A customer just emailed a drawing for one aluminum machined body. The note says ITAR. Your shop has five people, the ship-to address is in Ohio, and nobody is talking about an overseas box. The estimator still has to open that STEP file to price it.
That inbox sits inside the control line. One domestic defense part can create a yearly registration duty. Registration with the State Department does not license a later shipment, and it does not make an ITAR machine shop ready for CMMC. The people who may see the print, the finisher who may receive the spec, and the system that stores the quote are separate questions. Answer them before you promise a price or a date.
Table of Contents
When One Defense Part Requires Registration
Say the same five-person shop machines that one defense component and never exports it. Under 22 CFR § 122.1, engaging in the business can be a single occasion of manufacturing, exporting, or temporarily importing a defense article, or of furnishing a defense service. The rule also says a manufacturer must register even when it does not export. Shop size is not the test. A border crossing is not the test.
Registration is not an export license. It does not authorize a shipment, and it does not authorize a data transfer. Registrants who must pay the fee renew every year under § 122.2, so this is an operating cost, not a wall plaque. Treat it like a recurring shop expense you calendar, not a certificate you frame once.
What the rule is asking
Look at the specific part, the contract, and the drawing. A commercial bracket that is not on the U.S. Munitions List is a different job from a lookalike defense article. Public textbook engineering does not pull the whole shop in. A controlled print mixed into an otherwise commercial job can.
Shop situation | Register with DDTC | What it does not do |
|---|---|---|
Manufacture one defense article and never export it | Yes | Does not license later exports |
Export or temporarily import a defense article | Yes | Is not the export authorization itself |
Furnish a defense service tied to a defense article | Yes | Does not clear every employee to see data |
Broker defense articles or related technical data | Yes | Does not replace item classification |
Use only public scientific or engineering principles | No | Does not cover a controlled print mixed into the job |
Machine ordinary commercial parts not on the U.S. Munitions List | No | Does not decide a lookalike defense part |
Practical rule: Judge the item, the contract, and the technical data. Do not judge the headcount or whether the carton crossed a border.
If the row says yes, registration is the starting obligation. It still does not clear the quote, the programmer, or the plater.
Registering With DDTC and Handling a Slip
Once that row says registration applies, register with the Directorate of Defense Trade Controls before the shop manufactures, exports, or temporarily imports a defense article. Expect a registration fee when the registrant is required to pay one. The filing produces a registration statement. Keep it accurate. Report changes in officers, ownership, or address as they happen, not at renewal.
Fee-paying registrants renew every year. Name one person who owns the calendar entry, the fee, and the statement. Last year's approval is not permanent.
If a file already went to the wrong person
Ask four questions, in order.
Who and when: Who received the file or the part, and on what date and time?
Job reason: Was that person a U.S. person who needed it for the work?
What left: Exactly which print, model, photo, or spec was disclosed?
Cutoff: Has further access already been stopped?
If an unauthorized export or disclosure has happened, stop further access at once and preserve who opened what and when. Bring in experienced export counsel quickly. The State Department's voluntary disclosure process depends on prompt, documented reporting. This is a process to start, not a legal opinion. Confirm the details with counsel before you file anything.
What Counts as Controlled Data on the Shop Floor
The control follows the information needed to make the part, not only a finished weapon. Under 22 CFR § 120.33, technical data includes information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of a defense article. The regulation names blueprints, drawings, photographs, plans, instructions, and documentation, plus certain classified information and software directly related to defense articles.
What the estimator actually opens
A normal RFQ pack is not "just a picture of a part." For a CNC or sheet-metal job it often includes:
3D CAD and STEP files: the model the programmer uses to plan toolpaths.
2D prints: tolerances, material callouts, and finish notes.
Setup photos and process sheets: how the part is held, formed, or inspected.
Bills of material and inspection plans: what is bought and what is checked.
Related software: files directly tied to the defense article, not a generic spreadsheet.
The same section of the rule excludes general science, math, and engineering commonly taught in schools, and information already in the public domain. You do not lock the whole server because someone stored a textbook formula. You do lock the customer's drawing package when it is directly related to an item on the U.S. Munitions List. A careful pass through reviewing engineering drawings is where that split shows up, title block by title block.
Unfinished metal can already be the article
A forging, casting, extrusion, or machined body can itself be a defense article once material, geometry, mechanical properties, or function make it clearly identifiable. The blank on the rack is not automatically "just stock."
