ITAR Technical Data Rules for CNC Machining: 2026 Checklist

Last updated: July 11, 2026

Key Takeaways for ITAR-Controlled CNC Work

• ITAR technical data in CNC machining includes CAD files, G-code, tool paths, setup sheets, material specs and inspection criteria tied to USML items. These assets require strict access controls to prevent export violations.
• Supplier Quality Engineers verify seven documented controls: digital file security, US-person-only access, audit logging, physical floor restrictions, hardware controls, active DDTC registration and supplier-audit criteria.
• Common violations such as storing files on unencrypted shared drives or allowing foreign-national access without deemed export licenses can trigger DDTC consent agreements and penalties.
• Integrated facilities that combine machining, fabrication and finishing under one AS9100D- and ITAR-registered roof reduce program risk by keeping all controlled data within a single compliance boundary.
• Precision Advanced Manufacturing maintains these controls across its California and Texas facilities. Connect with the team to evaluate how an ITAR-registered partner can support a defense program.

7-Step ITAR Technical Data Controls Checklist for CNC Suppliers

Supplier Quality Engineers and Program Managers auditing a prospective CNC partner confirm that all seven controls are documented and active.

1. Digital file security: All ITAR-controlled files, including CAD models, G-code and setup sheets, are stored in encrypted, access-controlled repositories segregated from general-purpose systems.
2. US-person-only access: Access to controlled technical data is restricted to authorized U.S. persons only, with foreign nationals excluded unless a DDTC license or exemption applies.
3. Audit logging: Every access event, including file open, download, print or transfer, is logged with user identity, timestamp and action, and records are retained for the required period.
4. Physical floor restrictions: ITAR work areas are physically separated, badged and monitored. Visitors, vendors and unauthorized personnel cannot view screens, setup sheets or in-process parts.
5. Hardware controls: Removable media is prohibited or tightly controlled on CNC controllers. USB ports are disabled or monitored, and controller logs are reviewed on a defined schedule.
6. DDTC registration maintenance: The facility holds an active DDTC registration and renews it on schedule. Registration documents are available for customer audit.
7. Supplier-audit criteria: Any subcontractor or domestic supplier receiving controlled data is screened, documented and bound by written agreements that mirror the prime contractor’s ITAR obligations.

Digital Controls for CAD Files, G-Code and Tool Paths

A frequent violation occurs when an engineering team stores ITAR-controlled CAD files on an unencrypted shared drive or a commercial cloud platform without ITAR evaluation. One mid-size aerospace manufacturer migrated USML-controlled design drawings to a commercial cloud platform without ITAR evaluation, which resulted in unauthorized foreign-national access and a DDTC consent agreement.

Non-U.S. person access to ITAR-controlled files in Slack, GitHub, shared drives, Teams or cloud storage creates export or deemed export risk. The same exposure appears when controlled manufacturing notes or G-code are pasted into AI-enabled CAD or PLM tools.

Precision Advanced Manufacturing stores all ITAR-controlled digital assets, including CAD files, 3D models, 2D drawings, G-code and tool paths, in secured, access-controlled systems segregated from general collaboration environments. File transfers occur only through documented, authorized channels.

See how these digital controls work in practice and review how program data stays protected from intake through delivery.

Personnel Controls for US-Person Access and Foreign-National Screening

Personnel controls prevent deemed export violations inside otherwise secure facilities. A frequent violation occurs when an H-1B engineer accesses setup sheets or USML-controlled drawings inside a U.S. facility without a deemed export license. A defense electronics firm allowed foreign national engineers on H-1B visas to access USML Category XI radar system designs for three years without deemed export licenses, which led to criminal referrals for two executives and a penalty.

Giving a non-U.S. person access to controlled drawings, CAD files, source code, test data or manufacturing instructions constitutes a deemed export violation under ITAR, even when the employee works inside a U.S. facility.

Every organization handling ITAR technical data requires a formal foreign national access program that treats ITAR access authorization as a separate legal question from general employment or visa authorization. Precision Advanced Manufacturing maintains documented personnel screening procedures and restricts all ITAR work to authorized U.S. persons.

Physical Controls for Restricted Floor Access and Setup Sheets

Physical controls extend digital and personnel protections to the shop floor. A common violation occurs when a visitor or vendor representative enters a CNC work area and views screen readouts, setup sheets or in-process part dimensions tied to a USML-controlled program. Physical access controls extend the same U.S.-person restriction to the shop floor itself, where visitors, vendors and unauthorized personnel cannot view screens, setup sheets or in-process parts.

