Aerospace Sourcing
ITAR machining

Finding an ITAR Registered Machine Shop for Controlled Parts

An ITAR registered machine shop has a current DDTC registration under 22 CFR part 122 and keeps your technical data with US persons. We route controlled machining to shops that hold what your job requires and flow your clauses down. Send the part number, revision, material, quantity and export classification first, not the drawing.

Request a quote

Updated

What an ITAR registered machine shop is, in plain terms

An ITAR registered machine shop is a shop that has filed a registration statement with the State Department's Directorate of Defense Trade Controls (DDTC) and keeps it current, because it manufactures defense articles. That is the whole meaning of the word "registered." Everything else has to be checked separately.

People also search for an "ITAR machine shop" or "ITAR compliant CNC machining." Those phrases are looser. There is no ITAR certificate and no ITAR audit that a shop passes once and hangs on the wall. Compliance is a set of obligations the shop meets every day: registration, keeping foreign persons away from controlled technical data unless authorized, recordkeeping and reporting changes to DDTC. A shop can be registered and still handle your data badly, and the only way to know is to ask specific questions before release.

For the general requirements that apply to every aerospace part, see our aerospace CNC machining hub.

Who has to register with DDTC under 22 CFR 122

Under 22 CFR 122.1(a), anyone in the United States who manufactures, exports or temporarily imports defense articles, or furnishes defense services, must register with DDTC. One occasion is enough to count as being in the business, and the rule says outright that a manufacturer who never exports still has to register. So a domestic shop machining a defense article part generally needs a registration, even if nothing it makes ever leaves the country.

The regulation lists narrow exemptions in 122.1(b), including people whose business is limited to unclassified technical data and people who fabricate articles solely for experimental or scientific purposes, including research and development. Exempt persons still cannot get an export license or other approval unless they register. Do not assume a shop's exemption covers your job. Whether an exemption applies is a question for your export compliance lead, not something to accept from a quote.

Registered companies also have ongoing duties. Under 22 CFR 122.4, a registrant must notify DDTC within five days of events such as a change in name, address, legal structure, ownership or control, or senior officers, and must give 60 days advance notice before a planned sale or transfer of ownership or control to a foreign person. Ask whether anything has changed since the last renewal.

Have a part like this?Send it in under a minute. A person replies within 1 business day.

What DDTC registration proves, and what it does not

Registration proves that the company told DDTC who it is and what it does, and that the filing is current. It does not prove capability, security or a clean compliance record.

The regulation is direct about this. 22 CFR 122.1(c) says registration is primarily a way to give the government information about who is involved in certain manufacturing and exporting activities, that it does not confer any export rights or privileges, and that it is generally a precondition to a license or other approval.

Registration showsRegistration does not show
The company filed with DDTC and has a registrant codeThat the shop can hold your tolerances or run your material
The registration has an expiration date that has not passedThat only US persons can reach your files, machines or scrap
The company accepts the recordkeeping and change reporting duties of part 122That its IT systems meet NIST SP 800-171 or have a current SPRS score

DDTC registration letters list a registrant code and an expiration date. Many suppliers treat the code as confidential and share the letter only with customers who ask, which is normal. Ask for the current letter, check that the company name and address match the entity on your purchase order, and note the expiration date against your program schedule.

US person access to technical data

No foreign person may see your controlled technical data unless an authorization covers it. Under the ITAR, a release includes a foreign person visually inspecting a defense article in a way that reveals technical data, and oral or written exchanges of technical data, inside or outside the United States.

For the regulation, a US person includes US citizens, lawful permanent residents and certain protected individuals such as refugees and asylees, along with businesses organized to operate in the United States. A machine shop is full of places where technical data shows up without anyone thinking of it as a document:

  • The drawing and model on the CAM workstation and in the shop's file server
  • Setup sheets, traveler printouts and inspection plans on the floor
  • The part itself on the machine, on an inspection table or in the scrap bin
  • Questions emailed to an offshore programming or engineering service
  • Remote support sessions with a machine tool or CMM software vendor

Ask how the shop handles each of those. A good answer names the people cleared to work controlled jobs, explains how controlled work is segregated on the floor and in the file system, and describes how scrap from controlled parts is disposed of. "We are ITAR compliant" with nothing behind it is not an answer.

How controlled data should move and where it should live

Controlled files should move by an approved secure method to named US persons, and they should live only on systems the shop can show you are protected. Email attachments and public file sharing links are where most quiet mistakes happen.

Before release, settle these points in writing:

  • Transfer method. Which secure transfer tool will carry the files, and who on the shop side receives them.
  • Storage. Whether the files will sit on an on-premises server, a government cloud environment or a commercial cloud. If the files are covered defense information, DFARS 252.204-7012 requires any external cloud service holding them to meet security requirements equivalent to the FedRAMP Moderate baseline.
  • Sub-tier release. Whether a heat treater, coater or NDT house will need the drawing, and how the shop will control that release. Most special process houses only need the process callouts, not the full model.
  • Return or destruction. What happens to the files, programs and printouts when the order closes.