Handing over the print is like handing over the recipe. The aluminum or stainless can stay in the building and the disclosure can still be the problem.
If today's file is required to machine, form, inspect, or finish a munitions-list item, treat it as controlled until someone classifies it otherwise.
Who May See the Drawing and the Part
The file is only half the question. The person holding it is the other half. In plain shop terms, a U.S. person with a job reason may see the controlled print. A foreign national, an overseas programmer, or a cloud service whose staff can view the model can create a disclosure even though the chips never leave the building.
People owners actually have on the floor
Walk the cases that show up in a small shop, not a policy manual.
Night-shift helper who is not a U.S. person: needs a different assignment until counsel says otherwise. Good hands do not replace status.
A spouse who sorts the shop email: opening the RFQ to be helpful is still opening the file.
A visiting customer with a phone camera: a setup photo on a personal phone is a copy you cannot pull back.
A freelancer redlining toolpaths from another country: the model left the building the moment it hit that inbox.
Least privilege follows the role, not seniority. The estimator needs the print and the material callout. The mill or lathe programmer needs the model. The press-brake operator needs the flat pattern and the bend notes. A visitor does not need the job folder.
The physical side, without a lecture
Keep prints in a locked cabinet or behind a badge. Ban setup photos on personal phones. Keep a visitor log. Records should show who opened a revision and when it changed, in a form you can reproduce later.
On Monday, list every person and inbox that can open the current job folder, then remove anyone without a job reason.
Speed does not outrun that list. An estimator who forwards the drawing to get a quote out faster has already made the access decision.
Why ITAR Registration Is Not CMMC
A domestic defense part can create an annual ITAR registration duty, while the same job's quote folder raises a separate cybersecurity question. ITAR concerns whether an article, defense service, or technical data is controlled, who may access it, and whether an export or transfer needs authorization. CMMC concerns cybersecurity requirements for Federal Contract Information or Controlled Unclassified Information when a contract requires protection. Arena Solutions' key business questions explain the distinction: ITAR registration does not make a shop CMMC-compliant, and CMMC does not authorize an export or access by a foreign person.
For a machine or fabrication shop, the contract and the data determine which cybersecurity requirements apply. If a contract puts covered defense information on a contractor system, DFARS 252.204-7012 calls for adequate security and, for applicable nonfederal systems, NIST SP 800-171. It also addresses DoD assessments and reporting cyber incidents. Check the solicitation and contract rather than assuming that registration alone settles the cybersecurity requirements.
The quote folder is on the map
An RFQ inbox, a CAD parser, and a shared quote folder can all hold controlled data. Treat them as part of the shop's control line: identify what each system receives and who can access it. ITAR registration alone does not secure those systems. Likewise, a cybersecurity certification does not determine who may receive a controlled drawing.
Question | ITAR | CMMC |
|---|---|---|
Main question | Is this a defense article, service, or its technical data? | Can this system protect the federal information identified by the contract? |
Typical trigger | Manufacture, export, temporary import, brokering, or a defense service | A contract requiring protection of federal information |
Access focus | U.S. persons unless an authorization says otherwise | Users meeting the required security controls |
Quote-folder effect | Control access to prints and data transfers | Protect covered information and maintain required safeguards |
What it does not give you | A CMMC certification | Permission to export or show data to a foreign person |
Timing cue for owners | Registration can be triggered by one manufacturing occasion and renews yearly | Check the contract for applicable cybersecurity requirements |
Before quoting, identify whether the RFQ contains ITAR-controlled technical data, contract-covered information, both, or neither. Those labels lead to different obligations, and one does not replace the other. A registration record does not make the inbox secure, just as secured systems do not grant export authorization.
How to Run an ITAR-Aware Shop
An ITAR-controlled RFQ can arrive beside ordinary work in the estimator's inbox. A written routine helps your team carry the same access limits from the first drawing review through quoting, outside finishing, and the shop floor. Use it for milling, turning, and sheet metal.
The nine actions, in order
Intake. Ask whether the part or its data is ITAR-controlled or listed on the U.S. Munitions List. Record the customer's answer. You cannot price a control status you have not asked about.
Classify before you promise. Determine the status of the article and file pack before sending a price or lead time. A quick quote based on the wrong assumption can create costly rework.
