": "Answer", "text": "DDTC registration approval typically takes 4-8 weeks after submission of the DS-2032 form through the DECCS portal, though timelines vary based on DDTC workload and completeness of the submission. Renewals are annual and are generally faster once initial registration is on file." } }, { "@type": "Question", "name": "Who needs to be ITAR-registered?", "acceptedAnswer": { "@type": "Answer", "text": "Any U.S. person engaged in the business of manufacturing or exporting defense articles or furnishing defense services must be registered with DDTC per 22 CFR 122.1. For a CNC machine shop, this practically means shops that produce parts appearing on the United States Munitions List, including components for military aircraft, weapons systems, targeting equipment, defense-specific electronics enclosures, ground vehicle armament, and similar hardware." } }, { "@type": "Question", "name": "What is a U.S. Person under ITAR?", "acceptedAnswer": { "@type": "Answer", "text": "Under 22 CFR 120.62, a U.S. Person is a U.S. citizen, a lawful permanent resident of the United States (green card holder), a protected individual under the Immigration and Naturalization Act, or a U.S. corporation, business association, partnership, or other entity organized under U.S. law. ITAR-registered shops must maintain documented proof of U.S. Person status for every employee, contractor, or visitor with access to ITAR-controlled technical data." } }, { "@type": "Question", "name": "Can a foreign national work in an ITAR-registered CNC shop?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, but with restrictions. A foreign national may work in general shop areas that do not involve access to ITAR-controlled technical data or controlled defense articles. To grant a foreign national access to controlled technical data, the shop must obtain a DDTC-authorized license (typically a Technical Assistance Agreement or Manufacturing License Agreement) covering the specific access. Most small CNC shops choose to structure work so that non-U.S. Persons are not assigned to ITAR jobs." } }, { "@type": "Question", "name": "What is technical data under ITAR?", "acceptedAnswer": { "@type": "Answer", "text": "Under 22 CFR 120.33, ITAR technical data is any information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of a defense article. In a CNC shop context, this includes 2D engineering drawings, 3D solid models (STEP, IGES, native CAD), manufacturing specifications, CNC programs, process sheets, test and inspection procedures, and software directly related to defense articles." } }, { "@type": "Question", "name": "How does ITAR relate to CMMC and NIST 800-171?", "acceptedAnswer": { "@type": "Answer", "text": "ITAR is an export-control framework (State Department). CMMC and NIST 800-171 are cybersecurity frameworks (Defense Department). They overlap because ITAR-controlled technical data is generally a subset of Controlled Unclassified Information (CUI), which is what CMMC Level 2 protects. A supplier handling ITAR technical data typically needs CMMC Level 2 alignment at minimum. CMMC Level 1 (15 FAR 52.204-21 safeguards) is the entry point for Federal Contract Information. ITAR registration and CMMC alignment are complementary — one covers what data leaves the country, the other covers how the data is protected in transit and at rest." } }, { "@type": "Question", "name": "Is ITAR registration enough to bid on defense contracts?", "acceptedAnswer": { "@type": "Answer", "text": "No. ITAR registration is one of several qualifications typically required. Defense contract awards also generally require a valid CAGE Code, SAM.gov registration, appropriate NAICS code assignment, CMMC posture aligned with the contract's cybersecurity requirements, and often prime-contractor-specific supplier qualifications (approved supplier list membership, quality system certifications like AS9100D for aerospace work, first article inspection capability, and specific process approvals for special processes like heat treat, plating, or NDT)." } }, { "@type": "Question", "name": "What are the penalties for an ITAR violation?", "acceptedAnswer": { "@type": "Answer", "text": "ITAR violations can be prosecuted civilly or criminally. Civil penalties currently reach approximately $1.2 million per violation. Criminal penalties for willful violations can reach $1 million per violation and up to 20 years imprisonment. Common violations include unauthorized export of technical data (including allowing a non-U.S. Person to view a controlled drawing), unregistered manufacturing of defense articles, and failure to file required license applications for exports or defense services." } }, { "@type": "Question", "name": "Is Olympus Machining ITAR-registered?