ITAR Visitor Screening & Access Control
Meeting 22 CFR 120-130 foreign national requirements through systematic visitor screening, because a foreign visitor who reaches controlled technical data without authorization is a potential deemed export violation.
Every Foreign Visitor Is a Potential Export-Control Event
The International Traffic in Arms Regulations (ITAR), codified in 22 CFR Parts 120-130, impose strict controls on who can access defense articles, technical data, and defense services. Under the “deemed export” rule, releasing controlled technical data to a foreign person, even on US soil, is an export to every country where that person holds or has held citizenship or holds permanent residency (22 CFR § 120.50).
For defense contractors, this means every foreign visitor at a facility where ITAR-controlled data exists represents a potential export control event. A foreign national who reads a controlled schematic on a whiteboard, sees USML equipment on a manufacturing floor closely enough that it reveals technical data, or overhears a technical discussion about a defense article may have received a deemed export, regardless of intent.
Willful violations can be prosecuted, with criminal fines of up to $1,000,000 per violation and up to 20 years in prison (22 U.S.C. 2778(c)). Civil penalties do not require intent: the Directorate of Defense Trade Controls (DDTC) can impose them for an accidental or negligent exposure. The civil maximum is the greater of $1,271,078 or twice the value of the transaction, per violation (22 CFR § 127.10, as adjusted for inflation in January 2025). Maximums are periodically adjusted, so confirm current figures with export-control counsel.
The Deemed Export Problem
Under 22 CFR § 120.50(a)(2), a “deemed export” occurs when controlled technical data is released to a foreign person within the United States, and § 120.56 defines what counts as a release. Your visitor management system is the first (and often only) line of defense against uncontrolled deemed exports at the facility level.
ITAR Requirements for Physical Access Control
The ITAR framework imposes specific requirements on defense contractors that directly affect how visitors are screened, admitted, escorted, and documented at facilities handling controlled articles.
US Person vs. Foreign Person (22 CFR § 120.62 / § 120.63)
ITAR defines a “US Person” as a US citizen, lawful permanent resident, protected individual under 8 U.S.C. § 1324b(a)(3), or any entity incorporated in the US. Everyone else is a “foreign person.” This determination is the threshold question for every visitor, and it must be made before access is granted.
Dual nationals present additional complexity. A visitor who holds both US and foreign citizenship is generally treated as a US Person, but specific country combinations may trigger additional screening requirements under sanctions programs. For a foreign person, a release is deemed an export to every country where they hold or have held citizenship or hold permanent residency (22 CFR § 120.50(b)), not only the passport they present.
Deemed Exports (22 CFR §§ 120.50 and 120.56)
Releasing controlled technical data to a foreign person in the United States is an export (§ 120.50(a)(2)), “deemed” to go to every country where that person holds or has held citizenship or holds permanent residency (§ 120.50(b)). Under § 120.56, technical data is released through visual or other inspection of a defense article that reveals technical data, through oral or written exchanges (discussing controlled specifications, handing over a drawing), and through access information that lets the person reach unencrypted technical data.
A foreign visitor walking through a manufacturing floor where USML items are being assembled may receive a deemed export if what they can see along the route reveals technical data, even if no one shows them anything on purpose. Presence in the area is not the test on its own: what the route exposes is, and deciding that belongs to your export-control officer.
Technology Control Plans (TCP)
A Technology Control Plan defines how a facility physically and procedurally separates controlled from uncontrolled areas. TCPs specify which zones require ITAR clearance, which require escort, and which are accessible to all visitors. Your visitor management system must enforce the TCP, not just document it.
This means zone-based access control tied directly to each visitor's export classification, with badge issuance reflecting the approved access posture and mandatory escort assignment for foreign nationals in controlled zones.
Record-Keeping Requirements (22 CFR § 122.5)
ITAR-registered manufacturers and exporters must maintain records of all exports and deemed exports for a minimum of five years. For visitor management, this means retaining visitor identity, nationality, screening results, zone access logs, escort assignments, and any technical data access documentation for every foreign visitor. Section 122.5 allows a record to be changed only if the change, who made it, and when are recorded too.
The 5 Critical ITAR Failure Points in Visitor Management
Visitor programs at export-controlled facilities tend to fail in the same five places. Each one independently creates deemed export exposure, and a program can have several at once.
