Executive Summary
ITAR export control rules follow your technical data wherever it lives. For many defense suppliers, that includes the ERP system running quotes, bills of materials, and job costing. If a foreign person can reach that data, an unauthorized export may occur without anything leaving the building.
Hosting your ERP in AWS GovCloud (US) can narrow that exposure. This guide shows where ITAR risk tends to hide in finance and operations software. It also covers how GovCloud may support compliance and what to review before CMMC Phase 2 in November 2026.
5 Key Takeaways
- ITAR-controlled technical data can end up in ordinary ERP records, such as item masters, drawings, and routings.
- Giving foreign-person employees or contractors access to that data may count as an unauthorized export. [5]
- AWS GovCloud (US) is physically located in the US, and AWS personnel access is limited to US persons. [3]
- ITAR civil penalties can reach $1,271,078 per violation, or twice the transaction value, whichever is greater. [6]
- CMMC Phase 2 is scheduled to begin November 10, 2026, bringing third-party Level 2 assessments into many new contracts. [8]
What ITAR Export Control Means for Your ERP Data
The International Traffic in Arms Regulations govern defense articles, defense services, and related technical data. The State Department’s Directorate of Defense Trade Controls (DDTC) administers them.
Most finance leaders picture ITAR as a shipping issue. In practice, a larger share of the exposure often sits inside your business systems.
Technical Data Hides in Everyday ERP Records
Your ERP was built for accounting and inventory, not export control. Yet defense manufacturers routinely store sensitive details inside it. Common examples include:
- Item descriptions that reference USML-controlled parts or specifications
- Attached drawings, CAD files, and engineering change notices
- Bills of materials and routings that show how a defense article is built
- Work instructions, inspection plans, and supplier quotes tied to controlled programs
Any of these could qualify as technical data, depending on the content. Your export compliance team should make that call, not your IT vendor.
A Deemed Export Can Happen Without a Shipment
Releasing technical data to a foreign person can count as an export, even inside the United States. Boeing learned how costly that can become.
In 2024, the State Department announced a $51 million settlement with Boeing covering 199 alleged violations. [5] The case centered on technical data reaching foreign-person employees and contractors without authorization. Boeing voluntarily disclosed the conduct, and most of it predated 2020. [5]
Your ERP user list deserves the same scrutiny. So do the administrators and support staff working behind it.
Why On-Premise Servers and Commercial Cloud Leave Gaps
Many small and mid-size defense suppliers still run Sage or QuickBooks on a server in a back room. Others rely on a general hosting provider or a commercial cloud region.
Both setups can work for everyday accounting. For ITAR data, they may leave gaps that are hard to document. Consider who can touch the environment:
- An outsourced IT firm may route after-hours tickets to offshore technicians.
- Infrastructure support teams in commercial regions may not be limited to US persons.
- Backups may replicate to locations you cannot easily confirm.
- Shared admin passwords can make access logs difficult to prove during an audit.
None of these guarantees a violation. Each one, though, adds a question an auditor or investigator could reasonably ask.
Disclaimer: This comparison summarizes general characteristics of common ERP hosting setups based on publicly available AWS documentation. Individual environments, vendors, and configurations may differ. It is offered as a planning reference only and does not represent an audit finding, legal opinion, or guaranteed compliance outcome.
How GovCloud Hosting Supports ITAR Compliance
AWS GovCloud (US) is an isolated AWS region built for regulated workloads. According to AWS’s ITAR compliance overview, the environment is physically located in the United States. [3] Access by AWS personnel is limited to US persons. Accounts go only to US persons working for US organizations. [3]
The AWS GovCloud (US) User Guide lists support for the FedRAMP High baseline, DoD SRG, CMMC, and ITAR. [4] An independent third-party assessor has also reviewed its controls. [3] That foundation can make it easier to show where data lives and who can reach it.
One point matters for every buyer. No formal ITAR certification exists for cloud platforms, and AWS says so directly. [3] Your company still owns its export compliance decisions, even on GovCloud.
That is where a managed ERP host fits in. CFO Tech’s GovCloud Hosting runs Sage and QuickBooks on AWS infrastructure designed to support ITAR, EAR, and FedRAMP requirements. The service is backed by SOC 1, SOC 2, and SOC 3 reports. Your team can focus on the books instead of the servers.
The Encryption Carve-Out Has Limits
Since March 25, 2020, ITAR has treated certain encrypted technical data differently. [2] Under 22 CFR 120.54, storing unclassified technical data may not be an export if it is end-to-end encrypted. [1] The encryption generally must use FIPS 140-2 compliant modules, a successor standard, or comparable protection. [1]
That rule helps with email and file storage. A live ERP is harder, because users need decrypted data to run reports and post transactions.
The carve-out also requires that decryption keys stay away from third parties. [1] If a host’s administrators can view plaintext data, the carve-out may offer little protection. That is why the people operating your infrastructure still matter.
What an ITAR Violation Could Cost a Mid-Size Supplier
ITAR civil penalties are adjusted for inflation. The State Department’s 2025 penalty adjustment set the maximum at $1,271,078 or twice the transaction value, whichever is greater. [6] Each unauthorized access event could potentially be counted as a separate violation.
