What DDTC Is Finding That Most Programs Are Missing
After working with defense contractors, aerospace manufacturers, and federal program offices across the country, I keep seeing the same pattern: organizations invest in the visible parts of their ITAR export controls compliance program — the registration, the empowered official designation, the initial training — and then leave a long list of operational gaps completely unaddressed. In 2026, with DDTC enforcement activity at elevated levels and voluntary disclosure pressure increasing, those gaps are no longer low-risk oversights. They are active liability.
This post focuses on the areas we consistently identify during compliance assessments that organizations either underestimate or ignore entirely. If your program hasn't been stress-tested recently, assume at least some of these apply to you.
1. Digital Collaboration Tools and ITAR Technical Data Leakage
This is the single largest emerging gap we see right now. Engineering and program teams have adopted cloud-based collaboration tools, AI-assisted design platforms, and real-time document-sharing environments faster than compliance programs can track. The result is that ITAR-controlled technical data is regularly transmitted through systems that have never been assessed for compliance.
Common failure points include:
- Sharing CAD files, performance specifications, or test data through standard commercial cloud storage
- Using AI writing or design tools where data may be stored, processed, or used for model training on non-ITAR-compliant infrastructure
- Conducting video meetings that include screen shares of controlled technical data without verifying participant nationality
- Storing ITAR data in shared workspaces accessible to foreign nationals employed by the company or a vendor
If your acceptable use policy and IT controls were written before your team adopted these tools, your policy is already out of date. For a deeper look at the digital environment requirements, review our guidance on ITAR controlled technical data in cloud environments.
2. Inadequate Visitor Management and Facility Access Controls
Physical access controls remain one of the most frequently cited deficiencies in DDTC enforcement actions, yet they are treated by many organizations as a facilities management issue rather than a compliance issue. They are both.
Effective visitor management under ITAR requires more than a sign-in sheet and a badge. It requires a documented process that:
- Identifies foreign national visitors in advance and verifies whether a license or license exception applies
- Restricts access to areas where controlled technical data or hardware is visible or accessible
- Uses color-coded badging systems that communicate access levels to all personnel without requiring verbal instruction
- Maintains a defensible visitor log that can be produced during an audit
Organizations that have upgraded their physical compliance posture often start with the basics: ITAR-compliant visitor log books and standardized color-coded visitor badges that communicate access restrictions at a glance. These aren't administrative formalities — they are evidence of a functioning compliance program. Our blog on ITAR visitor requirements walks through exactly what needs to be in place before a foreign national enters your facility.
3. Deemed Export Failures Related to Foreign National Employees
The deemed export rule is one of the most misunderstood concepts in ITAR. Releasing controlled technical data to a foreign national inside the United States — whether verbally, visually, or electronically — constitutes an export to that person's country of nationality. Most compliance managers understand this in theory. Far fewer have built the operational controls to manage it in practice.
Where programs break down:
- HR onboarding that does not systematically flag foreign national status for compliance review
- Engineering leads who share technical data with teammates without checking nationality records
- No process for reviewing access permissions when an employee's visa status changes
- Subcontractor agreements that do not flow down deemed export obligations
This is not a theoretical risk. Our post on ITAR compliance and hiring foreign nationals outlines the specific considerations that compliance and HR teams need to work through together. If your program does not include a formal deemed export review process tied to your HR workflow, that gap needs to close immediately.
4. Subcontractor and Supply Chain Oversight
Prime contractors typically have mature ITAR programs. Their subcontractors frequently do not — and the prime is still responsible for what flows down the supply chain. DDTC has made clear that inadequate subcontractor oversight is not a mitigating factor; it is an aggravating one.
What adequate supply chain oversight looks like in 2026:
- Written ITAR compliance representations in all subcontract agreements
- Periodic audits or questionnaires for subcontractors who receive controlled technical data or hardware
- Documented verification that subcontractors are registered with the State Department if required
- Clear contractual language on what happens when a subcontractor has a potential violation
If you are a manufacturer operating in the defense industrial base, the compliance obligations extend well beyond your four walls. Our overview of ITAR compliance considerations for manufacturers addresses how companies in production environments should structure these supply chain controls.
