ITAR compliant file sharing means sharing technical data in a way that only authorized people can reach it, and that keeps it from being exported to a foreign person without authorization. The ITAR doesn’t certify any product, so there’s no such thing as an approved platform. You must choose and configure secure file-sharing tools that meet rules governing controlled data access, storage, and transfers.
This guide covers what ITAR compliant means, who can access ITAR data, what the encryption rule allows for cloud storage and data transmission, a checklist for evaluating a file sharing solution, and how to handle vendors. It’s general information, not legal advice. Have export counsel confirm your obligations.
What Does ITAR Compliant Mean? Why There Are No ITAR Certification Requirements for Platforms
The International Traffic in Arms Regulations (ITAR) control imports and exports of defense-related articles and services through government oversight. Defense articles are the items on the United States Munitions List (USML), and anything described as items on the USML is controlled. The ITAR regulations also cover technical data, meaning information required for the design, development, production, or modification of defense articles, such as drawings, specifications, and models. Our guide to the U.S. Munitions List explains how items get there.
An ITAR restriction, then, is a limit on who may receive that data and where it may go. Sharing ITAR technical data with the wrong person, even inside the United States, can be an export.
Two terms get confused:
- “ITAR compliant” has no regulatory definition. It’s a marketing phrase. What matters is whether your use of a tool meets the rules and helps you maintain ITAR compliance.
- “ITAR certified” isn’t a real credential either. The Directorate of Defense Trade Controls (DDTC) registers companies, and it doesn’t certify products or platforms. We explain the difference in our guide to ITAR certification. Any vendor claiming to be certified should be asked what that means.
So the useful question isn’t whether a platform is compliant. It’s whether the platform lets you meet ITAR requirements and show compliance with ITAR, and whether you can prove you did.
ITAR Requirements for Technical Data: Who Can Access ITAR Data?
A question we hear often is whether non-U.S. citizens can access ITAR data. The ITAR doesn’t ask about citizenship for technical data subject to ITAR. It asks whether someone is a U.S. person or a foreign person. U.S. citizens, lawful permanent residents, and protected individuals such as refugees and asylees are U.S. persons. Someone on a temporary work visa, or a foreign national visitor, is generally a foreign person. We walk through the categories in our guide to deemed exports.
Giving a foreign person access to ITAR technical data without authorization can be an export, even if it happens in your building and no file ever leaves the country. That’s why file sharing is an ITAR issue. A shared folder is an access list, and the access list is where compliance happens. Controlling access to sensitive data is the safeguard that matters most, and it applies to ITAR-controlled data in every format, from CAD models to emailed attachments.
Three groups matter more than people expect:
- Your own employees and contractors. A new hire’s access to a shared drive can create an unauthorized export.
- Your vendors and customers. Anyone you invite, both internal and external parties, is covered by the same rule, and a release of data to a foreign person can happen through any of them.
- The platform’s staff. If people who operate the service can read your files, their status matters too.
ITAR-Compliant Cloud Storage: What the Encryption Rule Allows for Data Transmission
Cloud storage raises an obvious worry: if a provider’s servers or staff can touch your data, haven’t you exported it?
The ITAR addresses this directly in 22 CFR 120.54, which lists activities that are not exports. Data stored in a data center, and data in transmission to it, both fall under the rule. Sending, taking, or storing technical data isn’t an export if it meets every one of these conditions:
- It’s unclassified.
- It’s secured with end-to-end encryption
The rule requires encryption between sender and recipient, restricting decryption to originators, authorized recipients, or qualifying U.S. persons.
- It’s protected by strong, validated cryptographyThe rule calls for cryptographic modules compliant with FIPS 140-2 or its successors, with proper key management, or other cryptographic means at least comparable to 128-bit AES.
- It’s not intentionally sent to a person in, or stored in, a country proscribed in 22 CFR 126.1, or the Russian Federation, and it’s not sent from one
Data merely passing through the internet isn’t treated as stored.
The rule also says that being able to access data in encrypted form, when those criteria are met, isn’t a release or export.
Three practical points follow:
- Who holds the keys matters. If the provider can decrypt your files, the encryption likely isn’t end-to-end in the rule’s sense, and its staff become part of your access list. Ask who holds the keys.
- Check the validation. FIPS 140-2 certificates moved to NIST’s Historical List on September 21, 2026. The ITAR text says “or its successors,” so modules validated under FIPS 140-3 satisfy the text. Ask vendors for a current validation certificate for the module they use.
- The carve-out has limits. It covers encrypted data. It doesn’t cover a foreign person who can view the data once it’s decrypted, and the rule doesn’t turn compliant storage into a substitute for access control. Who can open a file is still your problem to manage.
