Key Takeaways
-
ITAR registration is a legal requirement for any U.S. machine shop manufacturing defense articles, and buyers must verify active DDTC registration directly rather than accepting verbal assurances.
-
Defense primes require documented proof of compliance, including active CAGE codes, SAM.gov status, AS9100D and ISO 9001:2015 certifications, and a functioning Technology Control Plan with U.S.-person controls.
-
Supplier audits focus on traceability, first article inspection reports, material certifications and complete ITAR record-keeping for five years from the last transaction.
-
Scalable capacity from prototype through full-rate production is essential, because shops that cannot sustain program volume create mid-program supplier change risks.
-
Precision Advanced Manufacturing is ITAR registered with AS9100D and ISO 9001:2015 certifications and offers integrated capabilities across California and Texas facilities, so buyers can verify compliance credentials and discuss defense program requirements through a custom quote request.
ITAR Registration and Internal Controls for Defense Machine Shops
ITAR registration is mandatory for any U.S. company that manufactures defense articles, whether or not the company ever ships a part overseas. The International Traffic in Arms Regulations, codified at 22 CFR 120–130, require manufacturers of U.S. Munitions List articles to register with the Directorate of Defense Trade Controls (DDTC) under the U.S. Department of State. Registration is not a certification earned by passing an audit. It is a legal status that must be actively maintained and renewed.
Releasing technical data to a foreign-national employee inside the United States constitutes a deemed export, even if a drawing never leaves the building. That single legal concept shows why a machine shop’s internal controls matter as much as its registration number. A shop without documented controls creates enforcement risk regardless of its registration status.
Step 1: Confirm Active DDTC Registration and Expiration Date
Verification of DDTC registration begins with direct confirmation. Request the supplier’s DDTC registration number and cross-reference it against the DDTC registration database at DDTC.gov. Confirm the registration category covers manufacturing of defense articles, not just brokering or exporting. Check that the expiration date has not passed and that renewal is current.
Manufacturers must pay an annual DDTC registration fee to legally manufacture items on the United States Munitions List. A lapsed payment means a lapsed registration. An expired DDTC registration number closes the gate and creates immediate violation risk for the buyer because the supplier cannot legally receive controlled technical data.
Red flag: shops that claim to “follow ITAR” without filing registration, or registrations that have quietly expired, are among the most common compliance failures in the defense supply chain. These failures persist because buyers accept verbal assurances instead of verifying documentation directly. Require written proof of active registration before sharing any controlled data.
Step 2: Verify CAGE Code, SAM.gov Status and Supporting Certifications
DDTC registration confirms legal authority to manufacture defense articles, and federal procurement systems then rely on additional identifiers before a supplier can receive contract awards. A Commercial and Government Entity (CAGE) code identifies a supplier in the federal procurement system. This identifier must remain active in SAM.gov to receive federal contract awards, so confirming the entity record is current and unflagged reveals whether the supplier maintains basic administrative compliance. An inactive SAM.gov registration blocks contract awards and signals broader compliance gaps that often extend to quality certifications.
Beyond CAGE and SAM, defense primes expect suppliers to hold quality management certifications that demonstrate structured process discipline. Machine shops serving U.S. defense and aerospace programs hold AS9100D and ISO 9001:2015 certifications to demonstrate structured quality processes, inspection discipline, traceability practices and continuous improvement systems required for defense work. This quality management framework enforces the same documentation discipline that DDTC auditors expect during compliance reviews.
Many defense primes flow AS9100 expectations, including configuration management, risk-based thinking, counterfeit-part prevention and AS9102 First Article Inspection, to Tier-2 suppliers even when full AS9100D certification is not contractually required. When programs involve Controlled Unclassified Information, CMMC Level 2 certification becomes an important supplier requirement in addition to ITAR registration. CMMC Level 2 maps to the 110 security controls in NIST SP 800-171 and governs how suppliers protect technical data, drawings and program information.
Precision Advanced Manufacturing holds AS9100D and ISO 9001:2015 registrations and is ITAR registered, providing the compliance foundation defense primes require at qualification.
Step 3: Evaluate the Shop’s Technology Control Plan and U.S.-Person Controls
A Technology Control Plan (TCP) is a formal written document that describes how an organization will prevent unauthorized access to export-controlled technology, technical data and defense articles under ITAR. Request a copy or a summary of the supplier’s TCP before sharing any controlled drawings.
A TCP must define physical security controls, including restricted area designation, access control, visitor escort and sign-in procedures, locked storage, ITAR marking and controlled destruction, IT security measures, visitor management procedures, foreign national access restrictions, data marking requirements and disposal protocols for ITAR-controlled materials. These controls translate legal obligations into daily shop-floor behavior.
Common TCP weaknesses that create enforcement risk include TCPs that exist on paper but are never implemented, failure to update after personnel or product-line changes, inadequate IT controls for cloud or collaboration platforms, missing or inconsistent training records and visitor management gaps. These weaknesses often surface first during audits or incident investigations.
Red flags to watch for connect directly to TCP gaps. Frequent ITAR violations include emailing CAD files abroad, granting unauthorized repository access, misclassifying hardware as EAR99, sharing controlled designs during meetings and using unsecured cloud collaboration environments. Foreign-national employees with full network access to controlled drawings without a license represent a direct deemed export violation. Ask the supplier how foreign nationals are screened and what access restrictions are enforced.
Also verify sub-tier controls. When a machine shop sends a controlled part to a sub-tier supplier for plating, heat treat or finishing, the controlled drawing often travels with it, so the sub-tier supplier must also be ITAR-registered to avoid creating a violation for the prime contractor.