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Olympus Machining LLC is registered with the U.S. Directorate of Defense Trade Controls (DDTC) under 22 CFR Part 122 and operates from 639 Frederick St, Suite 1, Hanover, PA 17331 (CAGE Code 9V9P0). All ITAR-controlled work is performed at this U.S. address by U.S. Person employees, with drawings and models stored on U.S.-hosted systems. Registration codes and Empowered Official contact information are available to qualified OEM procurement teams on request." } } ] } ] } ] --- [Home](/) [CNC Milling](/cnc-milling) [CNC Turning](/cnc-turning) [Quality Assurance](/quality-assurance) [CNC Machining Capabilities](/capabilities) [CNC Machining Services](/cnc-machining) [Quality Program](/quality) [Contact Olympus Machining](/contact) [Prototype to Production](/prototype-to-production) [Industries Served](/industries-served) [Materials Machined](/materials-machined) [Robotics & Automation Machining](/robotics-automation-machining) [Precision CNC Machining](/precision-cnc-machining) [Compliance & Cybersecurity](/compliance) [Privacy Policy](/privacy-policy) [Blog](/blog) [Sitemap](/sitemap) [Pennsylvania CNC Machining](/areas-served/pennsylvania-cnc-machining) [Maryland CNC Machining](/areas-served/maryland-cnc-machining) [Virginia CNC Machining](/areas-served/virginia-cnc-machining) [Delaware CNC Machining](/areas-served/delaware-cnc-machining) [New Jersey CNC Machining](/areas-served/new-jersey-cnc-machining) [New York CNC Machining](/areas-served/new-york-cnc-machining) [Ohio CNC Machining](/areas-served/ohio-cnc-machining) [West Virginia CNC Machining](/areas-served/west-virginia-cnc-machining) [Washington DC CNC Machining](/areas-served/washington-dc-cnc-machining) [North Carolina CNC Machining](/areas-served/north-carolina-cnc-machining) [Aerospace Machining Tolerances Explained](/blog/aerospace-machining-tolerances-explained) [Titanium CNC Machining for Aerospace](/blog/titanium-cnc-machining-aerospace) [Aerospace CNC Machine Shop Near DC/MD](/blog/aerospace-cnc-machine-shop-near-washington-dc-maryland) [Cutting-Edge CNC Shop for Aerospace](/blog/cutting-edge-cnc-machine-shop-aerospace-industry) [Best CNC Machine Shop in Hanover, PA](/blog/best-cnc-machine-shop-hanover-pa) [QMS: Precision, Traceability, Process Control](/blog/quality-management-system-qms-precision-traceability-process-control) [Vet a CNC Shop in Pennsylvania](/blog/vet-cnc-machine-shop-pennsylvania-aerospace-defense-robotics) [CNC Shops in Rural America: Hanover, PA](/blog/cnc-machine-shop-rural-america-hanover-pa) [Aerospace CNC Machining in Pennsylvania](/blog/aerospace-cnc-machining-pennsylvania) [CNC Prototyping in PA](/blog/cnc-prototyping-pa) [CNC Machining in Pennsylvania](/blog/cnc-machining-pennsylvania) [Choosing CNC Machining Vendors](/blog/choosing-machining-vendors-cnc-machining-shop) [CNC Machining for Robotics — Guide](/blog/cnc-machining-for-robotics-automation-guide) [CNC Machining Parts for Robotics](/blog/cnc-machining-for-robotics-automation) [Prototype-to-Production CNC Machining](/blog/prototype-to-production-cnc-machining) [How OEMs Evaluate CNC Machine Shops](/blog/how-oems-evaluate-cnc-machine-shops) [CMM Inspection at Olympus Machining](/blog/cmm-inspection-enhances-quality-and-repeatability-at-olympus-machining) [ITAR & CMMC Level 1 in Precision CNC Machining](/blog/itar-cmmc-level-1-precision-cnc-machining) [Precision CNC Machining in Hanover, PA](/blog/precision-cnc-machining-hanover-pa) [AS9102 First Article Inspection Checklist](/blog/as9102-first-article-inspection-checklist) [AS9102 First Article Inspection](/as9102-first-article-inspection) [AS9102 FAI vs PFAI](/as9102-fai-vs-pfai) [AS9102 Balloon Drawings](/as9102-balloon-drawings) [CMM Inspection Services](/cmm-inspection-services) [Medical-Grade Alloys](/materials/medical-grade-alloys) [CMMC Level 1 Compliance](/compliance/cmmc-level-1) [Olympus vs Xometry](/comparison/olympus-vs-xometry) [Olympus vs Protolabs](/comparison/olympus-vs-protolabs) [Direct Shop vs Marketplace](/comparison/direct-shop-vs-marketplace) [Aerospace & Defense Machining](/industries/aerospace-defense) [Medical Device Machining](/industries/medical-devices) [Firearms & Suppressor Machining](/industries/firearms-suppressors) [Energy & Oil/Gas Machining](/industries/energy-oil-gas) [Philadelphia CNC Machining](/areas-served/philadelphia-cnc-machining) [Pittsburgh