Compliance/Global/ITAR
Eleven parts: fifteen leave evidence in the file.
The regulations control the export of defense articles, technical data and defense services, and treat many transfers to foreign persons as an export. Vaultize adds records that stay with the file.
- 22 CFR Subchapter M
- Administered by DDTC, U.S. Department of State
- Capability mapping, not legal advice
120.33(a)(1)Purpose and definitions
Information, other than software as defined in § 120.40(g), which is required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles.
Discover & Classify
120
Purpose and definitions
6 of 69
- 120.1
- 120.2
- 120.3
- 120.4
- 120.5
- 120.6
- 120.7
- 120.8
- 120.9
- 120.10
- 120.11
- 120.12
- 120.13
- 120.14
- 120.15
- 120.16
- 120.17
- 120.18
- 120.19
- 120.20
- 120.21
- 120.22
- 120.23
- 120.24
- 120.25
- 120.26
- 120.27
- 120.28
- 120.29
- 120.30
- 120.31
- 120.32
- 120.33
- 120.34
- 120.35
- 120.36
- 120.37
- 120.38
- 120.39
- 120.40
- 120.41
- 120.42
- 120.43
- 120.44
- 120.45
- 120.46
- 120.47
- 120.48
- 120.49
- 120.50
- 120.51
- 120.52
- 120.53
- 120.54
- 120.55
- 120.56
- 120.57
- 120.58
- 120.59
- 120.60
- 120.61
- 120.62
- 120.63
- 120.64
- 120.65
- 120.66
- 120.67
- 120.68
- 120.69
121
Munitions List
0 of 17
- 121.0
- 121.1
- 121.2
- 121.3
- 121.4
- 121.5
- 121.6
- 121.7
- 121.8
- 121.9
- 121.10
- 121.11
- 121.12
- 121.13
- 121.14
- 121.15
- 121.16
122
Registration
1 of 5
- 122.1
- 122.2
- 122.3
- 122.4
- 122.5
123
Export licences
1 of 28
- 123.1
- 123.2
- 123.3
- 123.4
- 123.5
- 123.6
- 123.7
- 123.8
- 123.9
- 123.10
- 123.11
- 123.12
- 123.13
- 123.14
- 123.15
- 123.16
- 123.17
- 123.18
- 123.19
- 123.20
- 123.21
- 123.22
- 123.23
- 123.24
- 123.25
- 123.26
- 123.27
- 123.28
124
Agreements and defense services
0 of 16
- 124.1
- 124.2
- 124.3
- 124.4
- 124.5
- 124.6
- 124.7
- 124.8
- 124.9
- 124.10
- 124.11
- 124.12
- 124.13
- 124.14
- 124.15
- 124.16
125
Technical data licences
0 of 9
- 125.1
- 125.2
- 125.3
- 125.4
- 125.5
- 125.6
- 125.7
- 125.8
- 125.9
126
General policies
0 of 18
- 126.1
- 126.2
- 126.3
- 126.4
- 126.5
- 126.6
- 126.7
- 126.8
- 126.9
- 126.10
- 126.11
- 126.12
- 126.13
- 126.14
- 126.15
- 126.16
- 126.17
- 126.18
127
Violations and penalties
1 of 12
- 127.1
- 127.2
- 127.3
- 127.4
- 127.5
- 127.6
- 127.7
- 127.8
- 127.9
- 127.10
- 127.11
- 127.12
128
Administrative procedures
0 of 17
- 128.1
- 128.2
- 128.3
- 128.4
- 128.5
- 128.6
- 128.7
- 128.8
- 128.9
- 128.10
- 128.11
- 128.12
- 128.13
- 128.14
- 128.15
- 128.16
- 128.17
129
Brokers
0 of 11
- 129.1
- 129.2
- 129.3
- 129.4
- 129.5
- 129.6
- 129.7
- 129.8
- 129.9
- 129.10
- 129.11
130
Political contributions
0 of 17
- 130.1
- 130.2
- 130.3
- 130.4
- 130.5
- 130.6
- 130.7
- 130.8
- 130.9
- 130.10
- 130.11
- 130.12
- 130.13
- 130.14
- 130.15
- 130.16
- 130.17
The answer in 30 seconds
Vaultize adds file-level records to fifteen provisions across six sections in four of the regulations' eleven parts: the definitions and encryption carve-out in Part 120, registrant recordkeeping in Part 122, retransfer approval in Part 123, and the evidence a suspected violation in Part 127 draws on. Classifying the Munitions List, licensing, agreements, general policy and administrative procedure sit outside a governed file, with the exporter and DDTC.