1.No Citizenship Capture at Registration
Most visitor management systems collect a name and a company. They do not ask for citizenship, dual-nationality status, or country of origin. Without that data, you have no defensible way to evaluate US Person status under ITAR, and no documentation showing whether a visit to a controlled area should have been treated as a deemed export.
22 CFR § 120.62: US Person Definition2.No Pre-Arrival Screening Against Restricted Lists
Foreign nationals should be screened against the OFAC SDN list, BIS Entity List, BIS Denied Persons List, and the DDTC Debarred Parties List before they arrive on site. Screening after arrival, or not screening at all, means a restricted person may have already accessed controlled technical data before anyone knew.
22 CFR § 127.1: Violations3.No Zone-Based Access Enforcement
Technology Control Plans separate ITAR-controlled areas from uncontrolled ones, physically and logically, because a visit is one place release by inspection can happen. A visitor badge that grants access to the entire facility, including labs, manufacturing floors, or engineering spaces with controlled technical data, creates an uncontrolled deemed export exposure for every foreign visitor.
22 CFR § 120.56: Release by Inspection4.No Mandatory Escort Workflow
The ITAR itself sets no escort rule; escorts come from your Technology Control Plan, license provisos, and, at cleared facilities, the NISPOM. Where your TCP requires that foreign nationals be escorted at all times, an optional escort field on a check-in form does not enforce it. If a foreign visitor can physically enter a controlled space without a confirmed, acknowledged escort, your TCP is not being enforced.
Technology Control Plan; 32 CFR Part 117 at cleared sites5.No Defensible Audit Trail
Section 122.5 requires records of exports and of the exemptions you rely on, kept for five years. When a question arises about who reached technical data, the visit record is where the answer starts. If your visitor logs can be edited or deleted without a trace, or if they only show check-in time without escort assignment, zone access, or screening results, they are weak evidence.
22 CFR § 122.5: Maintenance of RecordsCompounding Exposure
Each failure point can independently create exposure. A foreign visitor who arrives unscreened, enters a controlled zone without escort, and is not captured in an audit trail can represent multiple potential ITAR exposures at once, and every unauthorized release that results is its own violation, with a civil maximum of $1,271,078 or twice the transaction value, whichever is greater (22 CFR § 127.10). Multiply by the number of visitors and the number of days, and the exposure adds up quickly.
Building a Defensible ITAR Visitor Screening Workflow
A defensible ITAR visitor management workflow has five distinct phases, each generating evidence you can put in front of an auditor or use in a disclosure.
Visitor Identity & Nationality Capture
- Ask for every citizenship, past and present, and any permanent residency: a release is an export to each of those countries (22 CFR § 120.50(b)). SecurePoint checks one country per visit against § 126.1, so record any others in your review
- Each country checked against the ITAR § 126.1 list, which includes China, Russia, Iran, North Korea, Cuba, Venezuela, Belarus, and Burma
- Company/entity affiliation captured and screened against BIS Entity List
- Purpose of visit documented with technical data access scope
- Government-issued photo ID uploaded for verification
Multi-List Sanctions & Restricted Party Screening
- Automated screening against OFAC SDN and the BIS Entity List and Denied Persons List, with the DDTC debarred list turned on for ITAR work
- Fuzzy matching with configurable threshold to catch name variations and transliterations
- Export classification and program recorded with the reviewer’s decision
- Compliance officer notification for matches; no badge issued until resolved
Gate Screening & Zone Assignment
- Check-in screens again unless an approved screening is still inside your re-screening interval
- U.S.-person attestation taken at each check-in (22 CFR § 120.62); unresolved status holds the badge for review
- Government ID verified against pre-registration data
- Zone access determined by visitor export classification and TCP requirements
- Escort assigned from authorized personnel roster; mandatory confirmation required
- Badge issued reflecting access posture: ITAR-cleared, escorted-only, or uncontrolled-areas-only
Escort Enforcement & Access Monitoring
- Escort acknowledgment recorded with a timestamp
- NDA and non-disclosure capture for visitors accessing controlled technical data
- Real-time compliance dashboard for security operators and export control officers
Documentation & Evidence Generation
- Automated after-visit report (AVR) with escort compliance data
- Technical data access documentation linked to export classifications
- Badge return confirmation and deactivation logged
- Complete visit evidence exportable for review, with a checksum for each file
- Hash-chained audit log that application users cannot edit or delete
DDTC Enforcement: The Penalties Are Not Theoretical
DDTC consent agreements show that export control violations, including foreign-person access to controlled technical data, result in significant financial penalties, mandatory compliance programs, and reputational damage.