CNC Machining](/areas-served/pittsburgh-cnc-machining) [Baltimore CNC Machining](/areas-served/baltimore-cnc-machining) [Titanium CNC Machining](/materials/titanium-cnc-machining) [PEEK CNC Machining](/materials/peek-cnc-machining) [Inconel CNC Machining Guide](/materials/inconel-cnc-machining-guide) ![Olympus Machining LLC logo — precision CNC machining shop in Hanover, Pennsylvania](/assets/olympus-logo-DbWcTX06.webp) HomeAboutServices[Blog](/blog)Contact[Careers](/careers)[(717) 634-5094 ](tel:+17176345094)[Login](/auth)Get Quote [Back to Home](/) ITAR & Export Controls # ITAR Compliance for CNC Machine Shops What registration actually requires, what OEM buyers should verify, and how small precision shops handle export-controlled work — written from inside an ITAR-registered CNC shop. By Olympus Machining · Published September 15, 2026 · 12 min read [Download the 32-point ITAR Supplier Qualification Checklist (PDF)](/downloads/itar-supplier-qualification-checklist.pdf) [Call (717) 634-5094](tel:+17176345094) Last reviewed: May 12, 2026 ## On This Page 1. [What ITAR actually regulates](#what-itar-regulates) 2. ["ITAR-compliant" vs "ITAR-registered" — the distinction that matters](#compliant-vs-registered) 3. [How DDTC registration works](#ddtc-registration) 4. [The 5 operational controls every ITAR-registered shop maintains](#operational-controls) 5. [Technical data — what qualifies and how it's handled](#technical-data) 6. [Common ITAR myths in the CNC world](#itar-myths) 7. [How ITAR interacts with CMMC and NIST 800-171](#itar-cmmc-nist) 8. [OEM due diligence — what buyers should verify](#oem-due-diligence) 9. [The 32-point supplier qualification checklist](#checklist) 10. [Olympus Machining's ITAR posture](#olympus-posture) 11. [Frequently asked questions](#faq) ## What ITAR Actually Regulates The International Traffic in Arms Regulations (ITAR) is administered by the U.S. State Department's Directorate of Defense Trade Controls (DDTC), codified at 22 CFR Parts 120-130. ITAR controls the export and re-export of defense articles, defense services, and related technical data listed on the United States Munitions List (USML). For a CNC machine shop, this practically means three things: - **Defense articles** — physical hardware, components, and assemblies designed, developed, or modified for military application. If a customer's drawing shows a part that ends up in a weapon system, a targeting pod, a military aircraft structure, a ground vehicle armament mount, or a defense-specific radar or electronics enclosure, that part is a defense article under ITAR. - **Technical data** — the drawings, models, specifications, and manufacturing know-how required to produce a defense article. A STEP file for a missile fin, a PDF drawing of a rifle bolt carrier, or a native CAD model of an armored vehicle mounting bracket is technical data. Emailing that file, uploading it to an offshore cloud service, or letting a non-U.S. Person view it counts as an ITAR-controlled event. - **Defense services** — furnishing assistance (including training) to a foreign person in the design, engineering, development, production, assembly, testing, or repair of a defense article. Most CNC shops don't offer defense services, but the definition matters when a shop provides engineering support or reverse engineering to an overseas customer. ITAR is not the same as EAR (Export Administration Regulations, administered by the Commerce Department). EAR covers dual-use items — commercial products with potential military applications. Many CNC shops handle both ITAR-controlled work and EAR-controlled work depending on the customer and end-use. ## "ITAR-Compliant" vs "ITAR-Registered" — The Distinction That Matters This is the single most misunderstood term in defense manufacturing. They are not the same, and OEM procurement teams should reject any supplier that uses "ITAR-compliant" as if it were a substitute for "ITAR-registered." **ITAR-registered** means the shop has filed a DS-2032 registration statement with DDTC, paid the annual registration fee (currently $2,250 for the entry tier), received a registration code, and appears in the DDTC registrant database. This is a required legal status for any U.S. person engaged in the business of manufacturing or exporting defense articles per 22 CFR 122.1. **ITAR-compliant** has no regulatory definition. Some suppliers use it to mean "we understand ITAR and follow the rules internally." Others use it to mean "we have an internal SOP." A few use it to mean nothing at