Step 4: Assess What Primes Audit During Supplier Qualification
Strong TCP controls must stand up to formal review, so audit readiness becomes the next critical checkpoint. Prime contractor supplier audits focus on traceability, documentation integrity and inspection evidence. Auditors will request manufacturing travelers, material certifications, first article inspection reports and records of nonconformances. AS9102-format First Article Inspection reports compile dimensional verification, material certifications and process records into a single submittal package for prime-contractor review.
DFARS 252.225-7009 requires Tier-2 fabricators to trace specialty metals, including stainless steel, high-strength steel, titanium and certain alloys, to U.S. or qualifying-country melt sources and document compliance via Mill Test Reports at receiving. Confirm the shop maintains this traceability at the material level, not just at the part level.
The AS9100D framework introduced earlier becomes critical during audits because it embeds documentation discipline into daily operations. Manufacturers must maintain complete ITAR records, including registrations, classifications, licenses, visitor logs, manufacturing travelers, data access logs and shipping documentation, for five years from the last transaction and conduct periodic internal audits to verify adherence and supplier compliance. A shop operating under AS9100D already builds most of that infrastructure into its quality system.
The TCP is typically among the first documents requested during a DDTC audit or compliance review. A supplier that cannot produce it on request is not audit-ready.
Step 5: Confirm Scalable Capacity from Prototype to Full-Rate Production
Compliance credentials protect programs only when the supplier can execute at scale. A shop that passes qualification on a prototype run but cannot sustain full-rate production forces a mid-program supplier change. Evaluate multi-shift capability, integrated CNC-to-finishing services and the supplier’s track record of transitioning programs without quality degradation.
Geographic redundancy reduces single-point-of-failure risk. Precision Advanced Manufacturing operates specialized facilities in California and Texas, providing national coverage that supports programs across multiple regions without adding supplier handoffs. This geographic distribution pairs with integrated capabilities, including multi-axis CNC machining, precision fabrication, specialty welding, secondary finishing and kitting, all under one AS9100D- and ITAR-compliant roof, eliminating the sub-tier exposure that fragmented supply chains create when capabilities are distributed across multiple vendors.
For programs transitioning from an existing supplier, Precision Advanced Manufacturing provides complete documentation, material traceability and engineering support to ensure continuity. Pilot builds and validation runs reduce transition risk while integrating into existing supply chains.
Connect with the Precision Advanced Manufacturing team to review certifications, discuss production capacity and align support with specific program requirements.
Frequently Asked Questions
What is the difference between ITAR registered and ITAR certified?
“ITAR registered” is the correct term. It refers to active registration with the Directorate of Defense Trade Controls under the U.S. Department of State. There is no such thing as “ITAR certified.” A supplier that uses that phrase may not understand the regulatory framework, which is itself a qualification risk. Always ask for the DDTC registration number and verify it directly.
What should a buyer do if a supplier’s DDTC registration has expired?
Stop sharing controlled technical data immediately. An expired registration means the supplier cannot legally receive ITAR-controlled drawings, models or specifications. Continuing to send controlled data to an expired registrant creates violation exposure for the buyer’s organization, not just the supplier. Require the supplier to renew and provide updated registration documentation before resuming any data exchange.
Does AS9100D certification replace the need for a Technology Control Plan?
No. AS9100D governs quality management processes, including inspection, traceability, configuration management and continuous improvement. A Technology Control Plan governs export control security, including who can access controlled data, how it is stored, how foreign nationals are screened and how incidents are reported. Both are required for defense work. AS9100D strengthens ITAR compliance by enforcing documentation discipline, but it does not substitute for a TCP.
Can a machine shop transition a program from prototype to full-rate production without disrupting compliance?
Yes, when the shop operates under a certified quality management system with scalable production infrastructure. The key is that the same AS9100D processes, ITAR controls and traceability systems that govern prototype work must extend to full-rate production without modification. Shops that rely on informal processes during prototyping and attempt to formalize them at production scale introduce compliance gaps. Precision Advanced Manufacturing’s quality systems are designed to cover the full product lifecycle from initial build through sustained multi-shift manufacturing.
What documentation should a buyer request before awarding a purchase order to an ITAR-registered machine shop?
At minimum, request the DDTC registration number and expiration date, AS9100D and ISO 9001:2015 certificates with current scope and expiration, an active CAGE code and SAM.gov registration, a summary or attestation of the Technology Control Plan, evidence of U.S.-person controls and foreign national access procedures, and sample quality documentation such as a first article inspection report or manufacturing traveler. For programs involving Controlled Unclassified Information, also request CMMC compliance documentation.
Conclusion: Qualify ITAR Registered Machine Shops to Protect Defense Programs
Verifying an ITAR registered machine shop for defense requires five documented steps: confirming active DDTC registration, validating CAGE and SAM.gov status alongside AS9100D and ISO 9001:2015 certifications, reviewing a functioning Technology Control Plan with U.S.-person controls, assessing audit-ready documentation and traceability, and confirming scalable capacity from prototype through full-rate production.
ITAR civil penalties can reach significant amounts per violation or twice the transaction value, whichever is greater, with criminal penalties including fines and imprisonment. The RTX Corporation consent agreement in August 2024 demonstrates these penalties at scale, showing how inadequate supplier controls create enforcement exposure that extends beyond the supplier to the prime contractor. Supplier qualification functions as a program protection measure, not a paperwork exercise.
Precision Advanced Manufacturing meets every criterion in this playbook, combining the geographic coverage and integrated capabilities described above with complete traceability and documentation at every stage. Programs move from prototype to full-rate production under one compliant roof, supported by consistent quality and export-control discipline.
Start the qualification process with Precision Advanced Manufacturing’s defense manufacturing specialists to confirm compliance credentials, align production plans with program requirements and protect schedule and quality from the first award.
