ITAR is the US rule that controls defense-related products, drawings and services. If your company makes, handles or supports anything on the US Munitions List, the people who touch that work need to understand the rules. Start with a job title and we will show the level we recommend, why, and what your whole team needs.
Controlled product. Anything on the US Munitions List — a part, an assembly, a test rig. If it was designed or modified for a defense application, assume it counts until someone qualified says otherwise.
Technical data. The information needed to design, make, repair or test one of those products: drawings, 3D models, specifications, source code, test results, process sheets. This is the term that catches people out, because it is information rather than an object.
Export. Not just shipping. Emailing a drawing abroad is an export. So is showing it on a screen share, or letting a foreign employee read it at the next desk — that last one counts even though nothing left the building.
US person. A US citizen, lawful permanent resident, or protected individual. Anyone else is a foreign person, and giving them access to controlled technical data needs its own government approval.
Each row is a group of people who hold the same roles. Give one person several roles and we count them once, which is the normal case in a small company where the owner also runs shipping.
31 roles, grouped by function. Expand any role to see why it lands where it does. Only two things drive a recommendation: whether the role touches controlled technical information, and whether it carries authority over export decisions.
| Role | Recommended levels | Technical data | Export authority | |
|---|---|---|---|---|
|
Receptionist / front desk
|
01Introduction
|
No | No | |
|
Why: Decides who gets past the lobby and what a visitor sees or overhears on the way through. No access to controlled drawings or parts, but visitor sign-in and escort rules are the first physical control in any compliance program, and this is the desk that applies them.
|
||||
|
Administrative assistant
|
01Introduction
|
No | No | |
|
Why: Handles documents, calendars and correspondence that can contain controlled information without being labelled as such. The skill this role needs is recognising when something should not be forwarded, printed or discussed on a call.
|
||||
|
Finance / accounting
|
01Introduction
|
No | No | |
|
Why: Sees contracts, shipping paperwork and invoices that are the written evidence of an export. Records have to be kept for five years and produced if the government asks, and finance usually owns where they live.
A CFO is an officer of the company, but not in the export sense. What moves someone up this list is authority over export decisions — signing licence applications — not seniority or a title with "officer" in it. |
||||
|
Human resources
|
01Introduction
02Intermediate
|
Some | Some | |
|
Why: Works out and documents whether each employee is a "US person" — a citizen, permanent resident or protected individual. That single determination gates who may be given access to controlled drawings and data, so every access decision downstream rests on HR getting it right. Intermediate is where the rules on foreign employees are covered.
|
||||
|
Facilities / maintenance / janitorial
|
01Introduction
|
No | No | |
|
Why: Has keys to the areas where controlled parts and drawings sit, often alone and out of hours. Access is what matters here, not what the job involves.
|
||||
|
Marketing / communications
|
01Introduction
02Intermediate
|
Some | Some | |
|
Why: Decides what goes on the website, in a brochure and on the trade show stand. Publishing a controlled specification counts as an export to everyone who can read it, and judging what is safely public is genuinely difficult, which is why this role gets the second level.
|
||||
| Role | Recommended levels | Technical data | Export authority | |
|---|---|---|---|---|
|
Manufacturing / production
|
01Introduction
+ Intermediate if
|
Some | No | |
|
Why: Physically handles controlled parts. Whether the job also involves controlled drawings and programs depends entirely on how your shop runs, so answer the question below rather than assume.
Conditional: These people work from drawings, 3D models, CNC programs or written work instructions → add Intermediate. |
||||
|
Warehouse / stockroom
|
01Introduction
+ Intermediate if
|
Some | No | |
|
Why: Holds and moves controlled parts. It becomes an export question the moment someone packs a box for an address outside the United States.