all. A U.S. manufacturer that produces defense articles for U.S. customers is generally required to be registered — even if no export ever occurs — because 22 CFR 122.1 applies to those "engaged in the business" of manufacturing defense articles, not just to those who export them. There is a narrow set of exemptions, but for a job-shop-scale CNC operation working on ITAR-controlled parts, the safe posture is registration. Olympus Machining LLC is ITAR-registered with DDTC. Any supplier that describes themselves only as "ITAR-compliant" should be asked to produce their DDTC registration code before controlled work is placed with them. ## How DDTC Registration Works 1. **Prepare the DS-2032 statement of registration.** This is a public form covering business information, ownership, senior officers, and the categories of defense articles the applicant intends to manufacture or export. 2. **Designate an Empowered Official.** A U.S. citizen or U.S. permanent resident with legal authority to bind the company on export matters must be named on the registration. In small shops, this is typically the owner or a senior officer. 3. **Pay the registration fee.** Fees are tiered — the entry tier (~$2,250/year in 2026) applies to registrants with limited licensing activity. Higher tiers scale with the number of DDTC applications submitted in the prior year. 4. **Submit through DECCS.** DDTC's Defense Export Control and Compliance System (DECCS) is the online portal for registration submission, license applications, and annual renewals. 5. **Wait for a registration code.** Approval typically takes 4-8 weeks. Once issued, the code is what OEM buyers should ask for as proof of registration. 6. **Renew annually.** Registration must be renewed each year. A lapsed registration is grounds to reject a supplier on defense contracts. The registration itself is not a license to export. Actual exports require separate license authorizations — DSP-5 for permanent exports of hardware, DSP-73 for temporary exports, TAA (Technical Assistance Agreement) and MLA (Manufacturing License Agreement) for defense services and manufacturing arrangements with foreign parties. ## The 5 Operational Controls Every ITAR-Registered Shop Maintains Registration is the paperwork. Compliance is the operations. A shop that is registered but does not have the following controls in place is on borrowed time. 1. **U.S. Person verification.** Every employee, contractor, and visitor with access to controlled technical data has documented proof of U.S. Person status under 22 CFR 120.62 — U.S. citizen, U.S. permanent resident (green card holder), or protected individual under the Immigration and Naturalization Act. Documentation is retained in a controlled personnel file. 2. **Access control by role.** Not every employee has access to every drawing. Controlled drawings are stored in access-controlled folders, not on shared drives. Machine setup packets are handed to operators and returned or destroyed at end of run. 3. **Data handling procedure.** Digital technical data — drawings, models, inspection reports, manufacturing programs — lives on U.S.-hosted systems with encryption at rest and in transit. No offshore cloud regions, no consumer file-sharing services for controlled data. 4. **Physical access control.** Doors are locked, badges or keys restrict entry, visitors are logged and escorted. Controlled work is not visible from public-facing areas. 5. **Recordkeeping.** Registration renewals, employee U.S. Person documentation, export licenses (where applicable), TAA/MLA agreements, and shipping records for controlled hardware are retained for a minimum of 5 years per 22 CFR 122.5(a). These are the same five areas an OEM due-diligence audit will examine. A shop that can produce documentation for all five passes the check. ## Technical Data — What Qualifies and How It's Handled ITAR technical data is any information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of a defense article. Under 22 CFR 120.33, this includes: - Engineering drawings and models — 2D drawings (PDF, DWG), 3D solid models (STEP, IGES, native SolidWorks, native CATIA, native NX) - Manufacturing specifications, process sheets, and CNC programs - Test and inspection procedures - Software directly related to defense articles ### How Olympus Machining handles technical data - Received via encrypted, U.S.-hosted transfer (customer secure portal or ITAR-cleared email) - Stored on a U.S.