GE Aerospace
2026Consent agreement with DDTC resolving 116 alleged violations, including unauthorized exports of technical data to China. GE disclosed them voluntarily, and $18 million of the penalty is suspended for compliance improvements.
BAE Systems, Inc.
2026Consent agreement with DDTC resolving 104 alleged violations, including unauthorized exports of technical data, all but one voluntarily disclosed. $18 million of the penalty is suspended for remedial compliance measures.
The Boeing Company
2024Consent agreement with DDTC over alleged violations that included unauthorized exports of technical data to foreign-person employees and contractors.
FLIR Systems
2018Consent agreement with DDTC over alleged unauthorized exports of ITAR-controlled technical data and defense services to dual and third-country nationals at company facilities. Foreign-person employees could reach controlled technical data in company systems, and the company did not collect the citizenship information it needed to determine licensing requirements.
Honeywell International
2021Consent agreement with DDTC over alleged unauthorized exports and retransfers of engineering drawings containing ITAR-controlled technical data for parts of the F-35, F-22, and B-1B aircraft and the CTS800 engine, including to China.
L3Harris Technologies
2019Consent agreement with DDTC resolving 131 alleged violations, including unauthorized exports of technical data in software, tactical radios, and military electronics, license-proviso violations, and a false statement. Harris voluntarily disclosed many of them; DDTC found others.
Voluntary Disclosures Are Not a Safe Harbor
DDTC encourages voluntary self-disclosure (VSD) of ITAR violations under 22 CFR § 127.12. While VSDs are treated as mitigating factors, they do not eliminate penalties. GE Aerospace disclosed all of its violations and BAE Systems all but one, and both still entered $36 million consent agreements in 2026, with mandatory compliance upgrades and external oversight.
The best protection is prevention, not disclosure after the fact. A systematic visitor screening program lowers the odds of a foreign-person access violation. It does not make disclosure unnecessary: if a violation happens anyway, the visit records it keeps are what you assess it with and what a disclosure is built from.
Technology Control Plan Integration
Your Technology Control Plan defines the rules. Your visitor management system enforces them. The two must be tightly integrated: a TCP that exists only on paper provides no protection.
Zone-Based Access Classification
Map your facility into export control zones: ITAR-controlled, EAR-controlled, restricted, and unclassified. Each zone carries its own access requirements, escort rules, and badge-level permissions. Visitors are assigned to zones based on their export classification, not based on who they're visiting.
Export Classification Management
Visitors, their companies, and specific visits can each carry export classifications: USML categories (I-XXI), ECCN codes, or program-specific tags. These classifications determine zone eligibility and trigger appropriate screening workflows. Classifications can expire, requiring re-evaluation for repeat visitors whose access scope changes over time.
License Exception & Authorization Tracking
Not all foreign person access requires a license. Under the ITAR, an exemption (for example in 22 CFR § 125.4) may apply, though § 126.1 bars most exemptions for proscribed countries; under the EAR, a license exception such as STA, TSU, or TMP may apply, or the technology may need no license at all (NLR). Which one applies depends on the nature of the visit, the visitor's nationality, and the specific technical data involved. Whoever makes that determination should record which authorization applies and the basis for it, and keep it with the visit record for the five-year record-keeping period.
What SecurePoint Records at an ITAR Site
Foreign Person Status
At an ITAR-ready site, every visit asks the visitor to attest to U.S.-person status under 22 CFR § 120.62 before a badge is issued; an answer stored from an earlier visit does not count. A visitor not confirmed a U.S. person needs an escort, and a § 126.1 national, a visitor whose country cannot be resolved, or one whose attestation conflicts with their citizenship is held for compliance review.
SecurePoint records the attestation and the reviewer’s decision; it does not decide whether a license or exemption is required. That determination stays with your export control officer or empowered official.