The regulations in one view
Eleven parts. Two hundred and nineteen sections. Where file evidence lands.
The regulations run in eleven parts, 22 CFR 120 to 130. Part summaries are in our words. Select a part to see which of its sections a governed file can evidence.
120
Purpose and definitions
Sections 120.1 to 120.69. The definitions that run through the whole subchapter: defense article, technical data, export, reexport, retransfer, release, the encryption carve-out, U.S. person and foreign person.
Outcomes the file can evidence
- 120.33(a)(1)
- 120.50(a)(2)
- 120.51(a)(2)
- 120.54(a)(5)(i)
- 120.54(a)(5)(ii)
- 120.54(a)(5)(iii)
- 120.54(a)(5)(iv)
- 120.54(b)(1)(i)
- 120.56(a)(1)
- 120.56(a)(2)
- 120.63
- How Vaultize contributes
- Discover & Classify and Vaultize Seal give the exporter records to check technical data, foreign person and release questions against. Vaultize Seal's encryption and access records also answer the file's own share of the encryption carve-out in section 120.54. Vaultize does not decide whether data is technical data, whether a person is a foreign person, or whether an activity is a release, reexport or export.
- Evidence to retain
- Classification history. Encryption on the file. Per-access records with identity, location and time. Deployment records.
Section by section
What each provision asks. What the file can answer.
Wording is quoted from 22 CFR Parts 120 to 130 as published on the eCFR, current as of 3 September 2026. Longer provisions are excerpted. Each row is a capability mapping, not legal advice. Read the regulations and take advice on applicability, technical data, foreign person status and licensing.
Using this page
Where these rows fit in an ITAR programme.
The regulations apply now, to every export, reexport, retransfer and temporary import of defense articles, technical data and defense services within their scope. The rows above are evidence for the provisions that touch documents.
- 1
Register
Part 122. Manufacturers, exporters and furnishers of defense services register with DDTC before applying for a licence.
- 2
Classify the article or data
Part 121. Whether an article, service or piece of data is a defense article or technical data controlled by the United States Munitions List.
- 3
Confirm release and export definitions
Part 120. Export, reexport, retransfer, release and the encryption carve-out in section 120.54. Most of these rows belong here.
Bring the fifteen rows above as evidence for the release, export and encryption carve-out questions Part 120 raises.
- 4
Apply for licences and exemptions
Parts 123 and 125. Export and temporary import licences, and the exemptions of general applicability that can remove the need for one.
- 5
Keep the records
Sections 122.5 and 123.22. Registrant records and the reports the export licence process requires, kept for DDTC to inspect.
Responsibility boundary
Controls support compliance. They are not legal advice.
Vaultize contributes technical measures and evidence for documents and files governed under these regulations. It does not decide whether data is technical data, whether a person is a foreign person, or whether an activity is an export, reexport, retransfer or release. It does not register an exporter, apply for or grant a licence, or determine whether a transfer needs one. This page is a capability mapping, not legal advice. Read the regulations and take advice from qualified export control counsel before relying on this page.
“A person who is required to register must maintain records concerning the manufacture, acquisition and disposition (to include copies of all documentation on exports using exemptions and applications and licenses and their related documentation), of defense articles; of technical data; the provision of defense services; brokering activities; and information on political contributions, fees, or commissions furnished or obtained, as required by part 130 of this subchapter.”
22 CFR § 122.5(a)
Official references
Read the source before relying on the mapping.
Provision wording comes from the first item, the eCFR text of 22 CFR Parts 120 to 130. The second is the website of the bureau that administers these regulations.
- 22 CFR Chapter I, Subchapter M (International Traffic in Arms Regulations)eCFR, current as of 3 September 2026. Every section quoted on this page is from it.
- Directorate of Defense Trade Controls (DDTC), U.S. Department of StateThe bureau within the U.S. Department of State that administers the ITAR, registers exporters and issues licences.
A practical next step
Bring one document that carries technical data.
We will show which provisions the governed document can evidence today. We will name the owner responsible for the rest.