ITAR and CMMC get treated as interchangeable in casual conversation, and they’re not. One governs who’s allowed to touch defense technical data. The other governs how securely you have to protect it once you do.
Quick summary: ITAR (22 CFR Parts 120–130) is an export-control regulation restricting access to defense articles and technical data. CMMC, built on NIST SP 800-171, is a cybersecurity certification framework verifying a contractor’s IT environment adequately protects Controlled Unclassified Information. Defense contractors frequently need both, but they satisfy different requirements and are assessed independently.
What’s the Practical Difference for a Supplier?
ITAR registration establishes legal eligibility to handle certain defense-related technical data. CMMC certification verifies the IT systems handling that data meet defined cybersecurity control levels. Different questions, different compliance paths.
Does CMMC Replace the Need for ITAR Registration?
No — a company can be fully CMMC-certified and still need separate ITAR registration if it handles defense articles or technical data covered under the ITAR munitions list.
How Do These Interact on a Real Program?
A program may require a supplier to be ITAR-registered to legally receive the technical data at all, and CMMC-compliant to store and transmit it securely once received. Both gates typically need to be cleared, not one or the other.
What Should a Defense Program Manager Check When Vetting a Supplier?
Ask about both separately: current ITAR registration status, and current CMMC level or NIST SP 800-171 assessment status posted in SPRS. Neither substitutes for the other.
FAQ
Is CMMC required for all DoD contractors? Requirements phase in based on the sensitivity of information handled under a given contract — check current DoD contract language for the specific requirement level.
Does Accurate Machine & Tool maintain both certifications? Accurate Machine & Tool maintains ITAR registration and CMMC Level 1 compliance. Contact us directly for current certification status relevant to your program.
Sources: 22 CFR Parts 120–130 (ITAR); NIST SP 800-171 (basis for CMMC). Related: Frequently Asked Questions · eMachineShop’s ITAR vs. CMMC: What’s the Difference?