# DDTC Guidance: DDTC ITAR Risk Matrix Supplement 1 - University Specific: DDTC ITAR Risk Matrix Supplement 1 - University Specific

> Federal · Agency guidance · In force

URL: https://www.frixlaw.com/law-library/statutes/DDTC_GUID_DDTC_ITAR_RISK_MATRIX_SUPPLEMENT_1_UNIVERSITY_SPECIFIC_17673e1c

## Section

- **Citation:** DDTC Guidance: DDTC ITAR Risk Matrix Supplement 1 - University Specific
- **Heading:** DDTC ITAR Risk Matrix Supplement 1 - University Specific
- **Jurisdiction:** Federal
- **Kind:** Agency guidance
- **Status:** In force
- **Text as of:** August 14, 2026
- **Source:** Compiled text
- **Location:** DDTC Policy Guidance Documents / DDTC ITAR Risk Matrix Supplement 1 - University Specific

## Text

1

ITAR COMPLIANCE RISK MATRIX FOR UNIVERSITIES

Version
Date
Description of Changes
1.0
09/08/2023
Final

2

SUPPLEMENT 1
ITAR COMPLIANCE RISK MATRIX FOR UNIVERSITIES

This document supplements the Directorate of Defense Trade Controls (DDTC’s) International Traffic in Arms Regulations (ITAR) Compliance Risk Assessment Matrix by
providing guidance specific to universities, research institutes, and laboratories. Users should reference both DDTC’s ITAR Compliance Risk Assessment Matrix and this
document when assessing their ITAR compliance risk.

Note: The ITAR Compliance Assessment Risk Matrix is meant to be a tool for organizations to use to review and assess their ITAR compliance risks and gain a general
understanding of their overall level of ITAR compliance risk. It is not intended to be comprehensive, nor is it intended to be exhaustive. ITAR compliance risks are specific to
each organization’s operations and functions. This information is not intended to serve as a basis for any action or decision on the part of the public or the DDTC. To the extent
there is any discrepancy between this information and either the Arms Export Control Act, as amended (AECA) or the ITAR, the AECA and ITAR will prevail.

ITAR Exposure
LOW RISK
MEDIUM RISK
HIGH RISK
Type of Research
Performed
•
Only conducts research that does not involve
ITAR-controlled activities or products.
•
Only conducts research considered Fundamental
Research (FR) (see ITAR § 120.34(a)(8))
screpancy between this information and either the Arms Export Control Act, as amended (AECA) or the ITAR, the AECA and ITAR will prevail.

ITAR Exposure
LOW RISK
MEDIUM RISK
HIGH RISK
Type of Research
Performed
•
Only conducts research that does not involve
ITAR-controlled activities or products.
•
Only conducts research considered Fundamental
Research (FR) (see ITAR § 120.34(a)(8)).
•
Occasionally conducts ITAR-controlled research
that falls outside the FR (i.e., basic and applied
research in science and engineering, ordinarily
published and performed at an institution of higher
learning in the United States)
•
Frequently conducts research that ITAR-controlled
research that falls outside the FR (i.e., basic and
applied research in science and engineering,
ordinarily published and performed at an institution
of higher learning in the United States)
Development
Work/Product
Development
•
Only develops work products that are not
subject to the ITAR.
•
Performs defense services for systems/articles that
results in an ITAR-controlled defense article or
technical data
•
Develops prototypes covered by ITAR-controlled
“specially designed” and developmental
subcategories.
•
Performs development work controlled under the
ITAR that is segregated from fundamental
research.
•
Performs defense services and/or development work
controlled under the ITAR.
•
Export control function is not sufficiently integrated
into research and/or student work on campus to
comprehensively identify and authorize ITAR-
controlled development work.
Foreign Persons
(Including Work on
ITAR-Controlled
Research)
•
Processes in place to (1) determine if
students, employees, faculty, or visitors on
campus are a foreign person who may be
involved in supporting U.S
Export control function is not sufficiently integrated
into research and/or student work on campus to
comprehensively identify and authorize ITAR-
controlled development work.
Foreign Persons
(Including Work on
ITAR-Controlled
Research)
•
Processes in place to (1) determine if
students, employees, faculty, or visitors on
campus are a foreign person who may be
involved in supporting U.S. government
defense contracts, (2) assess whether such
•
ITAR-controlled work and/or technical
data/defense articles on campus, and all foreign
persons working on ITAR-controlled research are
appropriately export licensed students or scholars.
•
Compliance program resources insufficient to
appropriately vet and address role, proximity, access,
and services provided for those who support U.S.
government defense contracts.