Name the people. Limit RFQ access to named U.S. persons who need the information for estimating, programming, or inspection.
Name the systems. Keep CAD files, prints, and email on systems those people are authorized to use, with unique logins. A shared shop password makes it harder to tell who opened a revision.
Clear the finisher first. Before quoting plate, anodize, paint, or chem film, confirm the finisher may receive the controlled specifications.
Then price. Price materials and operations after those checks, and mark the quote as defense-controlled when appropriate.
Save the trail. Record who viewed each revision and which assumptions changed. Keep enough information to reproduce the manufacturing, acquisition, and disposition record.
Carry the same limits to the floor. Give the mill, lathe, or brake operator a traveler with the same access restrictions used for the quote. The shop-floor copy needs the same protection.
Calendar the renewal. If registration applies, schedule its annual renewal. Last year's registration does not cover future years automatically.
Where a person still has to look
People must review classification and any decision to send a file outside the building. Software can sort an inbox, but it cannot determine whether a finisher is authorized to see a controlled finish specification. That decision belongs to someone who understands the part, the data, and the access rules.
A quote should show who opened each revision and whether the plater was cleared before receiving the relevant information. Without that record, the shop may have to reconstruct its decisions under a deadline. Use the routine as a handoff: each person checks access before passing the drawing, file, or traveler to the next.
How Defense RFQs Change Quotes and Finishers
The Directorate of Defense Trade Controls states that ITAR applies to organizations manufacturing, exporting, temporarily importing, or brokering defense articles, including controlled technical data, or providing defense services on the U.S. Munitions List. For a shop, that line runs through the RFQ and through outside processing.
A machined body that almost got forwarded
Take a high-mix CNC RFQ for a machined body in aluminum. The print is controlled. The estimator is about to forward the STEP file to a programmer who is not cleared. The metal supplier only needs alloy, size, and quantity.
Price the machining from an authorized workstation. Note the ITAR flag on the quote. Do not attach the model to the material email. The supplier can buy 6061 bar without the geometry that makes the body identifiable.
A stainless chassis that needs a finisher
Now a sheet-metal chassis in stainless that needs anodize or chem film after forming. The fab price and the brake time are meaningless if the finishing house cannot legally receive the drawing or the finish spec. Stock thickness and a public finish name may be enough for some vendors. The controlled print stays with a cleared processor. The same split shows up across outside processes and finishing: plating, anodizing, painting, and similar work sit on the compliance boundary, not outside it.
Classifying after the quote goes out has a commercial cost. The promised ship date slips while you replace a plater, and the old revision has no record of who priced the old assumption.
Put an ITAR yes-or-no line on the quote template, plus a named list of parties allowed to receive files, and fill both in before the bid is sent.
Shops that already route vendor questions through a controlled buying step, the way procurement automation for industrial operations describes for industrial buying, have an easier time keeping the material email and the controlled print in different lanes.
Classify the Next RFQ Before You Bid
Pull the newest defense or aerospace RFQ and hold the price. A normal machine shop RFQ process still applies. These four checks come first.
Status on the RFQ. Decide whether the part or any file is ITAR-controlled or on the U.S. Munitions List, and record the answer on the RFQ.
Named people only. Limit the controlled files to named U.S. persons with a job reason, and make the quoting inbox and shared quote folder match that list.
Finishers before finish price. Confirm every plater, anodizer, or painter may receive the spec before any finish is priced.
Then the bid. Quote only after that, mark the bid defense-controlled, and state which parties may receive files.
If the shop manufactures defense articles, put the annual DDTC renewal on the calendar. Registration is not permission to export. If the same contract carries covered defense information, treat NIST and CMMC controls as a separate workstream, with its own owner and checklist. Write the classification, the access list, and the finisher decision into the job file so the next estimator can reproduce them without asking.
We build Uptool specifically for U.S. machine and fabrication shops. Paid plans start at $195 per month, depending on total employees and whether the shop is ITAR, and any U.S. shop with fewer than 100 people can use a free 1-week trial at $0. If you are hunting the next program before that RFQ lands, a government RFP database is a practical place to see what is out for bid.
Uptool parses RFQ email, CAD, drawings, and bills of material into a quote your estimator can still review, so an ITAR flag, a named access list, and a finisher check can sit on the same record as the price. If you want that quoting inbox under control before the next defense drawing arrives, start with Uptool.
