If your program touches the United States Munitions List — aircraft structures, weapon systems, defense electronics housings, munitions components — the machine shop making your parts must be registered with the Directorate of Defense Trade Controls (DDTC) under ITAR. Not certified. Not compliant in a general sense. Registered. There is no substitute and no workaround.
Most Charlotte-area buyers sourcing defense machining already understand ITAR exists. Fewer understand what registration actually requires from a supplier — and what gaps to look for when qualifying shops. This guide covers what ITAR means at the machining supplier level, why it matters specifically for Charlotte and NC-region defense programs, and how Apex Manufacturing handles the practical requirements for ITAR-controlled work.
What Is ITAR?
ITAR — the International Traffic in Arms Regulations — is the U.S. regulatory framework governing the export and import of defense articles, defense services, and related technical data. It's administered by the State Department's Directorate of Defense Trade Controls (DDTC) and applies to anything on the United States Munitions List (USML).
The USML is a 21-category list of controlled items: from firearms and ammunition (Category I) to aircraft and related articles (Category VIII) to military electronics (Category XI) to spacecraft and related articles (Category XV). If a machined component is a part or component of an item on the USML — a bracket, housing, actuator body, weapon receiver — it's ITAR-controlled, and the supply chain making it must comply.
ITAR is not the same as EAR (Export Administration Regulations), which covers dual-use items on the Commerce Control List. The practical distinction: ITAR is State Department authority, covers military and defense-specific items, and has stricter requirements. If your legal or contracts team hasn't classified your drawing, don't assume EAR.
ITAR-controlled items require DDTC registration in the supply chain. EAR-controlled items typically do not require registration at the machining supplier level. Misclassifying an ITAR item as EAR exposes your prime contract to compliance violations — including fines up to $1M per violation and potential debarment. Before sending controlled drawings to any shop, confirm classification with your contracts or legal team.
What DDTC Registration Actually Requires
DDTC registration is the baseline for any manufacturer, exporter, or broker of ITAR-controlled defense articles. Registration is annual, fee-based, and requires disclosure of company ownership, foreign ownership interests, and the identity of the company's Empowered Official — the person legally responsible for ITAR compliance decisions.
Registration alone isn't compliance. A registered shop must also maintain and implement an ITAR compliance program covering:
Access Controls for Technical Data
ITAR-controlled drawings, CAD models, and specifications are "technical data" under the regulations. Providing access to a foreign person — any individual who is not a U.S. citizen, lawful permanent resident, or otherwise protected — requires an export license or applicable exemption. This applies to employees, contractors, subprocessors, and anyone who touches the controlled data.
At the practical level: a machine shop that employs foreign nationals must have documented processes for determining who can access which drawings and why. The absence of a documented access control policy is a compliance gap, not just an administrative shortcoming.
Physical and Digital Security
Controlled drawings and specifications must be stored with access controls — digital files in access-logged systems, paper drawings in secured storage. Screen-sharing a controlled drawing over a non-secure video call is an unauthorized export. Emailing a USML-controlled print to a foreign national's work address is an unauthorized export. These aren't edge cases — they're common failure modes at shops that handle defense work without a formal compliance program.
Empowered Official and Training
A registered ITAR entity must designate an Empowered Official who has the authority to bind the company on ITAR matters and signs export license applications. Staff with access to ITAR-controlled data require documented training — not a one-time briefing, but a recurring program with records.
Recordkeeping
ITAR requires a minimum five-year retention period for export and import records. For a machining supplier, this means: which drawings were received, who accessed them, when parts were shipped, to whom, and under what authorization. The records must be retrievable for government audit.
Why Charlotte-Area Defense Programs Require ITAR Machine Shops
North Carolina is one of the most defense-dense states in the country. The programs operating near Charlotte generate continuous demand for ITAR-compliant precision machining:
Fort Liberty (Fort Bragg)
The largest military installation in the United States by population, Fort Liberty supports Army Special Operations Command, XVIII Airborne Corps, and a concentration of special operations, airborne, and logistics units. Contractors supporting Fort Liberty programs — weapons systems, vehicle components, specialized equipment — routinely require ITAR-compliant machined parts sourced from the greater Charlotte region.