3

ITAR Exposure
LOW RISK
MEDIUM RISK
HIGH RISK
person requires access to ITAR-controlled
work or technical data, and (3) ensure the
required export authorizations or safeguards
are in place.
•
No ITAR-controlled work and/or technical
data/defense articles on campus.
•
Vetting of foreign persons is commensurate
with risk associated with role (e.g.,
undergraduate students, graduate students,
employees, visiting researchers, public
visitors), proximity, access and services
provided.
•
ITAR Compliance Program includes processes to
identify foreign persons and their activities on
campus who might participate in U.S. government
contracts but, is not consistently integrated with
the export control function to assure access
controls and that appropriate prior
approvals/exemptions are obtained.
•
University has a foreign person visitor policy that
addresses their role, proximity, access, and
services provided, and practices are consistent
with ITAR compliance policy.
•
Policies and procedures not in place to identify and
control technical data or defense articles to prevent
unauthorized exports to foreign persons on campus
at appropriate prior
approvals/exemptions are obtained.
•
University has a foreign person visitor policy that
addresses their role, proximity, access, and
services provided, and practices are consistent
with ITAR compliance policy.
•
Policies and procedures not in place to identify and
control technical data or defense articles to prevent
unauthorized exports to foreign persons on campus.
Staffing
•
No ITAR-controlled work and/or technical
data/defense articles on campus.
•
Processes in place to determine (1) if staff is a
foreign person (2) assess whether such person
requires access to ITAR-controlled work or
technical data and (3) ensure the required
export authorizations or safeguards are in
place.
•
Foreign persons on staff with proximity and access
to ITAR activities appropriately managed.
•
Foreign persons on staff and proximity and access to
ITAR activities is not appropriately managed.
Furnishing Defense
Services (ITAR § 120.32)
•
University does not furnish defense services.
•
ITAR compliance program includes appropriate
training, education, and consistent processes to
evaluate and track activities that may constitute
defense services and exports in furtherance of
defense services, e.g.:
o Release of technical data
o DDTC registration, control, ownership, or
inspection of defense articles.
•
University furnishes defense services that are
frequent, of significant duration, performed in more
than one university lab, or by more than one research
group, or of such complexity that identifying,
compartmentalizing, or implementing necessary
ITAR compliance is difficult.
•
ITAR compliance program resources are not
sufficiently matched with university risk profile such
that insufficient processes are in place.
Access/Release/Operation
of ITAR-Controlled
Defense Articles,
including Technical Data
and software
•
University does not have access to or use of
defense articles, technical data, or ITAR-
controlled software
essary
ITAR compliance is difficult.
•
ITAR compliance program resources are not
sufficiently matched with university risk profile such
that insufficient processes are in place.
Access/Release/Operation
of ITAR-Controlled
Defense Articles,
including Technical Data
and software
•
University does not have access to or use of
defense articles, technical data, or ITAR-
controlled software.
•
University accesses, receives, uses defense
articles, technical data, or ITAR-controlled
software.
•
ITAR compliance program includes a process to
identify, track and put appropriate controls around
•
ITAR compliance program resources are insufficient
and insufficiently integrated with operations to
determine whether university accesses, receives, uses
defense articles, technical data, or ITAR-controlled
software.

