How to Conduct an ITAR Risk Assessment

Last Updated: October 22, 2026

Table of Contents

• What You Need Before Starting an ITAR Risk Assessment
• Step 1: Define Your Assessment Scope and ITAR Applicability
• Step 2: Map ITAR-Controlled Data and Defense Articles Across Your Operations
• Step 3: Evaluate Foreign-Person Access Risks and Deemed Exports
• Step 4: Assess Access Controls, Facility Security, and Data Safeguarding
• Using an ITAR Risk Assessment Template and Compliance Checklist
  • Structure the Template Around Evidence, Not Questions
  • Evidence Collection by Control Area
  • Interview Guidance
  • Map Findings to Requirements, Not to Best Practices
  • Build the Checklist as a Monitoring Tool
• Step 5: Document Findings, Score Risks, and Build Your Compliance Checklist
  • Build a Risk Register, Not a Report
  • Use Transparent Likelihood and Impact Scales
  • Sample Register Entries
  • Prioritize Remediation by Residual Risk, Not by Ease
  • Define Reassessment Triggers
  • Turn the Register into Your Compliance Checklist
• Common Mistakes to Avoid During ITAR Risk Assessment
• Frequently Asked Questions

What You Need Before Starting an ITAR Risk Assessment

An ITAR risk assessment systematically examines how your organization handles controlled defense articles, technical data, and defense services, where export controls apply, who accesses sensitive information, and whether safeguards meet requirements.

Before starting, gather three items: the current U.S. Munitions List (USML) and which products or technical data fall under it; a map of all facilities, departments, systems, and external partners touching controlled information; and existing access control, security policy, and training documentation.

Evaluate people, processes, facilities, vendors, and technology systems in a single pass; piecemeal reviews create gaps.

Step 1: Define Your Assessment Scope and ITAR Applicability

Determine whether ITAR applies before investing in a full assessment.

Answer four questions: Does your organization design, develop, produce, or export USML items? Do you receive USML-related technical data from U.S. persons or foreign entities? Do you employ foreign nationals who access controlled information? Do you operate facilities with security requirements?

A yes to any question means ITAR likely applies.

Build the team from operations, legal, security, and IT, with a single owner driving remediation. Many organizations bring in external expertise for objectivity.

Write an assessment plan specifying applicable regulations, in-scope facilities, interview subjects, and records to review, it prevents misalignment and evidences diligence.

Step 2: Map ITAR-Controlled Data and Defense Articles Across Your Operations

Technical data appears in engineering drawings, software code, test results, and manufacturing processes; defense articles include finished products, components, and assemblies.

Review each product against the USML, which covers aircraft, missiles, fire control systems, encryption, military electronics, and related technical data.

Next, trace where controlled information lives. Technical data typically exists in:

• Design files and CAD drawings stored on servers or in document management systems
• Manufacturing specifications and process documentation
• Test data and performance reports

ITAR defines a foreign person as any non-U.S. citizen or permanent resident.

Document all third-party relationships involving controlled data.

Step 3: Evaluate Foreign-Person Access Risks and Deemed Exports

Foreign-person access is one of the highest compliance risks.

For each foreign national, document citizenship, visa status, work authorization, and which systems, facilities, and data they can access. Any access to controlled information requires a deemed export authorization from the Directorate of Defense Trade Controls (DDTC).

Assess your current controls for foreign-person access. Common safeguards include:

• Restricted areas with badge access limited to U.S. persons
• Encrypted systems requiring separate authentication for foreign nationals
• Network segmentation isolating controlled data from general systems

Many organizations lack adequate separation: foreign nationals share office space, email, and file servers with controlled data, creating continuous exposure.

Review hiring and onboarding: do you screen for ITAR applicability, train foreign national employees on access restrictions, and document their understanding in writing?

Examine visitor management: require badges, restrict facility access, and log visitor presence and duration, uncontrolled visitor access is a significant deemed export risk.

Step 4: Assess Access Controls, Facility Security, and Data Safeguarding

Access controls are the core of ITAR compliance: evaluate who can access controlled information, how access is granted, and whether it is monitored.

Evaluate physical security first. Facilities containing controlled articles or technical data require controlled access. Assess your current measures:

• Perimeter security (fencing, gates, barriers)
• Building access controls (badge readers, security guards)
• Restricted areas (locked rooms, secure storage)

Document gaps against ITAR requirements; most organizations need enhanced facility security, especially near foreign nationals.

Next, assess information security controls. Controlled technical data requires encryption, access logging, and network segmentation. Evaluate:

• Data classification and labeling procedures
• Encryption of data at rest and in transit
• Access control systems (role-based access, least privilege)

Many organizations store controlled data on general business networks without encryption or access controls, significant exposure requiring remediation.

Review retention and disposal: ITAR requires controlled information be retained per regulatory timelines and destroyed securely.

Evaluate incident response: can you detect unauthorized access, contain the breach, investigate the cause, and notify DDTC?

Using an ITAR Risk Assessment Template and Compliance Checklist

A template is only useful if it forces evidence collection, not opinions. A defensible assessment backs each finding with a record, configuration, contract clause, or interview note an auditor could re-verify.

Let's get in contact →

Structure the Template Around Evidence, Not Questions

Most templates are question lists. A stronger design pairs every question with the evidence that answers it. For each control area, specify:

• The requirement being tested (cite the ITAR section)
• The control that is supposed to meet it
• The evidence type that proves the control operates

This prevents the common failure mode of writing "access controls appear adequate" with nothing behind it.

