How Software Development Companies Can Achieve ITAR Compliance

Transition to U.S.-only data centers

To achieve ITAR compliance, software development companies should migrate their ITAR-controlled data and applications to ITAR-compliant cloud tenants.  Such tenants exclusively work for the U.S. government agencies and their contractors. Azure Gov and Amazon AWS GovCloud (US) are some of cloud tenants compliant with ITAR data sovereignty and access requirements. By migrating to these cloud environments, software development companies ensure ITAR-controlled data is physically located and logically processed only within the U.S. borders. This means that only U.S. persons can access code, files, and other ITAR-controlled technical data.

Deploy enhanced security protocols

Software development companies working on projects under ITAR should implement stringent security controls and layers. Such controls are necessary to ensure ITAR-controlled applications and data are protected from malicious or unauthorized access. ITAR-controlled data should be encrypted in transit  using IPSec and TLS and  at rest using Azure Key Vault or AWS KMS. Its worth noting that these solutions are FIPS 140-2 compliant, a key ITAR compliance requirement for technical data. For instance, AWS KMS HSMs are certified FIPS 140-2 at security level 2. On the other hand, Azure Key Vault is FIPS  140-2 compliant at level 2 or level 3 for software-protected and HSM-protected keys respectively.

Continuous monitoring

Software development companies should limit access to sensitive data by time, location, and unauthorized individuals. Activity monitoring in cloud environments is key to ITAR compliance. Role-based access controls (RBAC) can be used to grant the minimum necessary permissions to the users based on their roles and responsibilities. These companies can also use API rate limiting to enforce a limit to the number of transactions per second that developers and testers can consume.

Companies on AWS tenants can use AWS’s identity federation, key rotation, and access control tools to limit users’ API calls. Software development companies on Azure Government tenants should use Microsoft Entra ID, formerly Azure AD to ensure only authorized processes and users access ITAR-controlled applications and data.  They can use monitoring tools like AWS CloudTrail and Azure Monitor to collect and analyze the logs and metrics related to the data and applications, including who accessed what, where, when, and how. These tools can also generate alerts and reports for compliance audits.

Use GitHub Enterprise Server

Software companies working on projects under jurisdiction of the ITAR should ensure their repositories are private. Thus, the repositories shouldn’t be accessible or visible to the public. Unfortunately, the cloud-hosted service at Github.com is not designed to host applications or data subject to ITAR. This is because it does not have the ability of restricting repository access by country. Therefore, software development companies working on ITAR-controlled data or applications should consider using GitHub Enterprise Server. Software development companies can run this self-hosted virtual appliance within their own virtual private cloud or datacenter. This offering is compliant with Supplement No. 1 to part 740 of the EAR which contains among other things, the proscribed countries under ITAR. Remember, ITAR compliance is an ongoing endeavor. Thus, software development companies should ensure that all measures are in place to protect the ITAR-controlled applications and data.

Update internal policies and train the workforce

Software development companies should update their internal procedures and policies to align with the ITAR compliance requirements and best practices. These policies should entail topics like data classification, handling, retention, disposal and data breach response. User authentication and authorization policies should be in place to prevent unauthorized access to ITAR-controlled data and programs. Additionally, the companies should train their workforce on these policies and on how to use platforms and tools that are involved in ITAR compliance.  This training should also include examples and scenarios of ITAR violations and how to best avoid them. The training should be conducted regularly and updated as needed.