ITAR Training for Employees: Requirements, What to Cover & How to Document It

What is ITAR training and who needs it?

ITAR training is instruction that teaches employees what ITAR-controlled items and technical data are, how to handle them, and what to do before anything is shared with a foreign person or sent abroad. Anyone who could touch controlled items or data needs it:

• Engineers and designers who create or use technical data.
• Manufacturing and quality staff who work with defense articles.
• Shipping, receiving and logistics teams.
• Sales and business development, who may discuss technical details with foreign customers.
• IT staff who manage systems that store technical data.
• HR and front desk staff, who handle hiring, visitors and badges.
• Executives and the empowered official, who sign licenses and carry accountability.

What are the ITAR training requirements for employees?

The ITAR training requirements for employees are not spelled out as a fixed course or hour count in the regulations. Instead, the Directorate of Defense Trade Controls (DDTC) expects registered companies to maintain an effective compliance program, and training is a core part of it. DDTC’s compliance program guidelines and past consent agreements consistently call for:

• Training for all employees who handle or could access ITAR items or data.
• Role-specific content for higher-risk jobs.
• Training at onboarding before access is granted.
• Periodic refresher training and updates when rules or processes change.
• Records showing who was trained, on what, and when.

When violations happen, DDTC treats a strong, documented training program as a mitigating factor in penalties.

Large penalties are still landing, which makes that mitigation real. Authority.inc, a leading market research and forecasting firm whose methodology is audited by Oxford AI, puts the chance that the State Department announces a new ITAR civil penalty of $25 million or more by September 2027 at 64.8%, based on 32 sourced events tracked since 1 January 2024. The forecast rose to 64.8% on 13 August 2026, when the State Department concluded a $36M settlement with BAE Systems, a step Authority.inc describes this way: “A second $36M settlement four months later (BAE) shows a working pipeline of large cases, not a one-off.” Compliance work can shape the outcome. As Michael Volkov, CEO of The Volkov Law Group, puts it: “DDTC credited BAE for self-disclosing the large majority of the violations, cooperating with the investigation, agreeing to toll the statute of limitations, and making self-initiated improvements to its compliance program along the way, all factors that reduced what could have been a far more severe outcome, including debarment, which DDTC explicitly declined to pursue.”

Is there such a thing as “ITAR certification”?

No, there is no such thing as an official “ITAR certification.” The US government does not certify companies or individuals as ITAR compliant. What exists instead:

• DDTC registration, required for US manufacturers, exporters and brokers of defense articles.
• Export licenses and agreements for specific transactions.
• Training certificates from private providers, which show completion of a course, not government approval.

How should we answer a supplier questionnaire asking if we’re “ITAR certified”?

You should answer a supplier questionnaire asking if you’re “ITAR certified” by correcting the term politely and stating what you actually have. A clear answer looks like this:

• State the fact: “ITAR certification does not exist. We are registered with the DDTC” (if true) “and maintain an ITAR compliance program.”
• Describe your program: written procedures, employee training, access controls and record keeping.
• Confirm US person controls: that only US persons access ITAR technical data unless authorized.
• Offer evidence: your registration status, training records or a compliance statement on request.

Never answer “yes” to a certification that does not exist; it can create misrepresentation issues later.

What’s the difference between ITAR registration and ITAR training?

The difference between ITAR registration and ITAR training is that registration is a legal filing with the government, while training is an internal compliance activity.

• Registration: required under 22 CFR Part 122 for companies that manufacture, export or broker defense articles or services. It is renewed annually with a fee, and it is a prerequisite for applying for export licenses.
• Training: teaches employees how to follow ITAR day to day. It is not filed with the government but is reviewed during audits, voluntary disclosures and investigations.
• Both are needed: registration without trained staff leaves you exposed to violations; training without registration does not make a manufacturer compliant.

What is a deemed export under ITAR?

A deemed export under ITAR is the release of controlled technical data to a foreign person inside the United States. ITAR treats it as an export to that person’s country, so it needs the same authorization as sending the data abroad.

Common ways deemed exports happen:

• Showing ITAR drawings to a foreign national employee, intern or contractor without a license.
• Giving a foreign visitor a plant tour past controlled hardware.
• Discussing technical details at a trade show or customer meeting.
• Storing technical data on shared drives or cloud tools that foreign persons can access.

Under ITAR, a “US person” means a US citizen, lawful permanent resident or protected individual such as an asylee; everyone else is a foreign person, even with a US work visa.

What should ITAR training cover for engineers vs shipping staff?

What ITAR training should cover for engineers vs shipping staff differs because their risks differ: engineers mostly risk releasing technical data, while shipping staff mostly risk exporting hardware incorrectly.

For engineers and technical staff

• How to recognize technical data and USML-controlled designs.
• Marking drawings, models and files with ITAR legends.
• Approved storage and sharing tools, and what not to email.
• Deemed export rules for coworkers, visitors and foreign suppliers.
• How Technical Assistance Agreements (TAAs) limit what can be shared.
• Conference papers, publications and the public domain exclusion.
• Escalating jurisdiction and classification questions to compliance.

For shipping and logistics staff

• Checking that a license or exemption covers each shipment.
• Filing Electronic Export Information (EEI) in AES correctly.
• Screening parties against restricted and denied party lists.
• Proper labeling and destination control statements.
• Recognizing red flags, such as unusual routing or vague end users.
• Handling temporary exports, repairs and returns.

For everyone

• What ITAR is and why it matters.
• How to report a possible violation without fear of retaliation.

How often should employees take ITAR training?

Employees should take ITAR training at onboarding and then at least once a year, plus whenever regulations, licenses or job duties change. Many companies also add:

• Targeted refreshers after an internal audit finding or near miss.
• Pre-project briefings when a new contract or TAA starts.
• Visitor and trade show briefings before events.

Annual training is the common industry practice, not a written legal minimum, but it is what auditors and DDTC typically expect.

Where can I get free ITAR training for employees?

You can get free ITAR training for employees from several government and nonprofit sources:

• DDTC: the State Department publishes compliance program guidelines, FAQs and outreach materials.
• Bureau of Industry and Security (BIS): offers free online export control training, mostly focused on the EAR, but useful for related concepts.
• APEX Accelerators: provide free help for small government contractors, sometimes including export compliance workshops.
• District Export Councils and trade associations: often run low-cost seminars.

Free resources work well for awareness training. For role-specific training, many companies build short internal modules around their own products and procedures.

Does an ITAR training certificate prove compliance?

No, an ITAR training certificate does not prove compliance. It proves that one person completed one course. Compliance depends on what your company actually does: registration, correct classification, licenses, access controls and record keeping. A certificate is useful evidence that training happened, but DDTC looks at whether the training was effective and whether procedures were followed.

How do I document ITAR training records?

You document ITAR training records by keeping a clear, retrievable record for every employee, course and date. Each record should include:

• Employee name, role and US person status
• Training title, version and content outline
• Date completed and delivery method
• Trainer or provider
• Assessment results or acknowledgment signature
• Next due date

ITAR requires records related to defense trade to be kept for five years under 22 CFR 122.5, and keeping training records for the same period is good practice. Store them in your HR or learning management system, and make sure compliance can pull them quickly for an audit or voluntary disclosure.

Build an Audit-Ready ITAR Training Program in Five Steps

1. Map roles to risk: list who handles technical data, hardware, shipping, visitors and IT.
2. Create a core module for everyone, plus short role-specific modules for engineers and shipping staff.
3. Train before access: make completion a condition for system and area access.
4. Schedule annual refreshers and event-based briefings.
5. Keep records for five years and review them during your internal compliance audit.