Conditional: These people prepare or hand over shipments that leave the United States → add Intermediate. |
||||
|
Quality / QA inspector
|
01Introduction
02Intermediate
|
Yes | No | |
|
Why: Reads drawings, tolerances and specifications all day, and the inspection reports this role writes are themselves controlled information. Commonly missed on training lists because the job title does not sound technical.
|
||||
|
Shipping / logistics
|
01Introduction
02Intermediate
|
Some | Some | |
|
Why: Carries out the export itself. Declarations, values, the licence or exemption quoted on the paperwork, and the records that have to survive an audit all pass across this desk.
|
||||
|
Document control / configuration management
|
01Introduction
02Intermediate
|
Yes | Some | |
|
Why: Owns how drawings and specifications are marked, revised and distributed. If a controlled document is marked wrongly here, every control that depends on that marking fails quietly and nobody finds out until an audit.
|
||||
| Role | Recommended levels | Technical data | Export authority | |
|---|---|---|---|---|
|
Engineer / designer
|
01Introduction
02Intermediate
|
Yes | No | |
|
Why: Creates and changes the drawings, models and calculations that ITAR calls technical data. Sending one of those files to the wrong supplier, colleague or cloud folder is an export, with no parcel and no border crossing involved. Intermediate covers exactly that.
|
||||
|
Drafter / CAD technician
|
01Introduction
02Intermediate
|
Yes | No | |
|
Why: Produces the drawings themselves, so the exposure is the same as an engineer even though the role carries less program context.
|
||||
|
Software / firmware engineer
|
01Introduction
02Intermediate
|
Yes | No | |
|
Why: Source code for a controlled product is controlled information in the same way a drawing is. A public repository, an overseas contractor or a build server in the wrong region are each an export, and none of them look like shipping something.
|
||||
|
IT administrator
|
01Introduction
02Intermediate
|
Yes | Some | |
|
Why: Decides where controlled files are stored, who can reach them and which countries they are backed up to. Administrator rights mean effective access to everything, whatever the job description says.
|
||||
|
Cybersecurity
|
01Introduction
02Intermediate
|
Yes | Some | |
|
Why: Protects the systems holding controlled information, and usually owns the related NIST 800-171 and CMMC work. You cannot defend data properly without knowing which of it is controlled and why.
|
||||
| Role | Recommended levels | Technical data | Export authority | |
|---|---|---|---|---|
|
Contracts / procurement
|
01Introduction
02Intermediate
|
Yes | Some | |
|
Why: Passes requirements down to suppliers, accepts them from primes, and sends drawings out to vendors for quotes. A clause that does not get passed down to a supplier is a contracts failure, and it is the company holding the prime contract that answers for it.
|
||||
|
Sales / business development
|
01Introduction
02Intermediate
|
Some | Some | |
|
Why: Answers enquiries from abroad, works trade shows, and sends capability information to prospects. Arranging a sale of a controlled product between two other parties can require its own approval, and a quote package often contains controlled drawings.
A Sales Engineer belongs here rather than under engineering. The first word carries the exposure, not the second. |
||||
|
Field service / installation technician
|
01Introduction
02Intermediate
03Advanced
|
Yes | Some | |
|
Why: Helping a foreign customer install, repair, operate or maintain a controlled product needs government approval in its own right, even when no drawing and no part changes hands. Showing someone how to do something counts. This is the highest-exposure role outside the compliance team, and the one most often trained at the lowest level.
|
||||
|
Program / project manager
|
01Introduction
02Intermediate
|
Yes | Some | |
|
Why: Sits between engineering, suppliers and the customer, and is usually the person who decides what gets shared with whom to keep a schedule. The job is recognising that as an export decision before making it.
|
||||
|
Travel / mobility coordinator
|
01Introduction
02Intermediate
|
Some | Some | |
|
Why: Books the trips where laptops, phones and sample hardware leave the country. There is an allowance for taking controlled information abroad on your own laptop, but it has conditions, and this is the desk that needs to know them.
|
||||
| Role | Recommended levels | Technical data | Export authority | |
|---|---|---|---|---|
|
Export coordinator / licensing specialist
|
01Introduction
02Intermediate
03Advanced
|
Yes | Yes | |
|
Why: Prepares licence applications and agreements, applies exemptions and keeps the records. Advanced covers enforcement, voluntary disclosure, audits and transfers to third parties, which is the everyday material of this job.
|
||||
|
Internal ITAR auditor
|
01Introduction
02Intermediate
03Advanced
|
Yes | Yes | |
|
Why: Exists to find problems before the government does, which means knowing what a violation looks like in a records system rather than in a textbook.
|
||||
|
Facility security officer (FSO)
|
01Introduction
02Intermediate
03Advanced
|
Yes | Yes | |
|
Why: A formally appointed role for companies handling classified work, and in practice the person who ends up owning visitor control, foreign national access and the training records themselves.