An ITAR Compliance Checklist for File Sharing Solutions
Use this table to evaluate any file sharing solution, whether it’s a collaboration suite, a file transfer tool, or storage, so your setup stays in line with ITAR mandates. The right answers matter more than any logo.
| Criterion | Why it matters | What to ask |
| U.S.-person administration and support | Platform staff who can read your files may be foreign persons | Who can access customer data, and are they screened U.S. persons? |
| Encryption and key control | End-to-end encryption is what keeps stored data outside the export definition | Who holds the keys? Is the module validated under FIPS 140-3? |
| Data residency and location | The rule bars storage in proscribed countries | Where are the data centers? Is anything stored in or routed through a prohibited location? |
| Granular access control | Access lists are the compliance mechanism | Can you set role-based, least-privilege permissions by user, folder, and group, and build an approval workflow for new access? |
| Strong authentication | Stolen credentials are an unauthorized access path | Is multifactor authentication enforced? Can you restrict by device or IP address? |
| External sharing controls | Vendors and customers are where exposure grows | Can you limit sharing to approved domains, set view-only access, and expire links? |
| Logging and audit | You need proof of who accessed what | Are access logs complete, retained, and exportable? |
| Breach and incident terms | A mishandled event can become a reportable violation | What’s the vendor’s notice commitment in the event of a data breach? |
| Contract language | Some vendors will sign export-control terms and others won’t | Will the vendor agree to ITAR terms in writing? |
Two cautions. A SOC 2 Type II report shows a vendor’s security controls over time, and it doesn’t address ITAR by itself. And “HIPAA compliant” on a vendor’s site is irrelevant to export control. The claims that sound reassuring often aren’t the ones that matter.
Best Practices to Comply With ITAR When Sharing Data With Vendors
Exposure often grows with the vendors, subcontractors, and customers who need files, not just your own people. The data handling practices that hold up in the field are simple and written down, and they cover how you share data with vendors. Here’s what we’ve seen work with manufacturers, and it’s how they support ITAR compliance day to day:
- Verify registration, and document it. Ask vendors for their DDTC registration code and expiration date. We cover how in our guide to ITAR registration.
- Add U.S.-person checks to your vendor survey. We added ITAR compliance statements and U.S.-person access checks to manufacturer vendor surveys before sharing controlled technical files.
- Control access by approved domain. That company maintains a list of approved vendor domains and records of authorized vendor personnel for each sensitive folder.
- Use view-only access with an expiration, tied to the vendor’s compliance status. One approach we’ve discussed with manufacturers is a tiered model that gives vendors with weaker compliance more limited access.
- Review roles regularly. In one review, an access report was exported to find users with inappropriate permissions, and critical folders were confirmed as administrator-only.
- Agree on the exchange method before you send anything. Another manufacturer is planning a supplier directory that records each supplier’s eligibility for ITAR and CUI and their approved transmission method, with read-only collaboration preferred and email limited to approved FedRAMP environments.
- Treat the gray areas conservatively. Small suppliers handling paper drawings, sketches, or CNC code are easy to overlook. If it’s derived from controlled data, treat it as controlled.
- Update annually. Vendor status changes, so confirm it at least once a year.
These steps are part of a technology control plan, which documents who can access controlled technology and how you enforce it.
When ITAR Data Is Also CUI: Data Security and Compliance Under CMMC
Many manufacturers find their ITAR-controlled data is also CUI, so the CMMC rules apply as well. Microsoft calls it “CUI Specified,” and that matters because of the compliance requirements it adds to file sharing:
- A cloud provider that stores CUI for you has to meet the FedRAMP Moderate baseline or equivalent under DFARS 252.204-7012, and an assessor will expect you to show you did.
The point is to choose one approach on purpose and stay compliant with it. Mixing ITAR files across consumer sharing tools, email, and a compliant environment is how an ITAR violation happens.
Not sure whether your shared files count as CUI, or what your current setup would score? Take the smaller step first. The CMMC Level 2 Readiness Check takes about eight minutes, never asks for CUI or system names, and returns an estimated SPRS score range and readiness tier, which can support your compliance efforts and show you where sensitive information is most exposed.
👉 Start the CMMC Level 2 Readiness Check. This educational estimate excludes official assessments and SPRS submissions; enter your contact details to receive your ranked gaps.
Ready to talk through how your files are shared and what to change? Schedule a free consultation with our team. We work with manufacturers in the DoD supply chain on exactly this kind of access control.
FAQs
Can non-U.S. citizens access ITAR data?
It depends on whether they’re U.S. persons. Lawful permanent residents and protected individuals are U.S. persons even if they aren’t citizens. A foreign person generally needs authorization before access, so check status and authorization before granting it.
What is the safest way to share ITAR files?
For secure file sharing, use a platform that lets you control exactly who can access each file, with strong authentication, end-to-end encryption you control, U.S. data location, and logging. Keep ITAR files out of consumer tools and ordinary email, and document who has access and why. An ITAR compliant file sharing setup is one you can explain and prove.
Is an ITAR violation a felony?
It can be. Under the Arms Export Control Act, a willful violation is punishable by up to $1,000,000 per violation and up to 20 years in prison, and civil penalties are a separate track. We walk through the statute in our guide to the technology control plan.
Is there an ITAR-certified file sharing platform?
No. The ITAR doesn’t certify products. Vendors can describe their controls and sign contract terms, but compliance depends on how you configure and use the tool.
