How do I handle ITAR-controlled drawings when quoting?

Stop at the marking and verify the scope

An ITAR marking is a signal to stop ordinary RFQ forwarding. Ask the customer which items and data are controlled, which contract or authorization applies, whether the supplier is expected to be a US person, and how records must be retained or destroyed. A drawing can be both ITAR-controlled and CUI; one label does not replace the other program. Keep the customer’s written answer with the RFQ.

Do not assume that machining in the United States alone solves the issue. An outside processor, inspection lab, software provider or support person may be a foreign person under the authorization terms. If you cannot verify the path, pause the quote or decline it rather than uploading the drawing to a convenient service.

Price the controlled work as its own routing line

The worked example assumes $150 for controlled intake, access review and record setup, two machine hours at $125/hour ($250), and $40 material. Internal cost is $150 + $250 + $40 = $440. A 25% markup would make $550. If the customer requires a US-person outside inspection at $90/hour for 0.5 hour, add $45 before markup; if the vendor charges a $125 lot minimum, use that documented amount instead of guessing.

Whether you show a compliance line to the buyer depends on the contract and your commercial practice. You can include it in an engineering or handling line while stating what is included. Never claim a certification you do not hold, and never imply that a product feature substitutes for your ITAR program.

• Check whether your business needs DDTC registration

Control the handoff and close the record

Use a named owner for the RFQ. Keep permissions narrow, disable public links, record downloads and make sure the quote PDF itself does not reproduce controlled technical data. When the job is awarded, flow the marking and handling instructions to every authorized subcontractor. When it is declined or complete, follow the customer’s retention and destruction terms; do not improvise deletion from one laptop while copies remain in email and backups.

Review export-control questions with qualified counsel or an export-compliance professional. The DDTC registration question is separate from whether a particular transfer is authorized, and registration itself is not an export license.

• Decide whether email or Dropbox is an acceptable transfer path

What to do next

Create a one-page ITAR intake gate, train estimators to stop on a marking and keep the customer’s authorization attached to the quote record. If the shop cannot provide the required access and storage controls, say so promptly. A fast no-quote is safer for the customer and for your business than an uncontrolled “budgetary” price.