On our side, every supplier signs a flow-down NDA before seeing any customer data, suppliers do not learn who the end customer is unless you approve it, and no ITAR, EAR or CUI data passes through our website. Our confidentiality page and our controlled programs process describe the steps in detail.

DFARS 252.204-7012, NIST SP 800-171 and SPRS

If your drawing is covered defense information, the cyber rules apply in addition to the ITAR. DFARS 252.204-7012 requires contractors to protect that information on their systems using NIST SP 800-171 and to flow the clause, without alteration except to identify the parties, into subcontracts that involve covered defense information.

Covered defense information includes controlled technical information marked or identified in the contract, or developed by the contractor in performance. The clause also requires:

  • Reporting cyber incidents to DoD within 72 hours of discovery, which requires a DoD approved medium assurance certificate
  • Preserving images of affected systems for 90 days from the incident report
  • Cloud services meeting the FedRAMP Moderate equivalent baseline, as noted above

DFARS 252.204-7020 adds the assessment requirement. A contractor may not award a subcontract that is subject to the NIST SP 800-171 requirements unless the subcontractor has completed at least a Basic Assessment within the last three years. The Basic Assessment is a self-assessment scored against the 110 requirements of NIST SP 800-171, and the summary score is posted in the Supplier Performance Risk System (SPRS). Ask for the date of the shop's most recent assessment and confirm the score is posted.

CMMC status for machine shops in October 2026

CMMC Level 1 and Level 2 self-assessments are in effect on contracts that carry the clause, while third-party Level 2 certification is on hold. Check the current status before you write it into a purchase order.

  • The DFARS rule that puts CMMC into solicitations took effect on November 10, 2025, starting Phase 1, which uses self-assessments as a condition of award. DFARS 252.204-7021 has the prime flow the required CMMC level to subcontractors that will process, store or transmit federal contract information or CUI.
  • Phase 2 was scheduled for November 10, 2026, when Level 2 certification by a third-party assessment organization would have become the default for many CUI contracts. On July 13, 2026, the Department of War suspended Phase 2 and later milestones and set up a CMMC Reform Task Force to review the program over 60 days, with industry input gathered through a request for information.
  • Law firm summaries of the announcement agree that DFARS 252.204-7012, NIST SP 800-171 Revision 2, SPRS assessments and the Phase 1 self-assessment requirements under 252.204-7021 stay in effect during the suspension.

For a buyer: do not require third-party certification unless your prime contract does, and do not treat the suspension as a pause on protecting CUI. Confirm the latest position on the DoD CIO CMMC pages before writing terms.

ITAR compliant CNC machining still needs ordinary aerospace quality

Export compliance decides who may make the part. It says nothing about whether the part will be right, so the usual quality clauses still apply.

  • Quality system. AS9100 certification, checkable in the IAQG OASIS database, when your flow-downs require it.
  • First article. An AS9102 first article report on the first production lot. See our AS9102 first article guide.
  • Material. Mill certs traceable to heat or lot, and DFARS 252.225-7009 specialty metals compliance on titanium, nickel alloys and many steels when your contract carries it. See our specialty metals page.
  • Special processes. Coating, heat treat and NDT from processors your customer accepts, often Nadcap accredited. The processor may also need to be registered if it receives controlled data.

What to ask an ITAR machine shop before you release data

Ask these questions before the drawing leaves your building. Each has a factual answer.

QuestionWhat a good answer looks like
May we see your current DDTC registration letter?A letter in the company's legal name with an expiration date beyond your need date
Has ownership, control or senior management changed since your last renewal?A clear yes or no, and confirmation that DDTC was notified if yes
Who will see our data, and are they all US persons?Named roles, a process for verifying status, and no foreign national staff or contractors on the job without an authorization
Where will files be stored and how will they reach you?An on-premises or FedRAMP Moderate equivalent environment and a named secure transfer method
When was your last NIST SP 800-171 Basic Assessment?A date within the last three years and a score posted in SPRS
Which sub-tier processors will touch the part or the data?Named processors, what each receives, and how the flow-down reaches them
What happens to files, programs and scrap at the end of the order?A written return or destruction step and controlled scrap disposal

Our supplier qualification guide and supplier survey questionnaire cover the broader quality questions that sit beside these.

What goes wrong, and how we prevent it

The common failures on controlled machining jobs are procedural, not dramatic.

  • Drawings attached to a public quote form. We ask for the part number, revision and classification first and move files only by secure transfer to US persons.
  • An expired registration discovered at audit. We check the registration letter and its expiration date before release, not after award.
  • Data passed to a sub-tier processor without a flow-down. We flow the NDA and your clauses to every supplier on the order and only release what each one needs.
  • A CUI drawing sent to a shop with no assessment. We ask about SPRS status when the request involves covered defense information.
  • Unclear classification. If nobody has classified the drawing, we ask your export compliance lead to decide before anything moves.