Evidence Collection by Control Area

Interview Guidance

Interviews fill the gap between what documents say and what actually happens. Use a consistent protocol:

• Interview at least one person per function that touches controlled data: engineering, manufacturing, IT, HR, supply chain, facilities, and legal.
• Ask open questions first ("Walk me through how a new engineer gets access to design files"), then verify against records.
• Ask the same question of two people in different roles and compare answers. Divergence is a finding.

Front-line staff often describe a workaround that bypasses the documented control, frequently the highest-value finding in the assessment.

Map Findings to Requirements, Not to Best Practices

A requirement-to-control crosswalk keeps the assessment honest. For each finding, record the specific ITAR obligation it relates to. Distinguish three categories:

1. Regulatory obligation, a specific ITAR section or DDTC requirement. Example: §122.5 recordkeeping retention. These are mandatory and must be remediated or formally accepted with rationale.
2. Supporting control, a security or process measure that helps meet the obligation but is not itself required by ITAR. Example: network segmentation. These are good practice and should be prioritized by risk, not treated as compliance failures.
3. Observation, a weakness with no direct regulatory link. Example: inconsistent file naming. These belong in the register but should not be escalated as compliance findings.

This distinction prevents two failures: claiming compliance based on best practices that do not meet the regulation, and treating every observation as a violation, which dilutes attention from real exposure.

Build the Checklist as a Monitoring Tool

The checklist should be derived from the crosswalk. For each requirement area, list the control, the evidence standard, the test frequency, and the owner. A practical format:

• Requirement: ITAR §120.17 deemed export controls
• Control: Foreign-person access review and authorization documentation
• Evidence: Access report cross-referenced to HR status, authorization records

The checklist is not a one-time artifact but the recurring monitoring view of the same controls. Review it quarterly, update it when a reassessment trigger fires, and use it to brief leadership on residual risk trends.

Step 5: Document Findings, Score Risks, and Build Your Compliance Checklist

Documentation turns an assessment from a conversation into an auditable record. The output is a risk register leadership can act on and a regulator or auditor can follow. Build it once, use it every cycle.

Build a Risk Register, Not a Report

A narrative report is hard to track and easy to shelve. A risk register is a table with one row per finding and fixed columns. At minimum, include:

• Finding ID and short title
• Affected requirement (cite the ITAR section or DDTC guidance item)
• Scope location (facility, system, department, vendor)

Use Transparent Likelihood and Impact Scales

Consistency matters more than sophistication. A five-point scale every assessor applies the same way beats a complex model applied inconsistently.

Likelihood (probability the gap leads to a compliance event within 12 months):

1. Remote, no known pathway; controls are documented and tested.
2. Unlikely, pathway exists but is blocked by at least two independent controls.
3. Possible, pathway exists and one control is weak or untested.
4. Likely, pathway is open and controls are informal or undocumented.
5. Almost certain, pathway is open, observed, and no control is in place.

Impact (consequence if the event occurs):

1. Negligible, internal finding, no controlled data exposure.
2. Minor, procedural gap with no data exposure; correctable without notification.
3. Moderate, limited exposure of controlled technical data; internal escalation required.
4. Major, unauthorized foreign-person access or loss of controlled data; DDTC notification likely.
5. Severe, systemic exposure across facilities or vendors; license suspension or penalty exposure.

Score inherent risk before considering controls, then residual risk after. The gap between the two numbers tells you whether your controls are actually doing work or just existing on paper.

Sample Register Entries

These entries are illustrative. Populate your own register with findings from Steps 1-4 and cite the specific regulatory basis for each row.

Prioritize Remediation by Residual Risk, Not by Ease

A common mistake is fixing the easy items first. That builds momentum but leaves the highest residual risks open. Use this order:

1. Residual score 15-25: Remediate within 30 days. Escalate to executive leadership. These are the findings most likely to produce a DDTC notification or penalty exposure.
2. Residual score 8-14: Remediate within 60-90 days. Assign a named owner and require weekly status updates.
3. Residual score 4-7: Remediate within 180 days. Track in the register and review at the next quarterly compliance meeting.
4. Residual score 1-3: Accept with documented rationale and monitor. Re-score if the underlying control changes.

Set escalation criteria in writing: if a high-residual finding is not remediated by its target date, it escalates one level of management automatically. This prevents the register from becoming a static document.

Define Reassessment Triggers

An assessment is a snapshot. Define what forces a new one:

• New USML category or product line added to the portfolio
• New facility, system, or cloud environment introduced
• New foreign national hire or change in a foreign national's access

Absent a trigger, reassess at least annually. Quarterly register reviews are the minimum cadence for tracking remediation status.

Turn the Register into Your Compliance Checklist

Your checklist should mirror the register structure. For each requirement area, DDTC registration, technical data safeguarding, foreign-person access, vendor management, training, recordkeeping, list the control, the evidence that proves it operates, the test frequency, and the owner. It is not a separate document but the monitoring view of the same register; review it quarterly and update it whenever a reassessment trigger fires.

Common Mistakes to Avoid During ITAR Risk Assessment

The most common mistake is underestimating scope, assuming ITAR applies only to manufacturing or certain departments.

Another frequent error is inadequate foreign-person evaluation: overlooking temporary workers, contractors, and consultants, or failing to update access when assignments change.

Findings often fail to become action, with reports shelved while remediation stalls.

Finally, teams often treat assessments as one-time events. ITAR compliance requires continuous monitoring, establish quarterly reviews to verify remediation remains effective and new risks have not emerged.

Conducting an ITAR risk assessment requires systematic evaluation across people, processes, facilities, vendors, and technology.