Physical controls at Precision Advanced Manufacturing include badged access to ITAR work areas, screen-position protocols that prevent incidental viewing and documented procedures for handling, storing and destroying printed setup sheets and inspection records. These measures align with the AS9100D quality management system operating across the facility.

Hardware Controls for CNC Controllers and Removable Media

Hardware controls address how ITAR data moves on and off CNC equipment. A direct hardware violation occurs when a machinist copies G-code or a tool-path file to a USB drive and removes it from the facility. Sending controlled drawings or CAD files to a foreign supplier without authorization is an export under ITAR, even if the supplier never manufactures the part. The same logic applies to any unauthorized removal of controlled files from a registered facility.

Precision Advanced Manufacturing disables or actively monitors USB ports on CNC controllers, maintains controller access logs and reviews those logs as part of routine compliance oversight. Removable-media policies are documented and enforced across both facility locations.

Common Machining-Shop Violations and CNC Supplier Audit Questions

Recurring violations in DDTC enforcement actions and consent agreements often involve precision machining environments.

• Emailing CAD files or drawings to foreign recipients without authorization
• Storing ITAR-controlled files on unmanaged shared drives or commercial cloud platforms
• Distributing unmarked manufacturing drawings with controlled dimensional tolerances to domestic suppliers who then route them to overseas vendors
• Allowing foreign national employees or contractors to access controlled files without deemed export licenses
• Using general-purpose collaboration tools, such as Slack, Teams or shared repositories, for ITAR-controlled data without ITAR-specific configuration
• Failing to maintain DDTC registration currency or compliance records for the required retention period

Audit questions help confirm that a prospective CNC supplier manages these risks.

• Is the facility DDTC registration active and available for review?
• Are AS9100D and ISO 9001:2015 certifications current?
• Does the facility maintain a documented foreign national access program?
• Are ITAR-controlled files stored in systems segregated from general collaboration tools?
• Are CNC controller logs retained and reviewed?
• Are domestic subcontractors bound by written ITAR flow-down agreements?
• Can the facility produce training records demonstrating employee ITAR awareness?

How an Integrated AS9100D and ITAR-Registered Facility Reduces Risk

Fragmented supply chains multiply ITAR exposure because each handoff between a machinist, a finishing vendor and a secondary supplier creates a new data-transfer event that must be controlled, documented and authorized. To reduce these handoff risks, Precision Advanced Manufacturing consolidates multi-axis CNC machining, precision fabrication, engineering support and integrated finishing under one AS9100D- and ITAR-registered roof at facilities in California and Texas.

Controlled technical data, including CAD files, G-code, setup sheets and inspection records, stays within a single, documented compliance boundary from intake through shipment. Program Managers and Supplier Quality Engineers gain a single audit target with consistent controls rather than a chain of separately managed vendors.

Discuss an upcoming program with the Precision Advanced Manufacturing team and evaluate how an integrated, ITAR-registered facility fits the compliance requirements of an aerospace, defense, space or UAV program.

Frequently Asked Questions About ITAR in CNC Machining

Does G-code qualify as ITAR technical data?

G-code that encodes the manufacturing process for a USML-listed defense article qualifies as ITAR technical data. It contains the instructions required to produce a controlled component and must be protected with the same controls applied to CAD files and drawings.

What is a deemed export on a CNC shop floor?

A deemed export occurs when a foreign national inside the United States accesses ITAR-controlled technical data. On a CNC floor, this includes viewing setup sheets, reading screen readouts or accessing digital files tied to USML-controlled programs. A deemed export license or applicable exemption is required before that access occurs.

What certifications should a CNC supplier hold for ITAR defense work?

A CNC supplier handling ITAR technical data should hold active DDTC registration, AS9100D certification and ISO 9001:2015 certification. Depending on the program, CMMC Level 2 certification may also be required when Controlled Unclassified Information is involved. Precision Advanced Manufacturing holds DDTC registration and operates under AS9100D and ISO 9001:2015 certified quality management systems.

How long must an ITAR-registered CNC shop retain compliance records?

ITAR regulations require that records related to controlled technical data and export transactions be retained for a minimum of five years. This requirement covers access logs, training records, file transfer documentation and any license or exemption records associated with the program.

Can a domestic U.S. supplier still create ITAR exposure when receiving machining drawings?

A U.S.-based supplier creates ITAR exposure if its employees, subcontractors or offshore affiliates can access controlled technical data without authorization. Sending controlled drawings to a domestic supplier that then routes them to an overseas vendor constitutes an unauthorized export. Written ITAR flow-down agreements and supplier screening are required to manage this risk.