ITAR. Export control. The other CUI gate.
The International Traffic in Arms Regulations control how defense articles and technical data cross borders — including into cloud storage that happens to replicate data outside the United States. ITAR sits alongside CMMC as a parallel compliance regime.
Overview
ITAR is administered by the State Department's DDTC, not DoD, and it governs a specific category of controlled information: technical data related to defense articles on the United States Munitions List. If your contract touches USML items — weapons systems, radar, launch vehicles, certain simulation software — ITAR applies whether or not the contract says the words 'CMMC' or 'NIST 800-171'.
ITAR's compliance model is different from CMMC: instead of assessed controls, it's registration + licensing + data handling rules. The practical overlap is that most of what makes a CMMC Level 2 environment defensible — tenant isolation, encryption, access control, audit logging, US-person restrictions — also constitutes the technical controls ITAR expects.
Scope
Any organization manufacturing, exporting, or handling technical data for items on the United States Munitions List (22 CFR 121).
Technical data cannot be accessed by non-US persons without a license. This is the single most common ITAR violation in cloud environments, because default cloud tenants are staffed globally.
Core Requirements
- 01DDTC registration if you manufacture or export defense articles
- 02Licensing for any export of ITAR-controlled technical data
- 03US-persons access controls for ITAR data at rest and in transit
- 04Separation from non-ITAR workloads (often via enclave architecture)
- 05Record retention per DDTC guidance
Tolerance's GCC High integration enforces US-persons access at the tenant level, and our enclave scoping tooling keeps ITAR data inside a defensible boundary that does not bleed into commercial productivity suites.
Have a contract requiring this framework?
Book a 30-minute call. We'll scope your obligation and give you a fixed-price proposal the same week.