If you manufacture or export defense articles — or hold the drawings, specifications, and source data behind them — the International Traffic in Arms Regulations govern how that technical data moves and who is allowed near it. Get the architecture wrong and an ordinary support ticket can become a reportable export violation. Atom builds the enclaves and access controls that keep ITAR data compliant while your engineers keep working.
The International Traffic in Arms Regulations are administered by the US Department of State through the Directorate of Defense Trade Controls (DDTC). They control the export of defense articles, defense services, and the technical data tied to them — everything enumerated on the US Munitions List (USML).
“Technical data” is the part that catches software and IT teams off guard: blueprints, drawings, specifications, and documentation required to design, produce, or maintain a defense article are controlled even when nothing physical ever ships. Violations carry heavy civil and criminal penalties — substantial per-violation fines, and, for willful violations, prison time. This is a strict regime, and intent is not always a defense.
ITAR restricts access to technical data to US persons. Giving a non-US person access — even inside your own building, even without anything leaving the country — can itself be an export.
A visa holder on staff, an offshore developer, or a foreign-national support engineer at your cloud vendor is generally not a US person for ITAR purposes.
Disclosing controlled technical data to a non-US person is treated as an export to that person’s country — a deemed export — even if the data never leaves US soil.
In practice that means a foreign-national administrator with backend access, an unrestricted file share, or a helpdesk in the wrong region can constitute an unauthorized export. The control is not just your firewall — it is who holds the keys and who can reach the data, all the way down the stack.
For years the open question was whether storing ITAR technical data in a commercial cloud was itself an export, because the provider’s foreign-national staff could theoretically reach it. ITAR §120.54 answered it: sending, storing, or moving technical data is not an export when the data is properly end-to-end encrypted — because a non-US person can only ever touch ciphertext.
This carve-out is the entire basis for compliant cloud architecture. But it is conditional, and the conditions are technical. Miss one and you are back to a potential deemed export. The three prongs must all hold:
The data is encrypted end to end, with no access by the cloud provider or any intermediary to the unencrypted content.
The sender or data owner retains exclusive control of the decryption keys. The provider cannot decrypt on your behalf.
No unencrypted technical data is accessible to non-US persons at any point — including the cloud provider’s own staff.
ITAR 22 CFR §120.54
Microsoft’s Government Community Cloud High (GCC High) has become the de facto environment for contractors handling CUI and ITAR/export-controlled data — because it is built to keep the data inside US boundaries and reachable only by screened US persons.
GCC High stores data in US-sovereign data centers and is operated by screened US-person personnel — the operational answer to the US-person access requirement, not just a marketing label.
You do not have to drag your whole company into GCC High. An enclave isolates CUI and ITAR data into a defined boundary — identity, storage, and collaboration — leaving the rest of the business where it is. Smaller boundary, tighter control, fewer controls to prove.
The enclave is only as good as its edges. Conditional access, labeling, data-loss prevention, and disciplined external sharing keep controlled data in the boundary and non-US persons out of it.
They are different regulators asking different questions, and many contractors must answer both at once.
CMMC is a Department of Defense program. It governs how you protect CUI — the controls, the evidence, the assessment.
ITAR is a State Department regime. It governs who can access defense technical data — US persons only, keys included.
Build the enclave once, correctly, and it can carry both: NIST SP 800-171 controls for CMMC and US-person access plus §120.54 encryption for ITAR.
We are a security and compliance enablement partner — not your export-control counsel and not a C3PAO. What we build and operate is the technical machinery that makes the regulation hold in practice: the enclave, the access model, the keys, and the monitoring that proves it stayed controlled.
Legal classification of your articles and USML jurisdiction stays with your counsel. Everything downstream of that decision — the architecture and the day-to-day operation — is where we live.
Request a readiness assessment. We’ll map where your technical data lives, design the US-person-controlled enclave, and implement the encryption and key management that keep ITAR data compliant — while satisfying CMMC in the same boundary.
Request a Readiness Assessment →