Most of us know this already, but many remain confused by what is meant when a contract partner ask them to “certify” that their company is “ITAR compliant”.
First, to clear away some common misconceptions, certifying that your company is ITAR compliant does NOT mean that your company has:
- qualified for some industry standard;
- been certified by some government agency; or
- registered with the State Department’s Directorate of Defense Trade Controls (“DDTC”).
Rather, an ITAR certification is a representation your company makes to another company to the effect that your company has:
- registered with DDTC;
- implemented an adequate internal compliance program; and
- trained its workers to understand what they need to do to comply with the ITAR.
So, while DDTC registration is a necessary element of ITAR compliance, it is not by itself sufficient. Registration is something you can do on your own, but I’ll happily walk you through the steps.
For an overview of what’s involved in implementing an internal compliance program, please refer to my post entitled “Compliance For Managers”.