4

ITAR Exposure
LOW RISK
MEDIUM RISK
HIGH RISK
applicable defense articles, technical data, or
ITAR-controlled software.
•
ITAR compliance program resources are insufficient
and insufficiently integrated with operations to put
appropriate controls around applicable defense
articles, technical data, or ITAR-controlled software.
International Travel
•
University faculty and students conduct no or
minimal international travel.
•
International travel guidance offered to faculty and
students, but export control function is not
sufficiently integrated to capture all international
travel or appropriately review to assess whether
licenses are needed and obtain such authorizations
(licenses/exemptions).
•
International travel review occurs after travel (e.g.,
when receipts are submitted).
•
Sanitized loaner laptops and mobile devices are
made available and suggested to researchers
traveling to § 126.1 countries.
•
Appropriate pre-travel license review is in place to
obtain required authorizations
(licenses/exemptions)
es are needed and obtain such authorizations
(licenses/exemptions).
•
International travel review occurs after travel (e.g.,
when receipts are submitted).
•
Sanitized loaner laptops and mobile devices are
made available and suggested to researchers
traveling to § 126.1 countries.
•
Appropriate pre-travel license review is in place to
obtain required authorizations
(licenses/exemptions).
•
Policies and procedures not in place to track
international travel, obtain prior authorization to hand
carry defense articles, or permit access to technical
data from abroad.
•
Travelers are not consistently trained on applicable
on U.S. export control laws and regulations or
instructed to not provide defense services, engage
with foreign government entities, or access ITAR-
controlled technical data overseas without prior
export authorization.
•
Sanitized loaner laptops and/or mobile devices are
not available, and staff travel with every-day work
laptops, even when traveling to 126.1 countries.
Shipping
•
University does not possess or ship defense
articles or technical data.
•
University has restricted party screening
processes in place.
•
Shipping department works directly with
export control personnel.
•
University’s international shipping program
permits shipping of defense articles and retention
of documentation by non-administrative
departments, relying on training individuals to
recognize red-flag shipments and refer them to the
export office.
•
University has a high volume of international
shipments and has defense article inventory process
not integrated with university's shipping process.
•
Export office is not integrated in the process and
restricted party searches are not consistently
performed.
Procurement
•
Systems in place to identify requested
purchases of ITAR-controlled products,
includes prior notification requirement if item
is ITAR-controlled in procurement terms and
conditions
fense article inventory process
not integrated with university's shipping process.
•
Export office is not integrated in the process and
restricted party searches are not consistently
performed.
Procurement
•
Systems in place to identify requested
purchases of ITAR-controlled products,
includes prior notification requirement if item
is ITAR-controlled in procurement terms and
conditions.
•
Routinely trains procurement staff in how to
red flag purchases that may be ITAR-
controlled.
•
Systems in place to identify requested purchases
of ITAR-controlled products and accept or reject
prior to purchasing/receiving.
•
Systems not in place to identify requested purchases
of ITAR-controlled products and does not routinely
include prior notification requirement for ITAR in
procurement terms and conditions.
•
Procurement is an independent function with no
centralized training and no integration into the export
control function to red flag ITAR-controlled
purchases.
Incubator
•
University does not have incubator (or
equivalent) programs.
•
University has incubator (or equivalent) programs,
but they are limited to faculty, researchers, and
students primarily in support of undergraduate
•
University has incubator (or equivalent) programs,
and they are available to third parties, faculty,
researchers, and students. Graduate level courses are

5

ITAR Exposure
LOW RISK
MEDIUM RISK
HIGH RISK
courses and/or are limited to general scientific,
mathematical, or engineering principles commonly
taught in schools, colleges, and universities, and
university provides training and guidance to the
programs so they can assess in advance whether
they have received or are creating anything that
requires control.
•
Export control function is available to such
programs to assist with implementing appropriate
controls.
encouraged or required to develop or fabricate
prototypes for capstones or industry fellowships
es, and universities, and
university provides training and guidance to the
programs so they can assess in advance whether
they have received or are creating anything that
requires control.
•
Export control function is available to such
programs to assist with implementing appropriate
controls.
encouraged or required to develop or fabricate
prototypes for capstones or industry fellowships.
•
Incubator (or equivalent) programs exist but they are
not integrated with the export control function and do
not receive export control training or guidance to
perform their own analysis and implement their own
controls.
Communication Among
Departments
•
University is small with centralized and
shared services for functions such as human
resources, shipping, immigration, technology
transfer, procurement, travel, etc.
•
University uses standardized software
programs systemwide with automatic triggers
for additional review.
•
University is small to midsized with some
autonomous or decentralized units or campuses.
•
Major university services such as human
resources, sponsored programs, technology
transfers are centralized and/or include automatic
triggers for additional review.
•
Large university with multiple campuses and
organizational structures with complex reporting
lines.
•
Units operate autonomously using their preferred
method for human resources, sponsored programs,
etc.
•
Reviews are initiated ad hoc and primarily personal
communication.
International
Collaboration
•
University has no international engagement
and no research collaborations with foreign
entities.
•
Strategic mission of university is focused on
domestic activity.
•
Does not perform research in or on behalf of
a foreign country.
•
International engagement and travel are allowed
but not encouraged or considered important.
•
International engagement primarily occurs in areas
without ITAR-controlled activities
ional engagement
and no research collaborations with foreign
entities.
•
Strategic mission of university is focused on
domestic activity.
•
Does not perform research in or on behalf of
a foreign country.
•
International engagement and travel are allowed
but not encouraged or considered important.
•
International engagement primarily occurs in areas
without ITAR-controlled activities.
•
Has research collaborations with entities in ITAR
§ 126.1 countries and/or performs research in or
on behalf of these countries but has centralized
programmatic controls to ensure and document
ITAR compliance.
•
International engagement promoted and of strategic
importance. University, including science,
technology, engineering, and math (STEM)
departments, maintains close collaborations with and
in foreign countries, which may include foreign
campuses in ITAR § 126.1 countries.
•
University does not have processes in place to track
international collaborations vis-à-vis access to
defense articles or technical data.
•
Has research collaborations with entities in ITAR §
126.1 countries and/or performs research in ITAR §
126.1 countries – with decentralized or no procedures
for identifying and addressing controls to ensure and
document compliance.
Inventory and tracking
•
No ITAR-controlled inventory.
•
Screening review to prevent purchase or loan
of ITAR-controlled activity.
•
Routinely performs inventory and has processes in
place to track and appropriately control inventory
•
University has not identified where ITAR-controlled
equipment is used.
•
No regularly scheduled inventory tracking.
nsure and
document compliance.
Inventory and tracking
•
No ITAR-controlled inventory.
•
Screening review to prevent purchase or loan
of ITAR-controlled activity.
•
Routinely performs inventory and has processes in
place to track and appropriately control inventory
•
University has not identified where ITAR-controlled
equipment is used.
•
No regularly scheduled inventory tracking.