Multi-List Sanctions Screening
By default, every visitor is screened against OFAC SDN and SSI, the BIS Entity List and Denied Persons List, and the UK, EU, and UN sanctions lists, among other US and international sources. The DDTC debarred list is carried in the platform but off by default: an administrator turns it on in the organization's screening settings and chooses whether a DDTC match holds the visit. A visitor is screened at pre-registration. At an ITAR-ready site, check-in runs through the kiosk or guided desk flow, which screens again unless an approved screening is still inside the re-screening interval your organization sets and the name or ID given matches it.
Fuzzy matching with configurable thresholds catches name variations, transliterations, and aliases. A possible match holds the visit and alerts your compliance managers: no badge is issued until a reviewer decides.
Zone-Based Access & TCP Enforcement
Site export zones map directly to your Technology Control Plan. Each zone defines its access requirements: ITAR-controlled, EAR-controlled, restricted, or unclassified. Visitor badges reflect the approved access posture.
SecurePoint does not track movement inside the facility. Your access-control system and escorts enforce the boundary between zones.
Mandatory Escort Enforcement
At ITAR-controlled and DCSA high-security sites, foreign nationals and visitors whose U.S.-person status is unresolved require an escort by default. A front-desk check-in stops until an escort is assigned; at a self-service kiosk the visit is held for host verification, where the host attests that they will escort the visitor at all times. Escort events are recorded with timestamps, and an override of a missing escort is written to the audit log with who made it.
Hash-Chained Audit Trail with 10-Year Retention
Every screening result, access decision, escort assignment, and badge event is recorded in an append-only, cryptographically hashed audit log. Application users cannot edit or delete entries, and a verifier checks the hash chain for breaks. Audit logs are retained for ten years. Evidence and report exports cover screening activity, adjudication decisions, and the audit trail, with a SHA-256 checksum recorded for each export.
Separation of Duties
Security operators run the kiosk and front desk. Export control officers define policy and adjudicate edge cases. SecurePoint USA enforces this separation: front desk staff cannot override export classification decisions, and export control officers can audit every access event independently.
60-Day Implementation Roadmap
A phased approach that gets your ITAR visitor screening operational without disrupting daily facility operations.
Discovery & TCP Mapping
- Audit current visitor management processes and document gaps against 22 CFR requirements
- Map facility zones to export control classifications (ITAR, EAR, restricted, unclassified)
- Identify all USML categories and ECCN codes handled at each facility
- Define escort policies per zone and visitor type
- Establish export control officer roles and adjudication workflows
Platform Configuration & Integration
- Configure SecurePoint USA site zones matching your TCP
- Set up multi-list screening rules and fuzzy match thresholds
- Define badge templates reflecting access postures (ITAR-cleared, escorted, uncontrolled)
- Set which sites and visits require an escort
- Document how your access control system and escorts enforce zone boundaries (SecurePoint does not connect to door hardware)
Testing & Staff Training
- Run screening workflow tests with mock visitors across all nationality/zone combinations
- Train front desk staff on kiosk operations and badge issuance
- Train export control officers on adjudication dashboard and evidence exports
- Validate audit trail completeness: every event must generate a defensible record
- Test escort enforcement end-to-end: assignment, notification, acknowledgment, escalation
Go-Live & Compliance Validation
- Deploy to production with parallel operation alongside existing processes
- Monitor screening results and adjudication workflows in real-time
- Generate first compliance evidence export and validate against DDTC record-keeping requirements
- Decommission legacy visitor management processes
- Schedule 30-day post-launch compliance review
Stop Treating ITAR Compliance
as a Paper Exercise
A foreign visitor who reaches controlled technical data without authorization is a potential deemed export violation. The penalties are real, enforcement continues, and the answer is a systematic process.
SecurePoint USA provides foreign person determination support, multi-list sanctions screening, TCP-aligned site zones and badge access postures, escort workflows, and a hash-chained audit log.
Frequently asked questions
Does SecurePoint make our organization ITAR compliant?
No. ITAR compliance is a program your organization runs, and the obligation stays with you. SecurePoint is a control inside that program: it screens visitors, captures purpose and host, records escort requirements, and keeps an audit trail of who entered and who permitted them.
What is a deemed export in a visitor context?
