The Moment After You Submit: What Most Companies Don't Know
Filing an ITAR voluntary disclosure with the Directorate of Defense Trade Controls (DDTC) is one of the most consequential decisions a defense contractor or exporter can make. Most compliance managers spend significant energy preparing the submission itself. What they are far less prepared for is everything that comes after.
The post-submission period is not passive. DDTC reviews are active, documented, and increasingly rigorous. In 2026, with enforcement scrutiny at elevated levels, understanding the realistic timeline and managing your organization's posture throughout the review process is just as important as the quality of the initial disclosure package.
This post walks through what actually happens after you file, phase by phase, so your leadership team knows what to expect and how to stay ahead of the process.
Phase One: Acknowledgment and Initial Review (Weeks 1–8)
After submission, DDTC will issue a written acknowledgment confirming receipt of your voluntary disclosure. This acknowledgment includes a case number and assigns the matter to an Office of Defense Trade Controls Compliance (DTCC) analyst. Receipt of this acknowledgment does not mean the matter is resolved or that penalties are off the table. It means the clock has started.
During the first several weeks, DDTC conducts an initial intake review. Analysts evaluate whether the disclosure is complete, whether the described violation falls within ITAR jurisdiction, and whether any immediate national security concerns require escalated handling. Disclosures involving third-country transfers, classified programs, or parties of concern tend to receive faster and more intensive scrutiny.
What you should be doing during this phase:
- Ensure all supporting documentation referenced in the disclosure is organized, accessible, and ready to produce on request
- Brief your legal counsel and compliance team on the submission so responses can be coordinated quickly
- Freeze any records, systems, or personnel files related to the disclosed matter to prevent inadvertent destruction
- Avoid any additional exports, transfers, or activities that could be construed as continuation of the violation
If you worked with an ITAR and export controls compliance consultant to prepare the submission, this is the time to keep that relationship active. Questions from DDTC can arrive quickly, and response windows are not always generous.
Phase Two: DDTC Substantive Review and Possible Follow-Up Requests (Weeks 8–24)
The substantive review phase is where most of the DDTC analytical work happens. An analyst or team of analysts will review the disclosed facts against the United States Munitions List (USML), evaluate the scope of unauthorized activity, assess the adequacy of your remediation measures, and consider any aggravating or mitigating factors.
During this phase, DDTC may send a request for additional information. These requests are sometimes called Requests for Additional Information (RAIs) and can cover a wide range of topics, including:
- Clarification of specific transactions or transfers described in the disclosure
- Documentation of your compliance program at the time of the violation
- Evidence of corrective actions already taken
- Details about individuals involved and their roles
- Records of training, technology control plans, or access controls
Responding to RAIs accurately, promptly, and completely is critical. Incomplete or evasive responses can convert a cooperating company into one that appears obstructive, which significantly changes how DDTC weighs the disclosure. If you need to rebuild the underlying documentation during this phase, resources like the ITAR Compliance Documentation Toolkit can help you organize and present evidence in the format reviewers expect.
This is also a phase where having expert voluntary disclosure support makes a measurable difference. Consultants who have worked through prior DDTC reviews understand the language analysts use, the patterns of follow-up questions, and how to frame remediation in terms that resonate with the agency.
Phase Three: DDTC Determination and Disposition (Months 4–18+)
The timeline for a final DDTC determination varies considerably based on the complexity and severity of the disclosed violation. Simple, isolated violations with strong remediation may be resolved in four to six months. Complex matters involving multiple transactions, foreign parties, or systemic compliance failures can extend to eighteen months or longer.
DDTC has several disposition options available at the conclusion of its review:
- Closure with no further action: DDTC determines the matter is resolved and closes the case. This outcome is more common when the violation was minor, isolated, promptly disclosed, and accompanied by meaningful corrective action.
- Warning letter: DDTC issues a formal written warning that is placed in the company's regulatory file. No penalty is assessed, but the letter becomes part of the company's enforcement history.
- Consent agreement: A negotiated resolution that typically includes monetary penalties, enhanced compliance obligations, and an external compliance officer or auditor for a defined period. Consent agreements are publicly posted on the DDTC website.