6

ITAR Exposure
LOW RISK
MEDIUM RISK
HIGH RISK
•
No loaning of university equipment.

access, such that new purchase requests and/or
prototypes receive advance review/evaluation.
•
Research equipment loaned with advance
screening and review.
•
Export control is not involved with loans of research
equipment.
Activities of
Recharge/Service
Centers
•
University performs no ITAR-controlled
activities and does not provide rate-based
services for a fee to any external entity.
•
University permits service centers to perform
defense services on behalf of internal and external
university customers and activities are generally
assessed to determine if the activity constitutes a
defense service, or otherwise involves a defense
article or technical data.
•
Foreign person participants are licensed or
exempted.
•
Non-university external clients and activities are
assessed, screened and activity and personnel are
appropriately controlled, licensed, or exempted as
applicable.
•
University does not evaluate work performed by
service centers to assess performance of defense
services.
•
High level of foreign person involvement.
Areas of Research
Expertise
•
University is wholly liberal arts.
•
University has graduate level research programs in
science and engineering.
•
University has graduate level research programs in
science and engineering and receives substantial U.S.
Department of Defense funding in these areas.
Campuses/Locations
•
Only one U.S. campus in one location.
•
International exchange programs are limited to
undergraduate exchange
is wholly liberal arts.
•
University has graduate level research programs in
science and engineering.
•
University has graduate level research programs in
science and engineering and receives substantial U.S.
Department of Defense funding in these areas.
Campuses/Locations
•
Only one U.S. campus in one location.
•
International exchange programs are limited to
undergraduate exchange.
•
No university owned/operated campuses/locations
overseas.
•
Multiple campuses in the United States.
•
University owned/operated campuses/locations
overseas.
Information Technology
(IT) Infrastructure
•
Centrally managed IT.
•
Policy on use of cloud and super-computing,
practices align with ITA compliance policy.
•
Data accessible only to U.S Persons.
•
Technical data is not backed up to servers in
foreign locations, unless compliant with the
provisions of ITAR 120.54(a)(5).
•
IT system is intentionally designed to achieve
the level of safeguarded required under the
ITAR.
•
Combination of IT management (some
autonomous or decentralized units or campuses
maintain independent IT system).
•
University permits use of cloud and super-
computing.
•
Research data may be stored outside United States
and unconfirmed compliance with the provisions
of ITAR 120.54(a)(5).
•
University uses virtual private network (VPN),
ITAR-controlled information is transferred
•
IT departments operate autonomously.
•
No policy or controls on use of cloud or
supercomputing or university defaults to cloud for
storage and transmission with no assessment of cloud
for ITAR-compliance.
•
No compliance program insight into whether data is
stored in or outside of the United States.
•
Insufficient ITAR Compliance Program resources
and/or integration with IT to track and manage
transfer of ITAR-controlled information.
•
Password changes encouraged.
percomputing or university defaults to cloud for
storage and transmission with no assessment of cloud
for ITAR-compliance.
•
No compliance program insight into whether data is
stored in or outside of the United States.
•
Insufficient ITAR Compliance Program resources
and/or integration with IT to track and manage
transfer of ITAR-controlled information.
•
Password changes encouraged.