-hosted server with role-based access - Never uploaded to consumer cloud services (WeTransfer, personal Dropbox, personal Google Drive) - CAM/CAD workstations are not accessible to non-U.S. Persons - Printed drawings are logged out to the machinist and shredded when the job closes - Files are retained per contract terms with a floor of 5 years If your OEM has a specific data handling requirement (customer secure portal, specific encryption standard, air-gapped workstation), it's routed through the corresponding procedure. ## Common ITAR Myths in the CNC World - **"We don't export, so ITAR doesn't apply to us."** False. Manufacturing defense articles for a U.S. customer still requires DDTC registration under 22 CFR 122.1 for those engaged in the business of manufacturing defense articles. - **"ITAR-compliant is the same as ITAR-registered."** False. See the section above. - **"A no-fly list is enough to prove someone is a U.S. Person."** False. U.S. Person status requires citizenship, permanent residency (green card), or protected individual status. Documented proof is retained on file. - **"We can send the STEP file to our overseas partner shop for the deburring."** False. That's an export of technical data. It requires a license (DSP-5 or a TAA/MLA covering the transfer). - **"Encrypting the email is enough."** Encryption is necessary but not sufficient. Where the data lives, who administers the servers, and who has access to decryption keys all matter. U.S.-hosted, U.S.-administered systems remain the safe posture. - **"CMMC covers everything ITAR requires."** False. They overlap but are different frameworks. ## How ITAR Interacts with CMMC and NIST 800-171 CMMC (Cybersecurity Maturity Model Certification) is a Department of Defense cybersecurity framework built on top of NIST 800-171. ITAR is an export-control framework built on top of 22 CFR Parts 120-130. They overlap because ITAR-controlled technical data is a subset of Controlled Unclassified Information (CUI). If you handle CUI, CMMC applies. If your CUI includes ITAR technical data, both frameworks apply. ### Practical posture for a small CNC shop - **CMMC Level 1** (15 FAR 52.204-21 safeguards) is the entry point. It covers Federal Contract Information (FCI). Self-attestation is the current path. - **CMMC Level 2** (110 NIST 800-171 practices) applies when handling CUI, which includes most ITAR technical data. Third-party assessment is required in most cases under the DoD's phased rollout. Olympus Machining is CMMC Level 1 aligned per FAR 52.204-21 and on the roadmap to Level 2. The Level 1 posture combined with ITAR registration is a legitimate starting position for a small precision shop, and the Level 2 path is what OEMs handling active CUI programs will expect. See our [CMMC Level 1 to Level 2 roadmap](/resources/cmmc-level-1-to-level-2-roadmap) for the step-by-step path. ## OEM Due Diligence — What Buyers Should Verify Procurement teams choosing an ITAR-registered CNC supplier should verify: 1. Ask for the **DDTC registration code** and confirm it in the DDTC registrant database 2. Confirm the **CAGE Code** in SAM.gov and that the registered address matches the physical shop 3. Ask for the **name and contact of the Empowered Official** 4. Confirm the **U.S. Person verification procedure** is documented 5. Confirm the **data handling procedure** for received drawings and models 6. Confirm **physical access controls** at the shop 7. Confirm **records retention** aligns with 22 CFR 122.5(a) 8. Confirm **CMMC posture** — Level 1 minimum, Level 2 pathway for CUI programs The next section is a full 32-point checklist covering all of this. It's downloadable as a PDF. ## The 32-Point Supplier Qualification Checklist ### Download the ITAR Supplier Qualification Checklist (PDF) All 32 checkpoints grouped into seven sections, formatted for your incoming supplier qualification file. No sign-up required. [Download Free Checklist (PDF)](/downloads/itar-supplier-qualification-checklist.pdf) ### 1\. Registration & Legal Standing - **1.** Supplier is registered with the U.S. Directorate of Defense Trade Controls (DDTC) under 22 CFR Part 122. Ask for the DDTC registration code and expiration date. - **2.** Supplier has a valid CAGE Code in the SAM.gov registry. Verify the code is active, not expired or 'expired-not-renewed'. - **3.** Supplier's business address in DDTC records matches the physical shop address where controlled work is performed. Watch for suppliers who list a corporate HQ but manufacture elsewhere. - **4.** Registration category is appropriate — Manufacturer, Exporter, or Broker — for the work being placed. Most CNC job shops should be registered as Manufacturers. - **5.