- Referral for further enforcement action: In serious cases, DDTC may refer the matter for additional administrative or criminal enforcement through the Department of Justice.
The voluntary nature of the disclosure is a mitigating factor in every one of these outcomes. DDTC's own guidelines confirm that self-disclosure typically results in significantly reduced penalties compared to violations discovered through audits, tips, or enforcement investigations. That said, mitigation is not elimination. The strength of your compliance program before the violation, the scope of the breach, and the quality of your remediation all factor into the final determination.
What DDTC Looks for When Evaluating Your Remediation
Throughout the review process, DDTC analysts are evaluating not just what happened, but what your organization did about it. Remediation that is cosmetic or poorly documented will not carry the same weight as remediation that is specific, verifiable, and proportionate to the root cause of the violation.
Strong remediation typically includes:
- A documented root cause analysis identifying exactly how the violation occurred
- Updated or newly implemented written policies and procedures addressing the gap
- Targeted employee training with documented completion records
- Enhanced technology controls, including data labeling, access restrictions, and export screening enhancements
- Changes to governance structures, such as designating or empowering a compliance officer with appropriate authority
- External audit or assessment confirming the adequacy of corrective actions
Organizations that can demonstrate a mature, functioning compliance program development effort tied directly to the remediation tend to receive more favorable treatment. DDTC is not simply penalizing past conduct; it is trying to determine whether future violations are likely. Showing institutional change matters.
For companies that need to assess where their broader compliance posture stands during this process, a structured review through regulatory vCISO services can surface gaps before DDTC does, giving your organization the opportunity to address them proactively.
Parallel Obligations During the Review Period
While DDTC reviews your disclosure, your organization still has active regulatory obligations. ITAR registration renewals must continue on schedule. Any pending export license applications should be evaluated with counsel to determine whether they can proceed or should be held pending resolution of the disclosure. Employees handling ITAR-controlled technical data or hardware need to maintain their training and access controls without interruption.
It is also worth noting that a pending voluntary disclosure does not insulate your organization from additional scrutiny. If a second violation occurs during the review period and is not disclosed, the damage to your credibility with DDTC can be severe. Many compliance managers choose to conduct an internal audit of their entire export compliance program during this period precisely to identify and disclose any additional issues before DDTC finds them independently.
For a detailed look at how the filing decision itself should be made, our post on when and how to file an ITAR voluntary disclosure covers the preparation phase in depth.
Realistic Expectations for 2026
The enforcement environment at DDTC in 2026 reflects a sustained emphasis on systemic compliance failures, particularly those involving technology transfer, foreign national access controls, and digital export pathways. Disclosures involving technical data transmitted via uncontrolled cloud environments or collaboration platforms are receiving heightened attention. Companies with documented Technology Control Plans and ITAR-controlled technical data controls in cloud environments are better positioned during the review process.
Expect longer review timelines compared to five years ago. DDTC's caseload has increased alongside the growth of the defense industrial base. Plan for a minimum of six months for even straightforward matters, and build your internal planning assumptions around a twelve-month horizon for anything involving multiple transactions or foreign parties.
Throughout the process, maintain communication discipline. All correspondence with DDTC should be reviewed by qualified counsel or a compliance consultant before submission. Verbal representations should be avoided. Document every interaction with the agency, including phone calls.
How We Support Companies Through the DDTC Review Process
At Cleared Systems, we provide ITAR voluntary disclosure support from initial disclosure preparation through final resolution. Our team has worked with defense contractors, manufacturers, and technology companies navigating DDTC reviews of varying complexity, and we understand what DDTC analysts are looking for at each phase of the process.
Whether you need help responding to a Request for Additional Information, rebuilding your compliance program documentation, or preparing your leadership team for the full timeline ahead, we are ready to work alongside your legal counsel to protect your organization's interests and demonstrate credible remediation to the agency.
If your organization has recently filed a voluntary disclosure or is considering doing so, request a consultation with our team today. The decisions you make in the weeks and months after filing shape how DDTC perceives your company's commitment to compliance, and that perception matters more than most executives realize until it is tested.