Straight answers on ITAR, EAR, DFARS, and CMMC.

ITAR compliance means access to technical data named or described on the U.S. Munitions List is safeguarded by secure measures and encrypted communications, and restricted to U.S. Persons and properly licensed individuals only. There is no ITAR certificate: compliance is your controls and what you can prove about them.

ITAR is the State Department's regime for defense articles on the U.S. Munitions List. EAR is the Commerce Department's regime for dual-use items on the Commerce Control List. Different lists, different licensing, and often both apply across one company's catalog. More on the EAR page →

Implementation of the NIST SP 800-171 control families on systems that touch covered defense information: access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity. All fourteen families must be implemented, not just written down.

Full compliance with NIST SP 800-171, rapid reporting of cyber incidents to DoD within 72 hours of discovery, and flow-down of the requirements to your suppliers and subcontractors. Related clauses add a self-assessment score in SPRS (7019) and government assessment access (7020). The full clause family →

Compliance flows down. If your prime carries the clause, so do you, and failure to meet the requirements can cost current contracts and future awards. Being the small shop in the chain doesn't exempt you; it usually means you're the one the requirement lands on with the least warning.

It varies with size and sprawl. For small and mid-sized firms, roughly two weeks is a fair planning number; larger companies can run months. The biggest variables are how many distinct information systems you operate and how far your CUI has spread, which is why shrinking the boundary first shrinks everything else after it.

No vendor can sell you compliance, and you should walk away from any that claims to. What the platform does is carry a large share of the control implementation inside a compliant enclave, collapse your boundary, and generate the evidence, while our team supports your documentation through to assessment.

Handling Federal Contract Information alone still obligates an annual CMMC Level 1 self-assessment, fifteen safeguarding requirements, affirmed by a senior official in SPRS. Almost nobody in the defense supply chain is fully outside the program. Levels explained →