Key Takeaways
- ITAR-compliant box build services require active DDTC registration plus operational controls including U.S. person access management, documented technical data handling and physical segregation of controlled work.
- Registration alone is insufficient. Buyers must verify a supplier’s Technology Control Plan, Empowered Official designation, subcontractor flow-down procedures and five-year record retention practices.
- CMMC and NIST SP 800-171 cybersecurity requirements now flow down through defense contracts, so suppliers must demonstrate System Security Plans and incident-response readiness alongside ITAR controls.
- Production volume fit and sourcing model, turnkey or consignment, directly affect compliance risk and must be evaluated before awarding a controlled box build program.
- Pro-Active Engineering maintains documented controls and certifications for ITAR-compliant box builds. Begin the qualification process with a program discussion.
Where Compliance Fits In A Defense Box Build
As the key takeaways suggest, a defense box build spans four capability categories: system integration, enclosure and mechanical build, testing and quality control and regulatory compliance. For a deeper look at the assembly process itself, see the full box build assembly overview and box build integration services.
The first three categories focus on capability. A supplier must have SMT lines, mechanical integration experience and functional test infrastructure to qualify. The fourth category focuses on qualification and often causes supplier selection problems. A supplier can assemble a complex electromechanical system with precision and still remain unqualified for controlled defense work when its compliance program functions as a filing receipt instead of an operational framework.
What ITAR Compliance Requires Of A Box Build Supplier
DDTC registration under 22 CFR Part 122 is mandatory for any manufacturer of defense articles, even with no exports. It is renewed annually, administrative in nature and grants no export rights or privileges. It proves only that a supplier filed a form.
U.S. person access controls govern who can see drawings, bills of materials, firmware and controlled hardware. Disclosing controlled technical data to a foreign national inside the United States is a deemed export, legally equivalent to shipping that data overseas. A supplier employing foreign nationals in areas where controlled data is accessible needs either specific DDTC licensing or physical and electronic controls that prevent that access entirely.
Technical data handling requires that controlled data be identified, stored, transmitted and logged under documented procedures. Systems storing ITAR data must maintain audit logs capturing who accessed what, when and what they did. Logs must support a DDTC investigation regarding who accessed a specific file on a specific date. Records must be retained for at least five years per 22 CFR 122.5.
Physical segregation separates controlled builds and their documentation from commercial work. To achieve this separation, suppliers must implement controlled-area boundaries, visitor management and access logging as operational requirements rather than administrative formalities.
Each entity in the supply chain carries independent legal responsibility for its own compliance. Subcontractors cannot rely on ITAR compliance from the prime. A supplier that cannot demonstrate subcontractor screening and flow-down documentation creates program risk.
ITAR Registration And ITAR-Compliant Program Execution
Registration alone does not constitute ITAR compliance. A defensible program includes product and technology classification, export license management, foreign national screening, employee training and recordkeeping with an internal audit cadence. A supplier whose answer stops at “we are ITAR-registered” sits at the floor of the requirement.
To expose the gap between registered and compliant, ask these questions during the RFQ process:
- Who physically touches controlled hardware, and how is U.S. person status verified before access is granted?
- How is controlled technical data stored, transmitted and logged, and can the supplier retrieve who accessed a specific file on a specific date?
- How are subcontractors screened and flowed down, and does the supplier know whether their workforces include foreign persons?
- How is access documented, reviewed and revoked when roles change or personnel depart?
- Who is the designated Empowered Official, and what authority does that person hold?
One practical reality affects verification. The DDTC registration database is not publicly searchable the way AS9100D is through the IAQG OASIS database. Buyers must request the registration acknowledgment letter and M-prefix registration code directly from the supplier and cross-reference the code on defense-contract documentation.
How To Verify An ITAR-Compliant Box Build Supplier
The following checklist is structured for direct use in a supplier qualification package. Request each document before award and verify the items that can be independently checked.
- Current DDTC registration acknowledgment letter and M-prefix registration code.
- AS9100D certificate with scope statement, verifiable through the IAQG OASIS database.
- CMMC status and NIST SP 800-171 self-assessment score, with System Security Plan availability.
