ITAR and NIST SP 800-171 for Maryland Manufacturers and Contractors

Manufacturers and contractors in Maryland’s defense supply chain usually meet NIST SP 800-171 and ITAR in the same year, because the same drawing can be both Controlled Unclassified Information under a DoD contract and ITAR-controlled technical data under the export rules. They are different laws with different enforcers, and getting one right does not satisfy the other. This article explains what each actually requires of a small manufacturer, where they overlap, and the IT decisions that follow from them.

Two different rules

NIST SP 800-171 in practice

The 110 requirements sit in 14 families: access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity. DoD’s CMMC program assesses against Revision 2 of the standard. For a manufacturer the heavy items are:

• Scoping the CUI environment. Where do drawings and specs live, who touches them, and can that be confined to a defined set of systems? A tight enclave is the difference between a manageable project and certifying the whole plant.
• Shop-floor systems. CNC controllers, CAM workstations, and quality systems often run old operating systems that cannot be patched. They need to be isolated on their own network segment with controlled access, and that has to be documented.
• Identity. Named accounts, multi-factor authentication, and a real process for people joining and leaving.
• Logging and monitoring. Centralized logs, retained and reviewed, plus the ability to detect and report a cyber incident to DoD within 72 hours under DFARS 252.204-7012.
• Evidence. The System Security Plan, policies, inventory, and diagrams. Assessors score what is written down and demonstrable.

Self-assessments at award have been required since November 10, 2025. Third-party certification, due from November 10, 2026, was suspended by the Department of War on July 13, 2026 pending a review of the program, with no new date announced as of October 2026; the 110 requirements themselves have not changed. Our CMMC guide for Maryland contractors covers the levels and phases in detail.

ITAR in practice

ITAR is about people and places, not just controls. The questions a small manufacturer has to answer:

• Are you registered? Manufacturers of defense articles must register with DDTC under Part 122, whether or not they export anything.
• Who is a foreign person? Anyone who is not a U.S. citizen, permanent resident, or protected individual. That includes employees on work visas, contractors, and the support staff of a cloud or IT vendor. Letting a foreign person access technical data is an export, even inside your building.
• Where does the data live? Technical data stored on a server or cloud service outside the United States is an export. Technical data that foreign-national administrators of a cloud provider could access is an export. The 2020 encryption rule (22 CFR 120.54) provides an exception: technical data secured with end-to-end encryption meeting FIPS 140-2 or equivalent, where the provider cannot access the keys and the data is not intentionally stored in certain countries, is not an export. In practice that pushes most small manufacturers to a government cloud tenant or a tightly controlled on-premises environment.
• Who can get into the building and the network? Visitor controls, badge access to areas where ITAR data is handled, and screen locks are not optional.
• Records. DDTC expects you to be able to show what was exported, to whom, and under what authorization, for five years.

Where the two overlap and where they do not

The overlap is large: both want controlled access, encryption, logging, and a documented environment. The differences cause the mistakes. NIST SP 800-171 is satisfied by a commercial government cloud with the right configuration; ITAR additionally requires that no foreign person, including the provider’s staff, can access the data, which is why “GCC High” and similar tenants with U.S.-person support exist. NIST SP 800-171 does not care about citizenship; ITAR cares about little else. A manufacturer that certifies its enclave for CMMC but stores technical data in a commercial cloud with offshore administrators has solved one problem and created another.

The IT decisions that follow

1. One enclave for both. Build the CUI environment to the stricter ITAR standard from the start: U.S.-based, U.S.-person-supported cloud or on-premises systems, end-to-end encryption, and access limited to screened U.S. persons.
2. Segment the plant. Shop-floor equipment on its own network with no direct internet path and controlled access from the engineering environment.
3. Manage every device. Encryption, endpoint detection and response, patching where possible and isolation where not, and no personal devices touching technical data.
4. Vendor screening. Confirm in writing that your IT provider, cloud provider, and any vendor with remote access use U.S. persons for anything that can reach ITAR data.
5. Document as you go. The System Security Plan for CMMC and the technology control plan for ITAR share most of their content.

How Corporate Technologies works with Maryland manufacturers

We support manufacturers and contractors across Maryland from our Frederick office, with a 24/7 help desk and security operations center shared across our 21 locations. We build and operate CUI enclaves, segment plant networks, deploy the controls, and produce the evidence for assessors; our Secure Advantage package covers the monitoring, endpoint, MFA, and training requirements. Export-control classification and licensing decisions belong with your export compliance counsel; we implement the technical controls those decisions require. Maryland’s own breach law applies to employee and customer data on top of all this; see Maryland PIPA explained.

This article is general information, not legal advice. ITAR jurisdiction and classification questions should go to export counsel.

Frequently asked questions

We do not export anything. Does ITAR still apply?

If you manufacture defense articles, you must register with DDTC regardless of exports, and any access by a foreign person to your technical data is treated as an export. Most small manufacturers are surprised to learn that a cloud vendor’s support team counts.

Can we meet NIST SP 800-171 with our current Microsoft 365?

Commercial Microsoft 365 is generally not suitable for CUI, and not acceptable for ITAR technical data. A government cloud tenant inside a defined enclave is the usual solution.

Our CNC machines run Windows 7. Is that a failure?

Not by itself. Unsupported systems have to be isolated, documented, and compensated for with other controls, and assessors expect to see exactly that. Leaving them on the main network with internet access is the failure.

How long does this take?

From a typical starting point, six to twelve months to assessment readiness, with scoping and documentation first and tooling second.