Releasing controlled technical data to a foreign person inside the United States can constitute an export under the ITAR and the EAR, including through a facility visit that gives access to controlled areas or data. Whether a specific release requires authorization is a determination for your export-control officer or counsel, not one a screening tool makes for you.
Can a visitor management system replace a Technology Control Plan?
No. A Technology Control Plan is the program document that defines your rules. A visitor system is one of the controls that carries those rules out at the door and records that they were applied. The plan stays yours to write, maintain, and defend.
What does SecurePoint record for a visit to a controlled area?
The visitor and their host, the stated purpose, the site, the escort requirement, the screening outcome and any adjudication decision with the reviewer who made it, badge issuance, and check-out. Those records are written to an append-only audit trail and can be exported as an evidence pack.
Does screening tell us whether a visitor needs an export license?
No. Screening tells you whether a party matches a restricted-party list and routes possible matches to a documented human review. License determinations depend on the item, the technology, the destination and the end use, and belong with your export-control officer or trade counsel.
Sources and revision history
First published March 2026. Last reviewed against the sources below and against SecurePoint's product as it stood that day. The sources are listed for traceability, not as endorsements; confirm current text with the issuing agency before relying on a citation.
- [1]International Traffic in Arms Regulations (22 CFR Parts 120-130)
Primary source for "export" including deemed exports (§ 120.50), "release" (§ 120.56), "US person" (§ 120.62), "foreign person" (§ 120.63), and recordkeeping obligations (§ 122.5).
- [2]22 CFR § 126.1: Prohibited exports, imports, and sales to or from certain countries
Source for the proscribed-country examples. Syria was removed from § 126.1(d)(1) effective October 1, 2026 (91 FR 62313).
- [3]22 CFR § 127.10: Civil penalty
Civil maximum per violation of 22 U.S.C. 2778: the greater of $1,271,078 or twice the value of the transaction, as adjusted for inflation at 90 FR 1868 (January 10, 2025). OMB Memorandum M-26-11 cancelled the 2026 adjustments.
- [4]22 U.S.C. 2778(c): Criminal violations
Willful violations: a fine of up to $1,000,000, up to 20 years in prison, or both, per violation.
- [5]Export Administration Regulations (15 CFR Parts 730-774)
EAR framework, ECCN structure, and license exceptions referenced.
- [6]U.S. Department of State: GE Aerospace settlement (April 2026)
$36 million consent agreement, $18 million suspended, resolving 116 voluntarily disclosed alleged violations.
- [7]U.S. Department of State: BAE Systems, Inc. settlement (August 2026)
$36 million consent agreement, $18 million suspended, resolving 104 alleged violations.
- [8]U.S. Department of State: The Boeing Company settlement (February 2024)
$51 million consent agreement, including unauthorized exports of technical data to foreign-person employees.
- [9]DDTC Penalties and Oversight Information
Index of consent agreements, including FLIR Systems (2018), L3Harris Technologies (2019), and Honeywell International (2021). Reconfirm figures against the official notice before quoting.
- [10]Consolidated Screening List (International Trade Administration)
Combined Commerce, State, and Treasury lists, a starting point for the multi-list screening discussion.
Revision history
Updated the ITAR § 126.1 country examples (Syria came off the list on October 1, 2026; China, Venezuela, and Burma are now named) and added the 2024 and 2026 DDTC consent agreements with Boeing, GE Aerospace, and BAE Systems. Corrected the citations for escorts, zone separation, and records, where SecurePoint captures U.S.-person status, and when check-in screens a visitor again.
Corrected ITAR citations and penalty figures, and removed a claim that SecurePoint enforces zone boundaries.
Described the DDTC debarred list as off until an administrator enables it, and removed an unmeasured deployment-time figure.
Informational only. This whitepaper is provided for general informational purposes only and does not constitute legal, regulatory, export-control, or compliance advice. It is not a substitute for review by qualified counsel, an empowered/export-control official, or other advisor familiar with your specific contracts, facilities, USML categories, and ECCN classifications.
CFR citations, enforcement examples, and penalty figures reflect publicly available information believed to be accurate as of the review date shown on this page and in the PDF. DDTC and BIS guidance, license exceptions, and penalty maximums change; verify with primary sources before relying on anything in this document. © 2026 SecurePoint USA LLC. All rights reserved.