ITAR Training for Employees: What to Cover and What to Record

The ITAR has no general rule requiring employee training, but DDTC’s compliance guidance expects role-based training at least annually, backed by accurate records of who completed it. For a small defense contractor, the training record is the evidence. It shows what each person was taught before they touched technical data.

This guide covers what to teach and what to record. For access decisions, hiring, and remote work, see the companion guide on ITAR requirements for employees.

What does the ITAR itself say about training?

The ITAR (22 CFR parts 120 to 130) does not contain a standalone requirement to train your workforce. Training shows up in two other places that matter to employers.

First, training can be a controlled activity. A defense service under 22 CFR 120.32 includes “the furnishing of assistance (including training) to foreign persons” on defense articles. A technical training deck for a foreign national employee or customer may need authorization. Being internal does not exempt the material.

Second, training becomes evidence after a problem. Under 22 CFR 127.12(c)(3), a voluntary disclosure should address “the details of compliance measures, processes and programs, including training, that were in place to prevent such violations, if any.” One mitigating factor DDTC may consider is whether the company “has instituted or improved an internal compliance program.” See 127.12(b)(3)(iv). If you cannot show what people were taught, that part of the disclosure is hard to write.

What does DDTC guidance expect?

DDTC’s ITAR Compliance Program Guidelines (version 1.1, September 2023) make training Element 5 of an effective compliance program. The document is guidance, not regulation. It states that the AECA and ITAR prevail where the two differ.

Element 5 says training programs should be “tailored, dynamic, up-to-date, and adequately resourced.” It says organizations “should offer training on a recurring basis, at a minimum annually” and “should maintain accurate training records.” The guidelines describe four tiers: all personnel, senior management, positions with export functions, and the export compliance team. They also note that “smaller organizations may adopt this tiered approach or provide comprehensive ITAR training to all personnel” (page 37).

Element 5 ends with accountability. Organizations should put ITAR training in performance plans and reviews, test employees at the end of each session, and issue a certificate of completion when they pass (page 41).

Consent agreements show what DDTC asks for once a case is open. In the 2021 Keysight Technologies consent agreement, paragraph 10 required that employees in ITAR-regulated activities be familiar with the AECA and the ITAR, and that their supervisors understand the underlying policies. It also required “records indicating the names of employees, trainers, and level and area of training received.” DDTC posts other agreements on its Penalties and Oversight Agreements page. Read them for the remedial terms, not the penalty amounts.

Who needs ITAR training at a small contractor?

The guidelines name the usual third-tier roles: program management, technical and engineering staff with access to controlled articles, shipping and receiving, supply chain, business development, human resources, and IT (page 39). Tier 1 training goes to “all new hires and contractors during the onboarding process.”

At a 30-person shop, one person may cover three of those roles. Train the person for every role they hold. Add two groups the tier list does not name: anyone who escorts visitors, and any outside IT provider with administrative access to systems holding technical data.

What should the core modules cover?

Build each module around a decision the employee will face. The guidelines list minimum topics for each tier. The modules below map those topics to the regulation.

• U.S. person vs. foreign person. Teach the definitions in 120.62 and 120.63. Status depends on the categories that section cites (citizenship, lawful permanent residence, or protected-individual status), not on job title or security clearance.
• Deemed exports and release. Releasing technical data to a foreign person in the United States is an export under 120.50(a)(2). Release includes visual inspection, oral or written exchanges, and providing access information such as passwords or decryption keys (120.56). This module matters most for IT staff, who issue credentials.
• Identifying and marking technical data. Tier 3 training should cover “how to handle technical data, including marking procedures” (page 40). Use your own drawings and tickets as examples. The technical data handling guide covers classification in depth.
• Your Technology Control Plan. DDTC lists “training and awareness programs” as a TCP element (page 28). Walk through your plan’s actual rules, not a generic sample.
• Email, cloud, and file sharing. Name the approved systems for technical data and the ones that are off limits. Show how to request access instead of forwarding a file.
• Travel and devices. DDTC recommends “recurring training on travel with mobile devices for new and existing employees” (page 24).
• Visitors. Cover escort duties, screen and whiteboard checks, and what to do when a visitor asks a technical question.
• Reporting. Tell employees who to call and how fast. Explain that 127.12 asks companies to notify DDTC “immediately after a violation is discovered,” which only works if employees report internally first. Route the disclosure decision to your empowered official or a senior officer, with counsel.

How deep should training go for each role?

This is a suggested operating table. Adjust frequency and depth to your risk assessment and contracts.

What should a training record show?

Start with the fields from the Keysight agreement: the employee’s name, the trainer, and the level and area of training. Then add what DDTC’s guidelines and an assessor will look for:

• role and tier at the time of training
• module title and version, with a copy of the materials
• completion date and test result or certificate
• acknowledgment of the TCP and handling policy
• next due date and the trigger that set it

ITAR’s recordkeeping rule, 22 CFR 122.5, covers registrants’ records on defense articles, technical data, and defense services. It does not name training records. Set a retention period with counsel and keep superseded versions of the materials, so you can show what a person was taught on a given date.

The same records can support NIST SP 800-171 Rev. 2. Requirement 3.2.1 covers making managers, administrators, and users aware of security risks and procedures. Requirement 3.2.2 covers training personnel “to carry out their assigned information security-related duties,” and 3.2.3 covers insider threat awareness. NIST SP 800-171A lists “training records” among the objects an assessor may examine for 3.2.1 and 3.2.2. Map each ITAR module to the requirement it supports. For contracts that carry DFARS 252.204-7012, that baseline remains in place under the current CMMC class deviation.

When should training be refreshed?

The annual minimum is a floor. DDTC’s guidelines describe other triggers, and some are practical additions.

Rule changes are not hypothetical. The eCFR source note for 22 CFR 120.54 lists amendments dated August 28 and September 16, 2026. Have the compliance lead check the Federal Register and DDTC’s site on a set schedule, as the guidelines suggest.

Keep the record next to the work

Training records lose value when they sit apart from the systems they describe. An assessor or DDTC reviewer may ask who had access to a folder, whether that person was trained first, and on what date.

If your training records, policy acknowledgments, and controlled files sit in separate tools, request a defense pilot built around your training and access records with IRONKEEP. The private beta brings MAIL, DRIVE, DOCS, CHAT, and MEETINGS into one U.S.-hosted workspace with audit logs, retention, and scoped exports. It does not deliver your ITAR training. Your organization still owns export authorizations, scope, and legal review. Confirm with counsel that a deployment fits your ITAR obligations before you add technical data.

Start with this week’s roster

Pull a list of everyone with access to technical data, including contractors and your IT provider. Next to each name, record the last ITAR training date, the module version, and the role tier. Any blank cell is a gap with an owner and a due date.

Then compare that list against the access list for your controlled folders. Anyone with access and no training record is the first person to train.