ITAR vs. CMMC: What Defense Buyers Need from Suppliers
Defense supplier qualification has changed. A few years ago, ITAR registration was one of the primary compliance questions buyers asked. Today, many defense programs also require suppliers to demonstrate how they protect Controlled Unclassified Information (CUI). Understanding the difference between ITAR and CMMC helps buyers qualify suppliers more effectively and reduce program risk before work ever begins.
ITAR vs CMMC CNC machining Borg Design
A common misconception is that ITAR registration and CMMC Level 2 certification are interchangeable. They are not. They address different risks, serve different purposes, and together help create a stronger, more secure defense supply chain.
If you’re evaluating manufacturing partners, understanding the difference can help you ask better questions and avoid surprises later in the procurement process.
Related Defense Compliance Resources.
- CMMC Level 2 Certified Machine Shop – An overview of our C3PAO-verified cybersecurity posture for handling Controlled Unclassified Information (CUI). Explore CMMC Resources →
- Precision CNC Machining and ITAR Compliance. How we secure technical data packages and manage USML-restricted defense manufacturing projects. Explore ITAR Guidelines →
- Defense Supplier Readiness Guide – A strategic screening tool and checklist for procurement officers vetting critical machining vendors. Access Readiness Guide →
| Comparison Point | ITAR | CMMC Level 2 |
|---|---|---|
| Primary Purpose | Protects defense articles and technical data from unauthorized export. | Protects Controlled Unclassified Information, or CUI, through cybersecurity practices. |
| Focus | Export control and handling of controlled defense information. | Cybersecurity and protection of CUI within information systems. |
| Applies To | Companies working with ITAR-controlled defense articles, services, or technical data. | Organizations handling CUI for Department of Defense contracts. |
| Buyer Question | Can this supplier legally and responsibly handle ITAR-controlled work? | Can this supplier securely receive, store, and protect CUI? |
| Why It Matters | Helps protect export-controlled defense information and national security interests. | Helps reduce cybersecurity and supply-chain risk across defense programs. |
ITAR: Protecting Defense Articles and Technical Data
The International Traffic in Arms Regulations (ITAR) govern the export and handling of defense articles, defense services, and related technical data.
For manufacturers, that often means controlling who has access to technical drawings, specifications, and production information. It also requires documented processes, employee awareness, and controls that prevent unauthorized access or disclosure.
For a defense buyer, ITAR registration demonstrates that a supplier understands its responsibilities when working with export-controlled defense programs.
CMMC Level 2: Protecting Controlled Unclassified Information
While ITAR focuses on export-controlled information, CMMC Level 2 focuses on protecting Controlled Unclassified Information (CUI) used throughout the defense supply chain.
The framework is based on the security requirements of NIST SP 800-171 and evaluates whether an organization has implemented the cybersecurity practices needed to safeguard sensitive government information.
For buyers, CMMC Level 2 provides confidence that suppliers have established processes to protect CUI throughout its lifecycle—from receipt through storage, use, and transmission.
What This Means During Supplier Qualification
- Engineering, supply chain, and quality teams often evaluate suppliers from different perspectives.
- An engineer wants confidence that sensitive technical data will be handled appropriately.
- A sourcing professional wants to reduce supplier risk and avoid qualification issues later in the program.
- A quality manager wants assurance that documented processes are consistently followed and that sensitive information is controlled throughout production.
Understanding how ITAR and CMMC work together helps each of these stakeholders make better supplier decisions.
Side note. Sometimes all this jargon can get confusing. We’ve built a glossary to help with commonly used terms. Check it out here >>
What We’ve Learned
One of the biggest misconceptions we encounter is that ITAR registration alone satisfies every defense program requirement.
In reality, many defense customers now evaluate suppliers through both an export-control lens and a cybersecurity lens. A supplier may be fully capable of manufacturing a complex defense component, but if they cannot appropriately protect Controlled Unclassified Information when required, they may not be the right fit for every program.
At Borg Design, supporting defense manufacturers means operating within both frameworks every day. Our documented ITAR processes, Technology Control Plan, employee training, and CMMC Level 2-certified cybersecurity program work together to help customers protect sensitive information while maintaining reliable manufacturing operations.
Here’s another thing we’ve learned. Beginning November 10, 2026, the Department of Defense will begin incorporating CMMC Level 2 requirements into many new solicitations and contract awards. For defense buyers, this means supplier qualification increasingly includes both manufacturing capability and cybersecurity readiness. Organizations that prepare now will be better positioned as these requirements become standard across the defense industrial base. We’re ready now. (See our certifications here).
Five Questions to Ask Before Qualifying a Defense Supplier
When evaluating manufacturing partners, consider asking:
- Are you ITAR registered?
- If our program includes CUI, do you hold CMMC Level 2 certification?
- How do you control access to technical drawings and program information?
- What documented processes protect sensitive customer information?
- How do your quality, security, and manufacturing processes work together?
These questions often reveal more about a supplier’s operational maturity than certifications alone.
The Bottom Line
ITAR and CMMC Level 2 serve different purposes, but together they help strengthen the security and resilience of the defense industrial base.
Understanding the distinction allows defense buyers to evaluate suppliers more effectively and select manufacturing partners that can support both technical requirements and information security expectations.
If you’re qualifying suppliers for an upcoming defense program, reviewing ITAR requirements and CMMC readiness early in the process can help avoid delays, reduce risk, and create a smoother path from qualification to production. The earlier these conversations happen during supplier qualification, the fewer compliance surprises you’ll encounter once the program is underway.
Frequently Asked Questions About ITAR and CMMC
Q: Is ITAR registration the same as CMMC Level 2 certification?
A: No. ITAR governs export-controlled defense articles and technical data, while CMMC Level 2 establishes cybersecurity requirements for protecting Controlled Unclassified Information (CUI). Many defense programs require suppliers to understand and comply with both.
Q: Do all defense suppliers need both ITAR and CMMC?
A: Not necessarily. Requirements depend on the contract and the information being handled. However, many Department of Defense programs increasingly expect suppliers to understand both frameworks.
Q: Why should buyers ask about both ITAR and CMMC?
A: Because they address different risks. ITAR focuses on export control, while CMMC focuses on cybersecurity. Understanding both helps buyers evaluate whether a supplier is prepared to support their specific program requirements.
Q: What questions should I ask a defense manufacturing supplier?
A: Ask whether they are ITAR registered, whether they maintain CMMC Level 2 certification when applicable, how they protect technical information, and what documented processes they use to safeguard customer data throughout manufacturing.