- Traceability records, including lot and serial traceability, certificates of conformance and first article inspection documentation.
- Written Technology Control Plan and Empowered Official designation.
- Workmanship standard evidence, including IPC-A-610 Class 3 and J-STD-001 alignment.
- CAGE code, verifiable through SAM.gov.
In addition to requesting these documents, watch for red flags that disqualify a supplier from controlled work:
- Claims “ITAR compliant” with no registration code or acknowledgment letter.
- No documented jurisdiction-determination intake process.
- Design data or PLM systems hosted on offshore cloud infrastructure.
- Records older than the five-year retention requirement on the production floor.
- No history of DDTC interactions of any kind.
- Access controls that have not been reviewed, including stale credentials for departed employees or contractors.
Get the compliance documentation package from Pro-Active Engineering to support a structured qualification review.
Cybersecurity Flow-Down As Part Of Supplier Qualification
Beyond ITAR verification, cybersecurity flow-down is now standard in defense contracts and must be evaluated alongside ITAR compliance. ITAR and CMMC are administered by different agencies, the State Department and DoD respectively, and address different concerns, and their controls overlap significantly in access control, audit logging, incident response and vendor management.
CMMC requirements flow down through the defense supply chain regardless of tier. CMMC Level 1 covers Federal Contract Information through self-assessment. CMMC Level 2 is built on the 110 controls in NIST SP 800-171 and protects Controlled Unclassified Information. DFARS 252.204-7012 is the contractual mechanism that flows those requirements to subcontractors handling CUI.
The practical screening test focuses on readiness. A supplier that cannot produce a current System Security Plan and demonstrate incident-response and 72-hour DoD reporting readiness is not ready for controlled work. A supplier can hold ITAR registration and still fail CMMC. The two programs are complementary and serve different purposes.
Contract language continues to evolve. On July 13, 2026, the Department of War announced the suspension of CMMC Phase 2 requirements that had been scheduled for November 2026. All Phase 1 self-assessment requirements remain in force, and all contractually invoked DFARS clauses related to CUI protection remain active. Buyers should confirm the applicable CMMC phase requirements for each specific contract.
Production Volume And Sourcing Model For Controlled Programs
Volume fit matters as much as compliance posture. Prototypes, low-rate initial production and full-rate production each demand different supplier infrastructure. A supplier optimized for one may not scale to the next. Ask how the transition is managed and whether prototypes are built on production processes. A prototype built on a different process than production introduces risk at the worst moment.
Sourcing model shifts the documentation chain. In a turnkey model, the supplier owns component sourcing, counterfeit avoidance and traceability from incoming inspection through shipment. In a consignment model, the buyer supplies parts, but the supplier still owns the documentation of what was done to those parts. Because these models assign responsibility differently, each changes who owns the risk of obsolescence, counterfeit infiltration and chain-of-custody gaps. Clarify this before award.
Suppliers That Align With The Verification Framework
Suppliers that demonstrate the controls described above share a common profile. They maintain active DDTC registration with documented program execution, AS9100D certification verifiable through OASIS, NIST SP 800-171 alignment and CMMC readiness. They operate with written Technology Control Plans, designated Empowered Officials and workmanship standards traceable to IPC-A-610 Class 3 and J-STD-001.
Pro-Active Engineering meets that profile. The company holds ITAR registration, AS9100 and ISO 9001:2015 certifications, JCP certification and Nadcap accreditation. To address cybersecurity flow-down requirements, it maintains NIST 800-171 alignment and CMMC readiness. For counterfeit avoidance, it follows SAE AS5553B methodology. Pro-Active Engineering’s CAGE code is verifiable through SAM.gov.
Pro-Active Engineering’s integrated workflow spans PCB design through box build and full system integration. Domestic U.S. manufacturing, full lot and serial traceability and documentation control are built into every program. The Speed Shop supports rapid prototyping on production processes, so successful development work scales without process risk. A single accountable partner model eliminates vendor fragmentation. This reduces compliance gaps in multi-supplier programs. For a detailed look at compliance documentation practices, see the box build compliance documentation guide.