DDTC has discretion to assess lower amounts, and voluntary disclosure can influence outcomes. Still, legal fees, remediation, and lost contract eligibility can add up quickly. IBM’s 2026 Cost of a Data Breach research put the global average breach cost at a record $4.99 million. [10]
Disclaimer: These figures are hypothetical scenarios that multiply the published statutory maximum by an assumed number of violations. They are not predictions. Actual penalties are set case by case and may be substantially lower based on disclosure, cooperation, and other factors. This chart is for general awareness and planning purposes only.
CMMC Phase 2 Raises the Stakes in November 2026
ITAR is only one layer. The DoD’s CMMC acquisition rule took effect on November 10, 2025, placing cybersecurity requirements directly into contracts. [7]
According to Arnold & Porter’s analysis of the final rule, Phase 2 begins November 10, 2026. [8] Many new solicitations may then require a third-party Level 2 certification assessment as a condition of award. [8]
Level 2 is built around the security requirements in NIST SP 800-171. [9] Because ITAR technical data often qualifies as controlled unclassified information, the two regimes tend to overlap. A clearly bounded, U.S.-person-controlled ERP environment may simplify parts of that assessment.
How Do You Move an ITAR-Controlled ERP to GovCloud?
A careful migration usually follows these steps:
- Classify your data. Have export compliance staff identify which ERP records contain technical data.
- Map every access path. List users, admins, IT vendors, integrations, and backup locations.
- Confirm U.S.-person status. Verify that anyone with system or support access qualifies or holds authorization.
- Select a GovCloud-capable ERP host. Ask about staffing, audit reports, encryption, and incident response.
- Migrate and test. Move data in a planned window, then validate reports, integrations, and permissions.
- Update your documentation. Reflect the new environment in your Technology Control Plan and system security plan.
Frequently Asked Questions
Does ITAR require GovCloud specifically?
No regulation names a specific cloud product. GovCloud’s U.S.-only location and U.S.-person staffing may, however, make ITAR controls easier to demonstrate. [3]
Is AWS GovCloud ITAR certified?
No formal ITAR certification exists for cloud platforms. AWS states that GovCloud supports customers building ITAR-compliant systems. [3]
Can we keep using Sage or QuickBooks?
In most cases, yes. Hosting typically moves your existing ERP software and data to a secure cloud server rather than replacing it.
Can foreign-national employees still use our ERP?
Possibly, with proper DDTC authorization and role-based permissions. Your export counsel should review each situation before granting access.
Does end-to-end encryption alone solve ITAR risk?
It can help with storage and transmission. The carve-out has conditions, though, and live ERP data is often decrypted during use. [1]
How long does a GovCloud ERP migration take?
Timelines vary with data volume, integrations, and user count. Many smaller environments can potentially move within a few weeks.
Ready to Protect Your ERP Before an Auditor Asks?
ITAR export control obligations reach every system that touches your technical data, including the ERP running your business. Moving it to a U.S.-person-controlled environment may reduce uncertainty and strengthen your audit trail. See how it could work for your team with a free test drive, and request a live demo today.
Key References And Sources
- Source [1]: eCFR. (2026). “22 CFR 120.54 Activities That Are Not Exports, Reexports, Retransfers, or Temporary Imports.” Retrieved from https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-120/subpart-C/section-120.54
- Source [2]: Federal Register. (2019). “International Traffic in Arms Regulations: Creation of Definition of Activities That Are Not Exports, Reexports, Retransfers, or Temporary Imports.” Retrieved from https://www.govinfo.gov/content/pkg/FR-2019-12-26/html/2019-27438.htm
- Source [3]: Amazon Web Services. (2026). “ITAR.” Retrieved from https://aws.amazon.com/compliance/itar/
- Source [4]: Amazon Web Services. (2026). “Compliance: AWS GovCloud (US) User Guide.” Retrieved from https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-compliance.html
- Source [5]: US Department of State. (2024). “U.S. Department of State Concludes $51 Million Settlement Resolving Export Violations by The Boeing Company.” Retrieved from https://www.state.gov/u-s-department-of-state-concludes-51-million-settlement-resolving-export-violations-by-the-boeing-company/
- Source [6]: Federal Register. (2025). “Department of State 2025 Civil Monetary Penalties Inflationary Adjustment.” Retrieved from https://www.federalregister.gov/d/2025-00361
- Source [7]: Federal Register. (2025). “Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041).” Retrieved from https://www.govinfo.gov/content/pkg/FR-2025-09-10/html/2025-17359.htm
- Source [8]: Arnold & Porter. (2025). “CMMC Final Rule: Key Takeaways for Defense Contractors.” Retrieved from https://www.arnoldporter.com/en/perspectives/advisories/2025/09/cmmc-final-rule-key-takeaways-for-defense-contractors
- Source [9]: NIST. (2024). “SP 800-171 Rev. 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.” Retrieved from https://csrc.nist.gov/pubs/sp/800/171/r3/final
- Source [10]: IBM. (2026). “IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average.” Retrieved from https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
Disclaimer: The information in this blog post is provided for general informational and educational purposes only. It does not constitute legal, export compliance, financial, or IT advice. ITAR, EAR, and CMMC obligations depend on your specific products, contracts, and data, and should be evaluated by qualified export counsel. Statistics, penalty amounts, and dates cited from third-party sources are attributed to their original publishers, and CFO Tech makes no independent representation as to their ongoing accuracy. Regulations and service offerings referenced here are subject to change. Hosting on GovCloud infrastructure does not by itself establish ITAR or CMMC compliance. Readers are encouraged to conduct their own due diligence before making infrastructure or compliance decisions.