DDTC Issues New ITAR Compliance Risk Matrix

The Department of State, Directorate of Defense Trade Controls (DDTC) is issuing a new ITAR Compliance Risk Matrix, accompanied by a supplemental risk matrix specific to universities.

These risk matrices are intended to assist organizations in assessing their level of ITAR compliance risk and assist in the evaluation of potential compliance risks that are specific to each organization and that, if left unaddressed, may lead to ITAR violations.

The International Traffic in Arms Regulations (ITAR) Compliance Assessment Risk Matrix is a tool for organizationsthat manufacture, export, broker,
or temporarily import defense articles and defense services described on the United States Munitions List (USML) to assist organizations in assessing
their level of ITAR compliance risk.

ITAR risk assessments in the defense trade controls context are evaluations of the potential compliance risks that are specific to each organization and that, if left unaddressed, may lead to ITAR violations. ITAR risk assessments therefore allow organizations to ascertain and analyze

• the likelihood that ITAR violations may occur,
• the most common reasons ITAR violations may occur, and
• the types of ITAR violations that are most likely to occur or may result in harm to U.S. national security.

After conducting an ITAR risk assessment to understand the full
spectrum of ITAR compliance risks, organizations should use that data to create an effective and tailored ITAR compliance program and allocate
resources as appropriate to prioritize and mitigate those risks.

A basic approach to ITAR compliance involves three areas:

1. Identify any ITAR-controlled activities or defense articles, including technical data.
2. Recognize the threats and vulnerabilities relevant to those ITAR-controlled activities or defense articles, including technical data.
3. Formulate a risk-based ITAR compliance plan that mitigates the organization’s vulnerabilities.

This matrix is organized into:

1. Enterprise Risks – These risks should be understood as areas applicable to the entire organization, not the size of structure of the organization.
2. Organizational Function Risks – These risks should be understood as areas that are typically most applicable to the function or group within the
   identified responsibilities. If your organization does not have a function or group performing these tasks specifically, you should still consider these risks and where they exist in your organization.
3. ITAR Compliance Program Element Risks

The new risk matrices are available for download on the DDTC website.

• DDTC ITAR Risk Matrix 20230908
• DTCC ITAR Risk Matrix Supplement 1 - University-Specific 20230908