Aerospace and defense is the default CMMC audience, so most of what applies here is covered across the rest of this site. What is distinct is the overlap with the International Traffic in Arms Regulations. Many aerospace companies hold data that is both CUI and ITAR-controlled technical data, and the two regimes classify, protect and enforce differently.
Treating ITAR as "covered by CMMC" or CMMC as "covered by our ITAR program" is the most common mistake we see in this sector. This page sets out where the two differ and how to design one environment that satisfies both.
Two regimes, different questions
| ITAR | NIST SP 800-171 / CMMC | |
|---|---|---|
| Purpose | Control export of defense articles and technical data | Safeguard CUI in nonfederal systems |
| Who decides what is covered | The US Munitions List and commodity jurisdiction | The government designator, via the CUI Registry and contract |
| Access test | US person status, or an export authorization | Authorized user with a need for access |
| Assessment | No certification; registration and self-compliance | SPRS self-assessment; DIBCAC reviews; CMMC assessments when resumed |
| Enforcement | Civil and criminal penalties administered by the State Department | Contractual remedies and False Claims Act exposure |
Why ITAR access is stricter
NIST SP 800-171 asks whether a user is authorized. ITAR asks whether the person is a US person — or whether an export license or other authorization covers the release. A foreign national employee who is perfectly authorized under your access control policy can still be the recipient of an unlicensed export if they open an ITAR drawing.
That carries into IT support and cloud services. Administrators with access to ITAR data, including those at managed service and cloud providers, must be US persons or covered by an authorization. This is one of the reasons many aerospace companies use environments such as Microsoft GCC High, which restrict support personnel accordingly; see CMMC enclave vs GCC High.
Where the two regimes reinforce each other
- Access control (3.1.1, 3.1.2) implements both authorization and US-person restrictions when roles carry citizenship or license attributes.
- Personnel screening (3.9.1) is where US-person status is verified and recorded.
- Marking (3.8.4 and the CUI marking rules) should show both the CUI banner and the export control warning.
- Encryption (3.13.11 and 3.13.16) supports the ITAR provision allowing end-to-end encrypted transmission and storage of technical data in some circumstances.
- Incident response (3.6.1, 3.6.2) must account for both DoD 72-hour reporting and possible voluntary disclosure to the State Department.
Cloud and collaboration choices
For data that is both CUI and ITAR technical data, a cloud service must satisfy two tests: DFARS 252.204-7012 requires FedRAMP Moderate or equivalent for CUI, and ITAR requires that the data not be exported without authorization — which in practice means data residency in the United States and support personnel who are US persons, or end-to-end encryption that meets the ITAR conditions. Collaboration with foreign partners, common in aerospace programs, needs export authorizations in place before any technical data is shared, and the sharing mechanism must be inside your protected environment.
Designing one boundary for both
The efficient design is a single protected environment that holds all CUI and all ITAR technical data, restricted to US persons or authorized foreign persons, built to NIST SP 800-171 and documented in one SSP that also records the export control measures. Running two parallel environments doubles cost and confuses users about where data belongs.
Start by classifying data under both regimes, then decide the boundary. CUI categories explains how export-controlled information appears in the CUI Registry, and CMMC Level 2 lists the 110 requirements the environment must meet.
Frequently asked questions
Does ITAR registration satisfy CMMC?
No. ITAR registration with the State Department is unrelated to NIST SP 800-171 compliance. You need both programs if you hold both kinds of data.
Is all ITAR technical data CUI?
Export-controlled technical data provided under a DoD contract is generally treated as CUI, but ITAR data from commercial programs may not be. Classify each data set under both regimes.
Can a foreign national administrator manage our CUI systems?
Not if those systems hold ITAR technical data, unless an export authorization covers it. For CUI that is not export-controlled, NIST SP 800-171 itself does not impose a citizenship test.
Do we report an ITAR data breach to DoD?
If it is also a cyber incident affecting covered defense information, DFARS 252.204-7012 requires reporting to DoD within 72 hours. An unauthorized export may separately warrant a voluntary disclosure to the State Department; take export counsel's advice.