7

ITAR Exposure
LOW RISK
MEDIUM RISK
HIGH RISK
•
Routine password changes required, and
multi-factor authentication used.
through encrypted file transfer protocols/encrypted
email only.
•
Routine password changes required.
Media/Public Relations
(PR)/Filming Requests
•
No ITAR-controlled activities, defense
articles, or technical data on campus.
•
No media/PR/filming requests/visits permitted to
labs with ITAR-controlled activities, defense
articles, or technical data unless appropriately
managed by export control function.
•
Media/PR/Filming requests are not integrated with
ITAR compliance program.
Publication Restrictions
•
University protocol precludes accepting
publication restrictions and practice is in line
with that protocol.
•
Publication restrictions are coordinated with
ITAR compliance program and are strictly
reviewed through lifecycle.
•
University protocol permits accepting publication
restrictions but only with approval and awareness
of compliance program and senior leadership
•
University has no protocol on publication restrictions
•
individual labs/departments make ad hoc decisions to
accept or decline and the compliance program is not
integrated into/notified of the decision for tracking
purposes
Technology
Transfer/Patents
•
University’s technology transfer office is
integrated with the ITAR Compliance
Program such that restrictions are highlighted
on funding associated with work that results
in an invention disclosure and ITAR
Compliance Program input is sought prior to
filing for patent protection and/or making
available for commercial licens
e decision for tracking
purposes
Technology
Transfer/Patents
•
University’s technology transfer office is
integrated with the ITAR Compliance
Program such that restrictions are highlighted
on funding associated with work that results
in an invention disclosure and ITAR
Compliance Program input is sought prior to
filing for patent protection and/or making
available for commercial license.
•
The technology transfer office receives
periodic training to assist in red-flagging
disclosures that may relate to or contain
controlled technical data or defense articles.
•
Restrictions are highlighted on funding associated
with work that results in an invention disclosure
and technology transfer office is encouraged to
seek ITAR compliance program input, but the
processes are not integrated to assure checks and
balances prior to filing for patent protection or
making available for commercial license.
•
The technology transfer office operates
independently of the ITAR compliance program and
is only made aware of relevant funding restrictions if
the researcher provides this information when
making an invention disclosure.
Classified Work
•
University does not accept classified work.
•
University performs classified work but does not
receive or retain classified materials on campus.
•
University performs classified research.
•
No program in place to control classified research or
the compliance program not involved.

## Nearby sections

- [DDTC Guidance: Commendations and Recommendations from Visiting Universities and Research Centers Commendations and Recommendations from Visiting Universities and Research Centers](https://www.frixlaw.com/law-library/statutes/DDTC_GUID_COMMENDATIONS_AND_RECOMMENDATIONS_FROM_VISITING_UNIVERSITIES_2c9ed5a0.md)
- [DDTC Guidance: Compliance Program Guidelines Compliance Program Guidelines](https://www.frixlaw.com/law-library/statutes/DDTC_GUID_COMPLIANCE_PROGRAM_GUIDELINES_cc037c57.md)
- [DDTC Guidance: DDTC ITAR Risk Matrix DDTC ITAR Risk Matrix](https://www.frixlaw.com/law-library/statutes/DDTC_GUID_DDTC_ITAR_RISK_MATRIX_5f67fa1c.md)
- [DDTC Guidance: DDTC ITAR Risk Matrix Supplement 1 - University Specific DDTC ITAR Risk Matrix Supplement 1 - University Specific](https://www.frixlaw.com/law-library/statutes/DDTC_GUID_DDTC_ITAR_RISK_MATRIX_SUPPLEMENT_1_UNIVERSITY_SPECIFIC_17673e1c.md)
- [DDTC Guidance: Guidance for Part 130 Certification for Agreements Guidance for Part 130 Certification for Agreements](https://www.frixlaw.com/law-library/statutes/DDTC_GUID_GUIDANCE_FOR_PART_130_CERTIFICATION_FOR_AGREEMENTS_23a4c522.md)
- [DDTC Guidance: Guidelines for Preparing Agreements Guidelines for Preparing Agreements](https://www.frixlaw.com/law-library/statutes/DDTC_GUID_GUIDELINES_FOR_PREPARING_AGREEMENTS_19c40d22.md)
- [DDTC Guidance: Seal Alert: Best Practices to Ensure the Compliant and Safe Transport of Goods and Commodities Seal Alert: Best Practices to Ensure the Compliant and Safe Transport of Goods and Commodities](https://www.frixlaw.com/law-library/statutes/DDTC_GUID_SEAL_ALERT_BEST_PRACTICES_TO_ENSURE_THE_COMPLIANT_AND_SAFE_T_cde0826a.md)

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/DDTC_GUID_DDTC_ITAR_RISK_MATRIX_SUPPLEMENT_1_UNIVERSITY_SPECIFIC_17673e1c. Check the current official text before relying on it. Not legal advice.