** Supplier has no active DDTC enforcement actions, consent agreements, or debarments. Check the DDTC Consent Agreements and Debarments list. ### 2\. Access Controls & Personnel - **6.** Supplier has a written U.S. Person verification procedure aligned with 22 CFR 120.62. All employees with access to ITAR-controlled technical data have documented proof of U.S. Person status. - **7.** Access to controlled technical data is restricted by role. Not every employee has access to every drawing. - **8.** Foreign-national employees, contractors, and visitors are excluded from areas where ITAR-controlled work is performed, or supplier holds a valid TAA/MLA covering their access. - **9.** Building has physical access controls — locked doors, badge access, or visitor sign-in — separating ITAR work areas from public/office spaces. - **10.** IT systems that store or transmit ITAR technical data have documented U.S.-only administrator access. ### 3\. Technical Data Handling - **11.** Digital drawings, models (STEP, IGES, native CAD), and inspection reports are stored on U.S.-hosted servers or U.S. cloud regions. No offshore backup, no unrestricted cloud sync. - **12.** Email containing ITAR technical data is encrypted at rest and in transit. TLS 1.2+ minimum. FIPS 140-2 validated encryption preferred. - **13.** File transfer methods are documented and restricted — no consumer file-sharing services (WeTransfer, Dropbox personal, Google Drive personal) for ITAR data. - **14.** Printed drawings are controlled — logged out, returned or shredded, not left on machine tools overnight. - **15.** Supplier can produce a Data Handling Plan on request describing how the customer's specific technical data flows through their systems. ### 4\. Manufacturing & Supply Chain - **16.** All machining is performed at the U.S. address on the DDTC registration. No offshore subcontracting of controlled work — including no 'we send it to a partner shop for the deburring.' - **17.** Suppliers used for outside processes (heat treat, plating, anodizing, NDT) are ITAR-registered themselves or the supplier holds a valid TAA/MLA for the transfer. - **18.** Material traceability by heat/lot is maintained for every controlled part. Certificates of conformance and mill certifications are retained per contract requirements. - **19.** Rejected parts, scrap, and non-conforming material are handled per a documented procedure — including physical destruction or controlled disposal of scrap containing technical data (e.g., unique geometry). - **20.** Supplier maintains a documented counterfeit parts prevention procedure aligned with AS5553 or AS9100D 8.1.4. ### 5\. Documentation & Recordkeeping - **21.** Supplier retains ITAR technical data and shipping records for a minimum of 5 years per 22 CFR 122.5(a). - **22.** Export licenses (DSP-5, DSP-73, TAA, MLA) are retained where applicable, with clear links to the transactions they authorize. - **23.** AS9102 First Article Inspection records — Form 1, Form 2, Form 3 — are generated for controlled parts and retained per contract terms. - **24.** Every shipment of controlled hardware includes an ITAR statement on the shipping documentation, packing list, or invoice. - **25.** Supplier can produce their DDTC-registered Empowered Official's name and contact information on request. ### 6\. Cybersecurity Alignment - **26.** Supplier has attested to CMMC Level 1 (15 FAR 52.204-21 safeguards) at minimum. If handling CUI (Controlled Unclassified Information) beyond FCI, they should be on the CMMC Level 2 path. - **27.** Multi-factor authentication is enforced on all user accounts with access to ITAR technical data. - **28.** Anti-malware protection is active on all endpoints where ITAR technical data is handled. - **29.** Supplier has a documented Incident Response procedure covering suspected export violations or data breaches involving ITAR technical data. - **30.** Removable media (USB drives, external hard drives) use is either blocked or restricted to encrypted, tracked devices. ### 7\. Contract & Flow-Down - **31.** Supplier's standard PO acknowledgment or terms include acceptance of ITAR flow-down language (DFARS 252.225-7048, ITAR marking requirements, technical data control clauses). - **32.** Supplier flows down ITAR requirements to their own sub-tier suppliers (heat treaters, coaters, hardware providers) with equivalent access-control obligations. **32 checkpoints total.