Marine Corps Air Station Cherry Point
MCAS Cherry Point, approximately 200 miles east of Charlotte, is the Marine Corps' largest air station and home to Fleet Readiness Center East — the Navy and Marine Corps' largest aircraft maintenance and repair facility. FRC East maintains F/A-18, EA-6B, and AV-8B aircraft. Suppliers supporting MRO contracts for these platforms produce ITAR-controlled machined components: airframe brackets, actuator housings, and structural fittings that trace to the USML Category VIII (aircraft and related articles).
Marine Corps Base Camp Lejeune
Camp Lejeune supports Marine Expeditionary Units, Marine Forces Command, and associated ground and air assets. Defense subcontractors supporting ground vehicle sustainment, weapons systems, and logistics equipment at Lejeune frequently require ITAR-registered machining suppliers within driveable range for quick-turn prototype and low-rate production work.
Charlotte Defense Industrial Base
Charlotte's manufacturing corridor — extending through Concord, Kannapolis, and the I-85 corridor — includes multiple defense prime contractors and Tier 1 subcontractors operating in aerospace, electronics, and ground systems. ITAR registration is a standard prerequisite for supplier qualification at these primes. Shops without current DDTC registration are disqualified before the drawing review begins.
How Apex Manufacturing Handles ITAR Requirements
Apex Manufacturing is DDTC-registered and AS9100D certified. ITAR compliance at our facility covers the specific requirements defense buyers need to verify before awarding:
Secure Facility and Access Controls
ITAR-controlled drawings and technical data are stored in access-controlled digital systems. Access is granted on a need-to-know basis, logged, and restricted to U.S. persons. Foreign nationals do not have access to controlled data without an applicable export authorization — and we document the basis for every access decision.
On the shop floor, ITAR-controlled jobs are managed with job-specific documentation controls. Drawings don't circulate freely; they go to the machinist on the job and are returned to controlled storage. Physical drawings for ITAR programs are handled under the same security framework as digital data.
Data Handling Procedures
We do not transmit ITAR-controlled drawings via unencrypted channels. File sharing for ITAR programs uses access-controlled transfer methods — not consumer cloud storage or unencrypted email. When a program requires a specific secure transfer method, we work to that requirement.
If a drawing arrives at our facility without a classification marking and we believe it may be ITAR-controlled, we flag it before proceeding. Processing an unclassified-but-ITAR-controlled drawing without appropriate controls is the same compliance violation as knowingly violating ITAR — "I didn't know" is not a defense under the regulations.
Empowered Official and Compliance Documentation
Our DDTC-designated Empowered Official is responsible for ITAR compliance decisions and signs our annual registration renewal. We maintain a written ITAR compliance program, conduct recurring staff training with documented records, and retain the required five-year recordkeeping archive for all ITAR transactions.
When a defense buyer asks for our ITAR registration certificate, we provide it. When a prime contractor flows down ITAR compliance requirements in a purchase order, we confirm acceptance and maintain records of that flowdown. This is not exceptional — it's table stakes for any shop doing real defense work.
Supply Chain Controls
ITAR compliance flows through the supply chain. If an ITAR program requires a special process — heat treat, anodize, non-destructive testing — the subprocessor handling that work must also be qualified under the applicable requirements. We maintain an approved supplier list for subprocessors we use on ITAR and defense programs, and we do not route controlled work to unqualified processors.
What to Verify Before Awarding ITAR Machining Work
When qualifying any machining supplier for ITAR-controlled work, the specific items to verify:
| Requirement | What to Ask For | Red Flag |
|---|---|---|
| DDTC Registration | Current DDTC registration certificate with registration number and expiration | Can't produce certificate; registration lapsed or unverifiable |
| Foreign Person Access | Written policy on foreign person access to controlled data; Empowered Official identified | No documented policy; unsure what a "foreign person" means under ITAR |
| Data Security | Description of how controlled drawings are transmitted and stored | Drawings sent via personal email or consumer cloud storage |
| Training Records | Confirmation of recurring ITAR training with records for staff accessing controlled data | No training program; "we tell people verbally" |
| Subprocessor Controls | Names and qualification status of subprocessors used on ITAR programs | Routes controlled work to unvetted outside processors without documentation |
| AS9100D | Current AS9100D certificate — in-scope, not expired, correct registrar | Claims certification without certificate; certificate scope doesn't cover your process |
A shop that hesitates on these questions or produces vague answers is a compliance risk regardless of their machining capability. ITAR violations carry fines up to $1M per violation and can result in debarment. The liability doesn't stay with the supplier — it follows the prime contractor who awarded the work.