5. Training Programs That Check a Box Without Changing Behavior
Annual ITAR training that consists of a 20-minute video and a multiple-choice quiz is not a compliance program. It is a documentation artifact. In 2026, DDTC and enforcement patterns consistently show that most violations do not happen because employees intended to break the rules — they happen because employees did not understand how the rules applied to their specific job function.
An effective ITAR training program in 2026 must:
- Be role-specific, not generic — engineers need different content than program managers, who need different content than shipping personnel
- Address the actual tools and workflows employees use, including cloud platforms and collaboration software
- Occur more frequently than once annually for high-exposure roles
- Include documented attestation and records that can be produced during a DDTC inquiry
Our post on why annual ITAR training isn't enough in 2026 makes the case for a more rigorous approach. For compliance managers looking for a practical foundation, our ITAR and Export Controls Fundamentals guide provides a structured reference for building role-based training content that actually holds up.
6. Incomplete or Outdated Compliance Documentation
When DDTC opens an inquiry — whether voluntary or as a result of a tip — the first thing they request is documentation: your Technology Control Plan, your empowered official designation, your training records, your license and license exception files, and your internal audit history. Organizations that cannot produce complete, current, and internally consistent documentation are in a significantly worse position than those that can, regardless of whether an actual violation occurred.
The most common documentation failures we encounter:
- Technology Control Plans that were written three years ago and never updated to reflect new business lines, facilities, or tools
- License files that lack associated records of who received the export and when
- No documented internal compliance audit history
- Empowered official designations that are not current following personnel changes
For organizations that need to build or rebuild their documentation foundation, the ITAR Compliance Documentation Toolkit provides a practical starting point. A well-maintained documentation set is also what separates a minor corrective action from a penalty order when DDTC does come knocking.
7. Misunderstanding the Intersection of ITAR and Cybersecurity Obligations
ITAR does not have a cybersecurity checklist the way CMMC or DFARS 252.204-7012 does, but that does not mean cybersecurity is irrelevant to ITAR compliance. An unauthorized intrusion that results in the exfiltration of ITAR-controlled technical data is, by definition, an unauthorized export. DDTC has been explicit on this point.
Compliance managers need to ensure that their IT security controls — particularly around access management, data loss prevention, and endpoint security — are calibrated to protect ITAR technical data specifically, not just CUI or general proprietary information. The ITAR export control compliance audit checklist we published outlines the specific intersections between IT controls and ITAR program requirements that examiners focus on. Organizations with overlapping CMMC and ITAR obligations should also be reviewing our guidance on CMMC, CUI, and DFARS compliance to ensure the two programs are aligned rather than managed as separate silos.
Where to Start If Your Program Has Gaps
The good news is that most of these gaps are addressable with structured, practical effort. The bad news is that many organizations do not discover them until they are already in a DDTC inquiry or have lost a contract opportunity due to compliance concerns raised during due diligence.
A compliance gap assessment focused specifically on ITAR export control obligations gives you an independent, documented view of where your program stands — before an enforcement action forces that conversation. It also gives you a defensible record of good-faith effort if a violation does surface.
If you are not sure where your program stands, that uncertainty is itself an answer. Mature ITAR programs do not leave compliance managers unsure. They provide clear visibility into what is controlled, who has access to it, what licenses and exceptions apply, and where the documentation trail lives.
Take the Next Step Toward a Defensible ITAR Program
At Cleared Systems, we work with defense contractors, aerospace companies, and federal program teams to identify and close ITAR compliance gaps before they become enforcement actions. Whether you need a full program assessment, help rebuilding your Technology Control Plan, or ongoing support through our Regulatory vCISO services, we bring the operational depth to make your program defensible — not just documented. Request a quote today and let us show you exactly where your ITAR export control compliance program stands and what it will take to bring it up to 2026 standards.