CMMC and ITAR: Does One Satisfy the Other?
By Shaheer Malik · Updated Oct 28, 2026
No: CMMC and ITAR are separate rules, and meeting one does not satisfy the other. CMMC (32 CFR part 170) verifies how DoD contractors protect FCI and CUI. ITAR (22 CFR parts 120–130) controls the export of defense articles, technical data and defense services, including releasing technical data to a foreign person inside the United States. They overlap because ITAR technical data handled under a DoD contract is usually also CUI.[1][2]
Two different regimes
| CMMC | ITAR | |
|---|---|---|
| Purpose | Cybersecurity of contractor systems holding FCI or CUI | Control of exports of defense articles, technical data and services |
| Run by | Department of Defense | Department of State |
| Applies through | DoD contract clauses | Law (Arms Export Control Act), whether or not you have a contract |
ITAR’s authority comes from Section 38 of the Arms Export Control Act, delegated to the Secretary of State.[2]
Where they meet
ITAR technical data includes information “required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles,” such as blueprints and drawings.[2] Under a DoD contract that kind of information typically arrives marked as CUI (export-controlled categories are in the National Archives CUI Registry), which brings CMMC Level 2 and DFARS 252.204-7012 into play.[3][4]
The access question
An export includes “releasing or otherwise transferring technical data to a foreign person in the United States (a deemed export).”[2] Release includes using access information to let a foreign person “access, view, or possess unencrypted technical data.”[2] So for ITAR data you must control who can access systems and cloud services, on top of meeting CMMC. That is why the choice of cloud matters: see does CMMC require GCC High.
Does handling ITAR data require CMMC Level 2?
If you handle it as CUI under a DoD contract with a CMMC requirement, yes, Level 2 at least.[1] ITAR itself does not reference CMMC levels.
Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.
FAQ
Does CMMC satisfy ITAR requirements?
No. CMMC verifies cybersecurity for DoD contracts; ITAR controls exports, including releasing technical data to foreign persons. You must comply with both where both apply.
Is ITAR technical data CUI?
Under a DoD contract it usually is: export-controlled information is a CUI category in the National Archives CUI Registry. Check how your contract marks it.
Does ITAR require CMMC?
No. ITAR applies by law to exports. CMMC applies when a DoD contract includes a CMMC requirement.
Sources
- 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
- 22 CFR part 120, International Traffic in Arms Regulations: purpose and definitions (checked Oct 28, 2026)
- National Archives: CUI Registry, category list (checked Oct 28, 2026)
- DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (checked Oct 28, 2026)
More on the rules behind cmmc
- CMMC vs NIST SP 800-171: The Difference, and Rev 3
- Which DFARS Clause Establishes CMMC? 7021, 7025 and 7012
- SPRS Score and CMMC: What It Is and How It’s Calculated
- FCI vs CUI in CMMC: What Each Is and Why It Matters
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.