%20Logos%202022/sharetru-white-logo.svg){kind=logo}
Why Sharetru?
Platform
Do you believe your products or data are subject to ITAR or DDTC compliance, but you’re unsure how to align with these regulations? Before you can start aligning with compliance standards, you need to know how to conduct ITAR business in alignment with DDTC controls.
Explore this article on how to keep your file sharing practices DDTC and ITAR compliant, and learn how the right secure file sharing solution helps you avoid the risks of noncompliance.
You might have some vague idea of what DDTC and ITAR are, but if you want to be truly compliant and avoid the risk of a fine, you need to have more than a working knowledge of each. Let’s learn more about both DDTC and ITAR, and how they relate to each other.
The U.S. Department of State Directorate of Defense Trade Controls (DDTC) has a mission to ensure“commercial exports of defense articles and defense services are consistent with U.S. national security and foreign policy objectives.”
ITAR, or the International Traffic in Arms Regulations, is a set of government regulations that dictate how companies prevent the distribution of defense items and services to foreign entities. These prohibited items can be found of the USML (United States Munitions List).
To put it simply, you must register with the DDTC to import or export ITAR regulated items. This registration is essential if you want to work with ITAR-covered business prospects, but being registered with the DDTC doesn’t necessarily mean you can start trading or that you are ITAR compliant. It simply means that you’re approved by the DDTC and you now have a registration code. With the registration code, you can apply for an ITAR export license.
Essentially, before you can start importing or exporting ITAR-related items, data or services, you need to be registered with the DDTC. To ensure ITAR and DDTC compliance, you need to follow an established process. Let’s explore the three steps to properly register with DDTC, and how to maintain ITAR compliance.
Before you register with the DDTC, you need to determine if the entire registration process is even necessary. The best way to make that determination is to find out if the items, data, or services your business imports or exports are ITAR controlled.
The first place to start is with the U.S. Munitions List (USML). Review this list to assess if your business exports fall into any of the categories on the list. The USML covers a broad scope of items, from hardware and technical data to defense services. It may take a little research to make sure your items in question are on the list, but it’s better to invest some time and effort into making that determination rather than facing the risks of noncompliance.
In fact, the government provides a few tools to make this determination process easier:
Order of Review Decision Tool - Helps you classify items that are subject to ITAR regulations.
Specially Designed Decision Tool - Provides insight on whether specially designed software or commodities are subject to ITAR.
Part 130 Decision Tree Tool - Focuses on the requirements for reporting political contributions, fees, and commissions as related to ITAR.
Each of these tools ask you a series of questions about the products or services to determine if they fall into the categories listed on the USML. Using these tools, you’ll know if your business commodities are subject to ITAR.
The next step once you’ve determined that your products or services are subject to ITAR is to register your business with the DDTC. This is essential if you want to import, export, manufacture, or broker items or services listed on the USML. This gives the government a better idea of who is dealing in ITAR-related item or services.
To register, you follow a four-step process:
Pay registration fees. (There are differing fee structures starting at $2,250 annually.)
Complete the registration form.
Gather and organize supporting documents. (These could include documents issued by a government authority granting permission to engage in business in the U.S. or in a foreign country.)
Submit your registration paperwork.
Once you’ve completed these steps, your registration will be reviewed. The average review period is 45 days from the time of submission. You can begin the registration process on the DDTC website.
Once your DDTC registration has been approved, you must register for an export license. This license grants you permission to export defense-related articles, services, or data. As part of the export license process, you need to fill out a number of forms, so be sure to factor in the time required to complete the application.
You can find the forms you need to apply for your export license on the DDTC website, too. Once the forms are completed and submitted, and you have been granted a license, you’re ready to start exporting ITAR-covered items and services.
So, where does compliant file sharing come in? Now that you have your export license, you need to take steps to comply with ITAR regulations. One key aspect of compliance is how you share and protect your data. The main objective of ITAR is to prevent sensitive defense-related commodities from falling into the hands of foreign nationals, and this includes data as well as physical products.
Since hackers can easily access data from all over the world, you need a way to store and share files that is impenetrable to unauthorized users. A secure file sharing solution is essential. And, few top solutions have built-in ITAR compliant features.
As you search for the right file sharing solution to adopt in your organization, make sure you choose one with the following features that can help you maintain ITAR compliance:
IP Address Restrictions – With a top file sharing solution, you can restrict solution access to only approved IP addresses. This means users on approved devices only can gain access.
Country Access Restrictions – Since ITAR mandates that only U.S. citizens can access sensitive data, you can restrict access by country, keeping users from other locations out.
Encryption – Your files need to be protected both in transit and at rest. Encryption ensures that data is only decipherable by the sender and the intended recipient.
Secure Physical Locations – When choosing a secure file sharing solution, make sure that they only house data at centers located within the U.S. You also need to verify that all employees working for the FTP host are U.S. citizens, a feature that is often guaranteed by top FTP providers.
As you strive to maintain ITAR and DDTC compliance, a top secure file sharing solution can be your strongest tool. Evaluate your options carefully, and ensure you select one that make compliance easy and keeps you data protected at all times.