What to send with your request

Send enough to scope the job without sending the controlled data itself.

  • Part number, drawing revision and a short description of the part
  • Export classification as your compliance team determined it: USML category, EAR classification or not controlled
  • Whether the drawing is covered defense information under DFARS 252.204-7012
  • Material, temper and specification, and any DFARS specialty metals requirement
  • Quantity, need date and whether follow-on lots are expected
  • Finish and special process callouts
  • Quality clauses: AS9100, AS9102 FAI, Nadcap processors, source inspection, CMMC level in your prime contract

The RFQ builder and our aerospace RFQ checklist help assemble the rest.

How Aerospace Sourcing handles ITAR machining requests

We are a sourcing service, not a machine shop, and we do not hold a DDTC registration or any certification on your behalf. We route controlled work to suppliers that hold what the job requires and keep the process controlled from request to delivery.

  • We review the scope you send and match it to shops whose registration, quality system and cyber posture fit your clauses
  • Every supplier signs a flow-down NDA before seeing data, and your requirements are flowed to each supplier on the order
  • Controlled files move by secure transfer to US persons only, never through our website
  • One quote, one point of contact and one purchase order, even when a machinist, processor and inspection house are involved
  • Paperwork is checked before shipment, and every order ships with a certificate of conformance plus the other certs your request requires

If no shop fits, we say so. See also our defense contractor page.

Request an ITAR machining quote

Start with the CNC machining request form and describe the part without attaching controlled files. Give us the classification and quality clauses, and a person will reply within one business day to arrange secure transfer to a registered shop that fits. Read the controlled programs page first if this is your first controlled request with us.

Where buyers source this

Quote this

Send the job. A person replies within 1 business day.

Part, quantity and date are enough to start. Drawings and the mutual NDA follow by reply, and controlled programs never send technical data through this site.

Export classification *

Need to attach drawings or sign the NDA first? Use the full request form.

Questions

Is there such a thing as an ITAR certified machine shop?

No. The ITAR has no certification. A shop can be registered with DDTC under 22 CFR part 122, which is a filing that must be kept current, and it can run a compliance program that keeps controlled data away from foreign persons. When a supplier says it is ITAR certified, ask for its current registration letter and an explanation of how it controls access to technical data. Those two answers tell you more than the label.

Does a machine shop need to register with DDTC if it never exports?

Generally yes. 22 CFR 122.1(a) requires anyone in the United States who manufactures defense articles to register, and it states that a manufacturer who does not export must still register. Narrow exemptions exist, such as fabrication solely for experimental or scientific purposes, but exempt persons still need registration to obtain any license. Your export compliance lead should decide whether an exemption fits a specific job.

How do I verify a shop's ITAR registration?

Ask for the current DDTC registration letter. It shows the registrant code and the expiration date. Check that the legal name and address match the company on your purchase order and that the expiration date covers your schedule. Many suppliers keep the code confidential and share it only with customers, which is normal practice. Also ask whether ownership or management has changed since the last renewal, since registrants must report those changes to DDTC within five days.

Can a registered shop employ foreign nationals?

Yes, but those employees cannot have access to controlled technical data or reveal it through inspection of defense articles unless an authorization from DDTC covers it. Ask how the shop identifies who may work controlled jobs, how it segregates controlled files and parts, and whether any offshore programming, engineering or software support could see your data. A clear, specific answer matters more than the headcount.

Is CMMC Level 2 certification required for machine shops right now?

Not as a default. Phase 1 self-assessments have applied since November 10, 2025. Third-party Level 2 certification was set to become the default on November 10, 2026, but the Department of War suspended Phase 2 on July 13, 2026 pending a task force review. DFARS 252.204-7012, NIST SP 800-171 and SPRS assessments still apply. Check the DoD CIO site for the latest status before writing subcontract terms.

What is the difference between ITAR registration and DFARS 252.204-7012 compliance?

They answer different questions. ITAR registration under 22 CFR part 122 tells DDTC who manufactures or exports defense articles. DFARS 252.204-7012 is a contract clause that requires protecting covered defense information on the contractor's systems using NIST SP 800-171, reporting cyber incidents within 72 hours and flowing the clause to subcontractors. A shop handling a controlled defense drawing often needs both, and one does not prove the other.

Can I send the ITAR drawing with my quote request?

Please do not attach controlled drawings to our quote form. Send the part number, revision, material, quantity and export classification instead. We then arrange secure transfer to US persons at a supplier that has signed a flow-down NDA. Our confidentiality and controlled programs pages describe each step.

Related

Sources

Ready to
source it?

A person replies within 1 business day. NDA first.

Request a quote