Other suppliers operating in this space include Milwaukee Electronics, Ducommun, Electronic Technologies International and East West, among others. Buyers should apply the verification framework above to any supplier under consideration, regardless of size or brand recognition.
Frequently Asked Questions
What Does ITAR Compliance Require Operationally Of A Box Build Supplier?
Operational ITAR compliance requires active DDTC registration renewed annually, U.S. person access controls covering all controlled technical data and hardware and documented technical data handling with audit logs and the record retention period mentioned earlier. It also requires physical segregation of controlled work from commercial programs, a written Technology Control Plan, a designated Empowered Official and employee training with documented records. Subcontractor flow-down with independent verification that each entity in the chain maintains its own compliant program completes the framework.
What Is The Difference Between ITAR Registered And ITAR Compliant?
As noted earlier, registration is a filing, not a certification of compliance. ITAR registration is a DDTC filing that demonstrates a supplier submitted Form DS-2032 and paid the annual fee. ITAR compliance means operational controls, including access management, data handling, physical segregation, subcontractor flow-down, training and recordkeeping, function daily and remain defensible to a DDTC auditor.
What Documents Should A Buyer Request From An ITAR Box Build Supplier?
Request the DDTC registration acknowledgment letter and M-prefix registration code, the AS9100D certificate with scope statement for OASIS verification and a NIST SP 800-171 self-assessment score and System Security Plan. Also request the written Technology Control Plan, Empowered Official designation documentation, lot and serial traceability records, certificates of conformance, first article inspection documentation, IPC-A-610 Class 3 and J-STD-001 workmanship evidence and the CAGE code for SAM.gov verification.
How Do CMMC And NIST SP 800-171 Affect Supplier Selection?
DFARS 252.204-7012 flows NIST SP 800-171 requirements to any subcontractor handling Controlled Unclassified Information. CMMC builds on that baseline by adding third-party assessment requirements. A supplier that cannot produce a current System Security Plan, demonstrate incident-response readiness and show the incident-response and reporting readiness described earlier is not ready for controlled work, regardless of ITAR registration status. CMMC Phase 1 self-assessment requirements are in force as of November 2025. Buyers should confirm the applicable CMMC level for each contract.
How Should A Buyer Evaluate Production Volume Fit?
Ask whether the supplier builds prototypes on production processes. A prototype built on a separate process introduces risk when transitioning to low-rate initial production. Ask how the supplier manages the transition from prototype to LRIP to full-rate production and whether the same quality management system and documentation controls apply at each volume level. A supplier optimized for one volume tier may not have the infrastructure to scale without process changes that introduce new qualification risk.
How Does The Turnkey Vs. Consignment Sourcing Model Affect Compliance?
In a turnkey model, the supplier owns component sourcing, counterfeit avoidance under a methodology such as SAE AS5553B and the full traceability chain from incoming inspection through shipment. In a consignment model, the buyer supplies parts, but the supplier still owns documentation of all operations performed on those parts. Each model shifts who bears traceability, obsolescence and counterfeit risk. Clarify the model and its documentation responsibilities before award.
Can A Buyer Independently Verify A Supplier’s DDTC Registration?
The DDTC registration database is not publicly searchable. Buyers must request the registration acknowledgment letter and M-prefix registration code directly from the supplier. AS9100D certification can be independently verified through the IAQG OASIS database. CAGE codes can be verified through SAM.gov. For CMMC status, buyers can request the SPRS report or C3PAO certificate, depending on the applicable phase requirements.
What Happens If A Supplier’s ITAR Program Fails After Award?
An ITAR program failure after award can result in audit findings, contract disqualification, loss of facility clearance and DDTC enforcement action against the supplier, and potentially against the prime if flow-down obligations were not properly documented. Civil penalties can reach over $1.2 million per violation. Criminal exposure includes fines and imprisonment for individuals. The prime contractor’s program remains exposed regardless of whether the violation originated at the sub-tier. Pre-award qualification using a documented verification framework provides the strongest mitigation.
Discuss program requirements with Pro-Active Engineering to review compliance documentation and begin qualification for a controlled box build program.