What Is ITAR and Who Needs to Comply?
The International Traffic in Arms Regulations (ITAR) govern the export and import of defense-related articles, services, and technical data listed on the U.S. Munitions List (USML). Any Houston company that manufactures, exports, imports, or brokers defense articles or services — or handles technical data related to those items — must comply with ITAR. In practice, this means thousands of Houston companies supporting NASA, the Department of Defense, and the aerospace supply chain have ITAR obligations they may not fully understand.
ITAR is administered by the U.S. State Department’s Directorate of Defense Trade Controls (DDTC). Violations can trigger civil and criminal penalties that are company-ending for small aerospace subcontractors. The obligation doesn’t require you to export anything — if you manufacture or handle technical data related to a controlled item, your entire handling of that data is regulated.
Houston’s ITAR-Affected Aerospace Community
Houston’s aerospace contractor community in Clear Lake, Webster, and Nassau Bay is one of the most ITAR-intensive business communities in the United States. NASA Johnson Space Center and its contractor ecosystem — Intuitive Machines (Artemis lunar landers), Axiom Space (ISS commercial modules), United Launch Alliance suppliers, Boeing Defense & Space, L3Harris, and KBR — all involve technical data that falls under ITAR classification.
Every company that wins a NASA or DoD contract and handles technical data about controlled systems, propulsion, communications, or navigation is subject to ITAR. The obligation flows down through the subcontractor chain. A small engineering firm in Webster that provides propulsion analysis for an Artemis subcontractor is handling ITAR-controlled technical data and has full ITAR compliance obligations.
ITAR IT Requirements
ITAR doesn’t just regulate hardware exports — it governs how you store, transmit, and provide access to controlled technical data through your IT systems. Specific IT requirements include:
Access controls that prevent unauthorized persons — including foreign nationals on U.S. soil, even employees — from accessing ITAR-controlled technical data.
Encrypted storage and transmission of all controlled technical data, at rest and in transit.
Audit logging of all access to systems and repositories containing controlled technical data.
ITAR-compliant cloud environments: commercial Azure and AWS do NOT meet ITAR requirements without specific government cloud configurations. You must use Azure Government, AWS GovCloud, or equivalent.
Documented data handling procedures covering how controlled technical data is stored, transmitted, shared, and disposed of — including who can access it and under what authorization.
xSIT’s ITAR IT Compliance Services
ITAR Data Mapping: Identify what technical data you hold, where it’s stored (on-premises, cloud, shared drives, email), and who currently has access. Most Houston aerospace subcontractors are surprised by how broadly controlled data has spread through their IT environment.
ITAR-Compliant Cloud Configuration: Migrate sensitive technical data to Azure Government or AWS GovCloud with proper access controls, encryption, and audit logging. Configure commercial cloud services that are permissible for non-controlled data.
Access Control Implementation: Role-based access controls, MFA enforcement, privileged access management, and foreign national access restrictions to prevent unauthorized access to ITAR-controlled systems and data.
Audit Logging & Monitoring: Implement and retain comprehensive logs of all access to ITAR-controlled systems and data, in formats that satisfy DDTC audit requirements.
Technology Control Plan Development: Help develop your Technology Control Plan (TCP) — the primary document demonstrating your ITAR compliance program — and supporting data handling procedures.
The Cost of ITAR Violations
Civil penalties up to $1.3 million per violation. Criminal penalties up to $1 million per violation and 20 years imprisonment. Debarment from future government contracts. For a small Houston aerospace subcontractor, a single ITAR violation — even an inadvertent one caused by inadequate IT controls — can end the business. The most common ITAR IT violation is not intentional: it’s storing controlled technical data on commercial cloud systems that foreign nationals can access.
Schedule an ITAR IT Assessment
xSIT provides confidential ITAR IT assessments for Houston aerospace and defense companies. We’ll map your current data handling, identify compliance gaps in your IT environment, and give you a prioritized remediation roadmap. All conversations are confidential.