FSO and export control officer are separate appointments under separate rules. Smaller contractors give both jobs to one person — if yours does, add both roles to the same group and we will count that person once. |
||||
|
Export control officer
Also covers ITAR compliance manager, compliance director, and general counsel with export responsibility. |
01Introduction
02Intermediate
03Advanced
04Manager
|
Yes | Yes | |
|
Why: Owns the compliance program from end to end: writing it, funding it, training against it, and reporting when it fails. All four levels, because the fourth is the one about designing a program rather than following one.
|
||||
|
Empowered Official
|
01Introduction
02Intermediate
03Advanced
04Manager
|
Yes | Yes | |
|
Why: The named person who signs licence applications and agreements on the company's behalf, and who must be free to look into any matter and refuse to sign. That takes the whole picture, from what counts as a controlled product through to how the program is governed.
Finishing the training does not make someone an Empowered Official. The regulation sets its own conditions, including US person status and the legal authority to commit the company. The appointment is a decision your company makes and documents; training supports it. |
||||
| Role | Recommended levels | Technical data | Export authority | |
|---|---|---|---|---|
|
Owner / CEO / president
|
01Introduction
04Manager
|
Some | Yes | |
|
Why: Answerable for the program, signs the policy, and decides whether it is funded. The fourth level covers program design, personal and corporate liability, and what has to be reported when something goes wrong.
Levels two and three are deliberately left out here — they teach licence mechanics an owner delegates. If this owner also signs licence applications, add Empowered Official to the same group instead and the recommendation becomes all four levels. |
||||
|
Executive leadership (COO, VP, GM)
|
01Introduction
04Manager
|
Some | Yes | |
|
Why: Makes the operating calls a compliance program either survives or does not: who to hire, what to send offshore, how hard to push a schedule. The fourth level is about governing those decisions.
|
||||
|
Board member with ITAR oversight
|
01Introduction
04Manager
|
No | Yes | |
|
Why: Oversees without touching the work. Needs enough of the basics to read a compliance report critically, and enough of the governance material to know what to ask for.
|
||||
| Role | Recommended levels | Technical data | Export authority | |
|---|---|---|---|---|
|
Consultant / 1099 contractor / temp
|
01Introduction
+ Intermediate if
|
Some | No | |
|
Why: The rules care about who has access, not who is on payroll. A contractor with your drawings on their laptop is the same exposure as an employee with them.
Conditional: These people do technical work with our drawings, models, code or specifications → add Intermediate. Add their actual job as well. A contract stress engineer should be grouped with Engineer, not left on the first level alone. |
||||
|
Intern / co-op / apprentice
|
01Introduction
+ Intermediate if
|
Some | No | |
|
Why: Short stay, wide curiosity, and often a student visa. That combination is why interns turn up in enforcement cases far out of proportion to their numbers.
Conditional: These people will work with drawings, models, code or specifications during their placement → add Intermediate. Check US person status before granting any access, not in the final week of the placement. |
||||
This matrix is a recommendation built from the regulation and from what we see inside defense contractor programs. It is not a compliance opinion about your company.
ITAR does not name any course or level. What it requires is that people who handle controlled products, drawings and services understand the rules that apply to their own work. Government compliance guidance expects that training to be documented and matched to the job, which is what this matrix is for. Treat every row as a recommended baseline rather than a legal requirement.
Two questions. Does the role touch controlled technical information — drawings, 3D models, specifications, source code, test results? And does it carry authority over export decisions, such as licences, shipments, agreements, or signing on the company's behalf? Roles that touch neither take the first level. Technical information adds the second. Authority adds the third. Owning the compliance program adds the fourth. Seniority on its own changes nothing.
No. Empowered Official is a defined role with its own conditions: the person must be a US person, legally able to sign licence applications for the company, and positioned to look into any matter and refuse to sign. Training supports someone appointed to that role. It does not qualify anyone for it, and neither does a certificate.
Plan on once a year. Certificates themselves do not expire, but the training verification letters that primes and auditors ask for list only the people who completed training in the previous twelve months, so an annual refresh is what keeps that letter complete. Foreign-person employees take the same training as everyone else — and note that training is not permission to give them access to controlled information, which needs its own approval.