ITAR Machining and AS9100D: Why Both Matter
ITAR registration and AS9100D certification are related but distinct requirements. Many defense buyers require both, and understanding what each covers prevents qualification gaps.
ITAR registration is a regulatory requirement administered by the State Department. It controls who can make, handle, and export ITAR-controlled defense articles. A shop can be AS9100D certified and not ITAR-registered — in which case they cannot manufacture USML-controlled parts, regardless of their quality system.
AS9100D is a quality management system standard for aviation, space, and defense. It covers process controls, calibration, configuration management, first-article inspection, nonconformance handling, and supplier management. AS9100D addresses how parts are made and documented; ITAR addresses whether the supplier is authorized to make them at all.
For defense programs, the combination is the threshold. ITAR registration without AS9100D means you have authorization to handle controlled defense articles but lack the quality infrastructure defense primes require. AS9100D without ITAR means you have the quality system but can't legally manufacture USML-controlled parts. Both are required — not interchangeable.
See our full defense CNC machining guide for deeper coverage of AS9100D requirements, NADCAP special processes, and defense procurement documentation requirements.
Common ITAR Machining Questions
Does every defense part require ITAR machining?
No. ITAR applies to items on the United States Munitions List. Many components used in defense programs are classified as EAR-controlled dual-use items, not ITAR-controlled defense articles. Your contracts team or legal counsel should determine the classification for your specific drawing. If the prime contractor's purchase order flows ITAR requirements, comply with them regardless of your own classification assessment — the prime's legal team made that call and it's their liability if they're wrong.
What's the difference between ITAR registration and ITAR compliance?
DDTC registration is the formal regulatory act of notifying the State Department that you manufacture, export, or broker ITAR-controlled defense articles. Compliance is the ongoing operational requirement — access controls, training, recordkeeping, secure data handling. A shop can be registered and non-compliant (registered but not actually following the requirements), or compliant in practice but with a lapsed registration (following the procedures but technically deregistered). Both situations are violations. You need current registration AND an active compliance program.
Can a Charlotte shop handle ITAR work for a prime in another state?
Yes. ITAR registration is federal — it's not state-specific. A DDTC-registered shop in Charlotte can supply ITAR-controlled machined parts to a prime contractor in California, Virginia, or anywhere in the U.S. The compliance requirements — access controls, data security, recordkeeping — apply regardless of the buyer's location.
How long does it take to get ITAR registration?
DDTC processes registration applications on their own timeline. The typical window is 4–6 weeks, but it can run longer. Shops that claim they'll get registered "before your order ships" are taking on program risk they may not be able to manage. For any ongoing defense program, verify registration before you need it — not when you're already committed to a delivery schedule.
Summary: What ITAR Registration Means for Charlotte Defense Buyers
ITAR isn't a quality certification or an aspirational standard. It's a federal regulatory requirement with criminal and civil liability for violations. When sourcing precision machined parts for defense programs in the Charlotte region — supporting Fort Liberty, Cherry Point, Camp Lejeune, or the Charlotte defense industrial base — ITAR registration at the machining supplier level is not optional.
The practical checklist before awarding ITAR machining work:
- Current, verifiable DDTC registration certificate (ask for the number, verify it's not lapsed)
- Named Empowered Official with documented authority
- Written ITAR compliance program with documented staff training
- Access controls for technical data — both digital and physical
- Qualified and approved subprocessors for any special processes required
- AS9100D certification current and in-scope for your required processes
Apex Manufacturing meets all of these requirements and documents them. If you're sourcing ITAR-controlled machined parts in Charlotte, NC — or evaluating suppliers for a defense program — send us your drawings and we'll respond with a compliant quote.
For detailed coverage of materials, MIL-SPEC finishes, and the full procurement checklist for defense machining, see our defense CNC machining guide. For aerospace tolerances, AS9100D requirements, and CMM inspection, see Aerospace CNC Machining Tolerances. For a full list of our CNC capabilities, visit Capabilities.