ITAR-Registered Turning Shops for Defense-Controlled Parts

The single most important thing to understand is that ITAR is not a quality standard like ISO 9001 or AS9100. The International Traffic in Arms Regulations (22 CFR 120 to 130) are administered by the Directorate of Defense Trade Controls (DDTC) within the US State Department. A turning shop that manufactures defense articles or furnishes defense services is required under 22 CFR 122 to register with DDTC. That registration is an enrollment and a fee, not an audited certification, and it does not by itself say anything about whether the shop turns parts accurately. What registration does signal is that the shop has acknowledged its obligations: controlling access to export-controlled technical data, restricting handling of controlled hardware to authorized persons, and not exporting defense articles or data without authorization. For a turning supplier, the controlled item is often both the physical part (a USML-listed component) and the technical data (the drawing, the CNC program, and the manufacturing know-how). Because it is enrollment rather than accreditation, ITAR registration is almost always paired with a real quality system. Most defense turning is done by shops that hold AS9100 or ISO 9001 for quality and ITAR registration for compliance. Treat them as two separate questions you must both answer: can they make the part right, and are they legally cleared to handle it.

ITAR's reach on a turning operation is mostly about information and access, not cutting parameters. Technical data, defined in 22 CFR 120.10, includes the drawings, models, CAD files, and CNC programs needed to manufacture a USML part. Releasing that data to a foreign person, even on US soil, is a deemed export and requires authorization. So a defense turning shop must control who can see the print and the program: a foreign-national machinist or contractor accessing the toolpath for a controlled part without a license is a violation. This drives practical controls on the floor: access-restricted file servers and ERP records, segregated storage for controlled hardware, visitor and personnel screening, and often a documented technology control plan. The US-person concept (US citizen, lawful permanent resident, or protected individual) defines who may handle the data without further authorization. A buyer should expect a serious ITAR turning shop to be able to describe how it restricts technical data and who on its floor is cleared. The hardware itself is controlled too. A turned breech component, a gun-mount fitting, or a guidance-system shaft listed on the USML cannot leave the US without a license or exemption. That affects subcontracting: if the turning shop sends your controlled part out for plating or grinding, that processor must also be inside the compliance boundary.

Unlike AS9100 in OASIS, there is no public registry where you can look up a shop's ITAR registration, because DDTC registration information is not publicly searchable. Verification is therefore done by direct evidence: ask the supplier for its DDTC registration code and a copy or attestation of its current registration letter, which DDTC issues annually. Registration must be renewed each year, so confirm the current registration period, not a lapsed one. The most common trap is a lapsed registration. Because it renews annually and is easy to let slip, a shop may have been registered last year but failed to renew; manufacturing a defense article during a lapse is a problem. A second trap is conflating ITAR with EAR: some parts are controlled under the Export Administration Regulations (Commerce) rather than ITAR (State), and the jurisdiction determines what authorization applies. Get the export classification right before assuming ITAR registration is the relevant control. A third trap is the subcontractor gap, noted above: a registered turning shop that outsources a controlled part to an uncleared processor breaks the chain. Finally, remember registration is not authorization to export; even a registered shop needs a license or exemption to send controlled data or hardware abroad. ManufacturingBase identifies suppliers that self-attest ITAR registration so you can shortlist them, then run your own direct verification before transmitting any controlled print.