🛡️ ITAR
ITAR Registered Heat Treating for Defense-Controlled Parts
When the part on your bench is a USML-controlled defense article, the question is not only whether a heat treater can hit the hardness; it is whether they are legally cleared to touch it at all. ITAR registration with the State Department's DDTC governs that access, and getting it wrong turns a routine furnace job into an export-control violation.
ITARAS9100NADCAP
What ITAR Registration Means for a Heat Treat Shop
ITAR, the International Traffic in Arms Regulations under 22 CFR Parts 120 to 130, is administered by the Directorate of Defense Trade Controls (DDTC) within the State Department. Any US manufacturer or supplier that handles defense articles or technical data on the United States Munitions List is generally required to register with DDTC, even if they never directly export, because manufacturing defense articles triggers the registration obligation. For a heat treater, processing a USML-controlled component is manufacturing-adjacent handling that brings the shop into scope.
It is critical to understand that ITAR registration is not a quality certification and not a license. Registration with DDTC, evidenced by a registration code and an annual renewal, is essentially a statement that the entity is known to the regulator and eligible to apply for licenses. There is no audit of your furnaces, no pyrometry checklist, and no metallurgical scope tied to it. That is why ITAR almost always rides alongside a real quality system such as AS9100 and a process accreditation such as NADCAP on defense heat treat work.
The practical buyer takeaway: ITAR registration answers the access-and-compliance question, while AS9100 and NADCAP answer the can-they-make-it-right question. You generally need all three on controlled defense hardware, and they are not substitutes for one another.
Technical Data, US-Person Access, and Domestic Processing
The sharp edge of ITAR for a service supplier is technical data control. Drawings, specifications, process parameters, and even certain dimensioned models for a USML article are ITAR-controlled technical data, and disclosing them to a foreign person, including a foreign-national employee on US soil, is a deemed export that requires authorization. A compliant heat treater therefore controls who can access your traveler and spec, restricts the work to US persons as defined in 22 CFR 120.62 unless a license or exemption applies, and segregates controlled jobs from open shop traffic.
This is why the shop's workforce and IT practices matter as much as its furnaces. Ask how they restrict technical-data access, whether foreign-national employees are walled off from controlled work, and how they handle electronic transmission and storage of your drawings. A shop that emails controlled prints around casually is a liability regardless of how good its metallurgy is.
Domestic processing is the other expectation. Sending a controlled part offshore for heat treating is an export of the defense article and typically requires DDTC authorization that most buyers will not have and do not want. ITAR-controlled heat treat work generally stays inside the United States with US-person handling end to end, and your supplier flow-down should say so explicitly.
Stacking ITAR With the Certs That Govern the Metallurgy
Because ITAR carries no metallurgical content, defense heat treat sourcing is a layered decision. The typical stack on a controlled aerospace-defense part is ITAR registration for export compliance, AS9100 for the quality-management system, and NADCAP Heat Treating for AMS 2750 pyrometry conformance on the specific furnace and temperature range. Munitions and armor work may add MIL-spec process requirements such as MIL-H or MIL-STD heat-treat callouts and material specs tied to the application.
The alloys reinforce why this matters: gun-quality 4340 and 300M ultra-high-strength steels, armor plate, and aerospace-grade stainless and titanium all demand controlled cycles where a pyrometry lapse produces a part that looks fine and fails in service. ITAR keeps the data secure; NADCAP keeps the furnace honest; AS9100 keeps the system traceable. Pull any one out and you have a gap.
For the buyer, the cleanest practice is to flow down all applicable requirements in the PO and verify each independently: confirm the DDTC registration is current, confirm the AS9100 certificate scope covers heat treating, and confirm the NADCAP scope covers your alloy's temperature range. Treat the three as a checklist, not a single box.
Frequently Asked Questions
No, and this is the single most common misunderstanding in defense sourcing. ITAR registration with DDTC under 22 CFR is an export-control compliance status: it confirms the entity is registered with the State Department, holds a registration code, renews annually, and is eligible to apply for export licenses. It involves no audit of furnaces, no pyrometry review, no metallurgical scope, and no quality assessment whatsoever. A shop can be perfectly ITAR-registered and still run sloppy thermal processing. That is precisely why ITAR almost always rides alongside a genuine quality system and process accreditation on defense heat treat work: AS9100 for the management system and NADCAP Heat Treating for AMS 2750 pyrometry conformance. When you qualify a defense heat treater, treat ITAR as the legal-access gate and verify the quality and process credentials separately. Confirming ITAR alone tells you the shop may legally touch the part, not that it will heat treat it correctly.
Almost never, and attempting it is a serious export-control risk. Sending a USML-controlled defense article outside the United States for processing is an export of that article, which generally requires specific DDTC authorization that most buyers neither hold nor can readily obtain. Beyond the physical part, the drawings, specifications, and process parameters are ITAR-controlled technical data, and transmitting them to a foreign person or foreign facility is a deemed export that also requires authorization. The practical reality is that ITAR-controlled heat treating stays domestic, performed by a US-registered shop with US-person handling from receipt through shipment. The cost premium of domestic, controlled processing is the price of compliance, and the penalties for getting it wrong, civil and criminal, dwarf any savings. Your supplier flow-down should state explicitly that controlled work remains in the United States, that technical data is restricted to US persons, and that no offshore subcontracting is permitted without prior written authorization.
Focus on who can see your drawings and how. ITAR treats specifications, process parameters, and dimensioned technical data for a USML article as controlled technical data, and disclosure to a foreign person, including a foreign-national employee working on US soil, is a deemed export requiring authorization under 22 CFR 120.62. So ask concrete questions: Are foreign-national employees walled off from controlled jobs and the associated prints? How are travelers and specs physically and electronically segregated from open shop traffic? How are your drawings transmitted, stored, and accessed, and is that environment access-controlled? Does the shop have a documented technical-data management procedure and an empowered official responsible for ITAR compliance? A heat treater with strong metallurgy but lax data handling is a real exposure, because the violation can occur the moment a controlled print lands in the wrong inbox. A mature defense shop will answer these readily and will have the segregation built into both its IT systems and its floor workflow.
Layer three independent requirements and verify each on its own. First, ITAR registration: confirm the shop holds a current DDTC registration with an active annual renewal, which establishes legal eligibility to handle the controlled article and data. Second, AS9100 Rev D: confirm the quality-management certificate's scope explicitly includes heat treating or thermal processing, which gives you configuration control, traceability, and counterfeit prevention. Third, NADCAP Heat Treating accreditation: confirm the AC7102 scope covers your specific alloy and temperature range, which enforces AMS 2750 pyrometry on the actual furnace. On munitions, armor, or gun-quality steel work you may also see MIL-spec heat-treat and material callouts flowed down through the PO. The reason for stacking is that each credential covers a different risk: ITAR for export compliance, AS9100 for the system, NADCAP for the metallurgy. None substitutes for another, so build them into the PO flow-down as a checklist and verify all three before release.
Last updated: July 2026
Find ITAR-Certified Heat Treating Suppliers
Search verified heat treating shops that hold ITAR.
No logins. No email gates. Just results.