** A qualified ITAR supplier passes all 32. A supplier that passes fewer than 28 is a real audit risk on defense programs — request corrective action before placement. ## Olympus Machining's ITAR Posture - ITAR-registered with the U.S. Directorate of Defense Trade Controls (DDTC) under 22 CFR Part 122 - CMMC Level 1 aligned per FAR 52.204-21 - CAGE Code 9V9P0 - Physically located at 639 Frederick St, Suite 1, Hanover, PA 17331 - [AS9102 First Article Inspection](/as9102-first-article-inspection) capable in-house (Haas HMM 430 CMM) - Materials: Ti-6Al-4V, Inconel 718, 316L stainless, 4140 alloy steel, 17-4 PH, PEEK, 6061/7075 aluminum - No offshore subcontracting on controlled work Full profile and quote requests: call (717) 634-5094 or email info@olympusmachining.com. ## Frequently Asked Questions What is ITAR compliance for a CNC machine shop? ITAR compliance for a CNC machine shop means operating in accordance with the International Traffic in Arms Regulations (22 CFR Parts 120-130) when manufacturing defense articles or handling technical data related to defense articles. For a job-shop-scale CNC operation, this typically requires: registration with the U.S. Directorate of Defense Trade Controls (DDTC), documented U.S. Person verification for employees with access to controlled data, access controls on drawings and models, U.S.-hosted data storage, physical access controls at the shop, and retention of records for a minimum of 5 years per 22 CFR 122.5(a). What is the difference between "ITAR-compliant" and "ITAR-registered"? "ITAR-registered" means the company has filed a DS-2032 statement of registration with DDTC, paid the annual registration fee, and holds a valid DDTC registration code. It is a legally defined status. "ITAR-compliant" has no regulatory definition — different suppliers use it to mean different things. OEM buyers should ask for the DDTC registration code as proof of ITAR-registered status; "ITAR-compliant" without a registration code is not equivalent. How much does ITAR registration cost for a small CNC shop? DDTC registration fees are tiered. The entry tier is approximately $2,250 per year (2026) and applies to registrants with limited licensing activity in the prior year. Higher tiers scale with the number of DDTC applications submitted. In addition to the direct fee, shops should budget for the internal cost of implementing and maintaining the operational controls — access-controlled data storage, personnel documentation procedures, physical access hardware, and annual renewal filings. How long does ITAR registration take? DDTC registration approval typically takes 4-8 weeks after submission of the DS-2032 form through the DECCS portal, though timelines vary based on DDTC workload and completeness of the submission. Renewals are annual and are generally faster once initial registration is on file. Who needs to be ITAR-registered? Any U.S. person engaged in the business of manufacturing or exporting defense articles or furnishing defense services must be registered with DDTC per 22 CFR 122.1. For a CNC machine shop, this practically means shops that produce parts appearing on the United States Munitions List, including components for military aircraft, weapons systems, targeting equipment, defense-specific electronics enclosures, ground vehicle armament, and similar hardware. What is a U.S. Person under ITAR? Under 22 CFR 120.62, a U.S. Person is a U.S. citizen, a lawful permanent resident of the United States (green card holder), a protected individual under the Immigration and Naturalization Act, or a U.S. corporation, business association, partnership, or other entity organized under U.S. law. ITAR-registered shops must maintain documented proof of U.S. Person status for every employee, contractor, or visitor with access to ITAR-controlled technical data. Can a foreign national work in an ITAR-registered CNC shop? Yes, but with restrictions. A foreign national may work in general shop areas that do not involve access to ITAR-controlled technical data or controlled defense articles. To grant a foreign national access to controlled technical data, the shop must obtain a DDTC-authorized license (typically a Technical Assistance Agreement or Manufacturing License Agreement) covering the specific access. Most small CNC shops choose to structure work so that non-U.S. Persons are not assigned to ITAR jobs. What is technical data under ITAR? Under 22 CFR 120.33, ITAR technical data is any information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of a defense article. In a CNC shop context, this includes 2D engineering drawings, 3D solid models (STEP, IGES, native CAD), manufacturing specifications, CNC programs, process sheets, test and inspection procedures, and software directly related to defense articles. How does ITAR relate to CMMC and NIST 800-171? ITAR is an export-control framework (State Department). CMMC and NIST 800-171 are cybersecurity frameworks (Defense Department). They overlap because ITAR-controlled technical data is generally a subset of Controlled Unclassified Information (CUI), which is what CMMC Level 2 protects. A supplier handling ITAR technical data typically needs CMMC Level 2 alignment at minimum. CMMC Level 1 (15 FAR 52.204-21 safeguards) is the entry point for Federal Contract Information. ITAR registration and CMMC alignment are complementary — one covers what data leaves the country, the other covers how the data is protected in transit and at rest. Is ITAR registration enough to bid on defense contracts? No. ITAR registration is one of several qualifications typically required. Defense contract awards also generally require a valid CAGE Code, SAM.gov registration, appropriate NAICS code assignment, CMMC posture aligned with the contract's cybersecurity requirements, and often prime-contractor-specific supplier qualifications (approved supplier list membership, quality system certifications like AS9100D for aerospace work, first article inspection capability, and specific process approvals for special processes like heat treat, plating, or NDT). What are the penalties for an ITAR violation? ITAR violations can be prosecuted civilly or criminally. Civil penalties currently reach approximately $1.2 million per violation. Criminal penalties for willful violations can reach $1 million per violation and up to 20 years imprisonment. Common violations include unauthorized export of technical data (including allowing a non-U.S. Person to view a controlled drawing), unregistered manufacturing of defense articles, and failure to file required license applications for exports or defense services. Is Olympus Machining ITAR-registered? Yes. Olympus Machining LLC is registered with the U.S. Directorate of Defense Trade Controls (DDTC) under 22 CFR Part 122 and operates from 639 Frederick St, Suite 1, Hanover, PA 17331 (CAGE Code 9V9P0). All ITAR-controlled work is performed at this U.S. address by U.S. Person employees, with drawings and models stored on U.S.-hosted systems. Registration codes and Empowered Official contact information are available to qualified OEM procurement teams on request. ## Related Reading [ ### CMMC Level 1 to Level 2 Roadmap The cybersecurity path OEMs expect for CUI programs. ](/resources/cmmc-level-1-to-level-2-roadmap)[ ### AS9100D Certification for Small CNC Shops What aerospace quality certification actually requires. ](/resources/as9100d-for-small-cnc-shops)[ ### CMM Inspection Report Checklist How to read and verify a coordinate measuring machine report. ](/resources/cmm-inspection-report-checklist)[ ### AS9102 First Article Inspection Forms 1, 2, and 3 produced in-house on our Haas HMM 430 CMM. ](/as9102-first-article-inspection) [Request a Quote](/#contact) [Call (717) 634-5094](tel:+17176345094) [CNC Milling](/cnc-milling)| [CNC Turning](/cnc-turning)| [Quality Assurance](/quality-assurance)| [Prototype to Production](/prototype-to-production)| [Industries Served](/industries-served)| [Materials Machined](/materials-machined)| [Robotics & Automation Machining](/robotics-automation-machining)| [Precision CNC Machining](/precision-cnc-machining)| [Careers](/careers)| [ITAR CNC Machining for Mid-Atlantic Aerospace OEMs](/itar-cnc-machining-mid-atlantic-aerospace) [CNC Tolerances & GD&T Guide](/resources/cnc-machining-tolerances-gdt-guide)| [Reducing CNC Machining Costs](/resources/reducing-cnc-machining-costs)| [6061 vs 7075 Aluminum](/materials/6061-vs-7075-aluminum)| [Brass vs Bronze Machining](/materials/brass-vs-bronze-machining) [![Olympus Machining LLC logo — CNC machining shop Hanover, PA](/assets/olympus-logo-DbWcTX06.webp)](/) Olympus Machining LLC is a precision CNC machining shop in Hanover, Pennsylvania, providing CNC milling and turning services for OEMs and manufacturers nationwide. Olympus Machining LLC · 639 Frederick St, Suite 1 · Hanover, PA 17331 · [(717) 634-5094](tel:+17176345094) Explore all [areas served, industries, and capabilities →](/sitemap) © 2026 All rights reserved.[Admin](/auth) [Compliance & Cybersecurity](/compliance)| [Privacy Policy](/privacy-policy)| [Sitemap](/sitemap) ITAR-aligned internal controls. Cybersecurity practices aligned with CMMC Level 1 (FAR 52.204-21). [Call (717) 634-5094 ](tel:+17176345094)