The ITAR Storage Misconception
One of the most common misconceptions MAD Security encounters during client engagements is the belief that ITAR-controlled data is compliant if it is stored within the United States.
At first glance, that assumption seems reasonable. Many defense contractors use Microsoft 365 Commercial or Microsoft Government Community Cloud (GCC) because they offer strong security capabilities and are widely adopted across the government contracting community. As a result, organizations often assume these environments automatically satisfy International Traffic in Arms Regulations (ITAR) requirements.
The reality is more complicated.
When contractors ask, "Where can ITAR data be stored?" the answer depends on more than the physical location of the data. ITAR focuses heavily on who can access regulated technical information. Unauthorized access to ITAR controlled technical data by a foreign person may create compliance concerns even if the data never leaves a U.S.-based data center.
This is not a hypothetical issue. During scoping discussions, MAD Security frequently encounters organizations that are surprised to learn their existing cloud environment may not align with their ITAR obligations. In many cases, the organization selected a platform based on security features alone without fully evaluating administrative access restrictions.
As organizations prepare for Cybersecurity Maturity Model Certification (CMMC) requirements and increasing Department of Defense cybersecurity requirements, defense contractor cybersecurity programs must address both regulatory and operational risks. Understanding where ITAR data can be stored is an important part of that process.
Before evaluating cloud environments, it is important to understand what ITAR protects and why data storage decisions matter.
What Is ITAR and Why Does Data Storage Matter?
ITAR is a U.S. export control regulation designed to protect sensitive defense-related information from unauthorized access, disclosure, or transfer. For defense contractors, ITAR often applies to technical data related to military systems, manufacturing processes, engineering drawings, software, testing procedures, and other information that could impact national security if improperly disclosed.
One of the most important concepts within ITAR is the idea of a deemed export. Many organizations assume an export only occurs when information leaves the country. Under ITAR, however, access to controlled technical information by a non-U.S. person may be considered an export even when the data remains inside the United States.
This distinction is what makes ITAR data storage different from many other compliance requirements. Physical location matters, but it is only one part of the equation. Organizations must also evaluate who can access systems, administer cloud environments, and provide technical support.
For contractors evaluating Microsoft 365 Commercial, GCC, Microsoft GCC High, Azure Government, or AWS GovCloud, understanding this distinction is critical. The ability to restrict, monitor, and document access by authorized U.S. persons is a significant component of meeting ITAR obligations.
That brings us to the most important principle of ITAR data storage: access must be restricted to authorized U.S. persons.
The Critical Requirement: Access Must Be Restricted to U.S. Persons
At the heart of ITAR compliance is a simple requirement: access to regulated technical information must be restricted to authorized U.S. persons.
This is where many organizations encounter challenges. They focus on where information is stored while overlooking who may have the ability to access, manage, support, or administer that information.
A useful way to think about this is the difference between physical location and logical access. Physical location refers to where data resides. Logical access refers to who can interact with systems containing that data. An environment can store information entirely within the United States while still creating compliance concerns if non-U.S. persons have administrative or support access.
What Counts as Access Under ITAR?
Organizations evaluating ITAR cloud storage options should consider several forms of access:
| End-user access to view or modify technical information | |
| Administrative access used to manage systems and security controls | |
| Technical support access provided by cloud vendors | |
| Incident response access during troubleshooting activities | |
| Third-party vendor access associated with outsourced services |
For defense contractors, the challenge is not only restricting access but also demonstrating that restrictions are actively enforced. This becomes especially important when preparing for CMMC compliance efforts and reviewing cloud environments that store sensitive information.
Understanding who can access your environment is often the deciding factor between an ITAR-compliant cloud strategy and one that creates unnecessary compliance risk.
That reality becomes particularly important when evaluating Microsoft 365 Commercial.
Why Microsoft 365 Commercial Is Not Suitable for ITAR Data
Microsoft 365 Commercial is a powerful platform that delivers strong security capabilities for many organizations. However, it was not designed specifically around ITAR's access requirements.
The primary concern is not where the data is stored. The concern is administrative and support access. Microsoft 365 Commercial operates within Microsoft's global commercial cloud infrastructure. Depending on the service and support model, personnel outside the United States may be involved in administrative or support functions.
For organizations handling ITAR-controlled information, this creates an important consideration. Compliance is not determined solely by data residency. Contractors must also evaluate whether access controls align with ITAR's U.S. person requirements.
At MAD Security, this is one of the most common misconceptions uncovered during compliance readiness discussions. Organizations often assume that because Microsoft 365 Commercial is secure, it must also be appropriate for ITAR-regulated information.
Security and compliance are not always the same thing.
A cloud environment may offer strong cybersecurity protections while still creating challenges related to administrative access restrictions. That is why organizations evaluating cloud storage for ITAR data should look beyond security features and carefully review who can access the environment behind the scenes.
For many contractors, that realization leads to another question: what about GCC?
Why Microsoft GCC Still Falls Short for ITAR Compliance
Microsoft GCC provides additional protections compared to the commercial environment and is commonly used by government contractors handling Controlled Unclassified Information (CUI).
However, GCC and Microsoft GCC High serve different purposes.
One of the most common misunderstandings is that GCC automatically addresses all defense-related compliance requirements. Organizations handling ITAR-controlled information must still evaluate administrative access restrictions, support models, and contractual obligations. Microsoft GCC High was designed to support organizations within the Defense Industrial Base (DIB) and those supporting Department of Defense programs by providing a U.S. sovereign cloud environment with screened U.S. person administrators. The environment includes controls that more closely align with defense-sector requirements, including support for Defense Federal Acquisition Regulation Supplement (DFARS) compliance, National Institute of Standards and Technology Special Publication 800-171 (NIST SP 800-171) requirements, and CMMC compliance initiatives.
Organizations using GCC should carefully evaluate whether their environment supports their specific ITAR obligations. Simply moving from Commercial to GCC does not automatically resolve access-related compliance concerns. This is often where contractors discover gaps.
They may have already completed a migration only to learn additional controls, or platform changes are necessary to support their contractual requirements.
Once contractors understand the differences between Commercial, GCC, and GCC High, the next step is evaluating which environments are better suited to support ITAR requirements.
Environments Better Suited for ITAR-Controlled Data
When contractors ask where ITAR data can be stored, the answer depends on their operational requirements, contractual obligations, and ability to control access.
The most important consideration is not simply where the data resides. Organizations must also evaluate who can access the environment, how access is managed, and whether those controls can be demonstrated during compliance activities.
Microsoft GCC High
For many defense contractors, Microsoft GCC High is often the first environment evaluated for handling ITAR-controlled information and CUI.
Key considerations include:
| Designed for organizations within the Defense Industrial Base | |
| Supports DFARS compliance, NIST SP 800-171 requirements, and CMMC initiatives | |
| Enhanced administrative access controls | |
| Better alignment with U.S. person requirements | |
| Familiar Microsoft ecosystem for users and administrators |
For organizations already invested in Microsoft technologies, GCC High often provides a practical path forward while supporting defense-sector compliance objectives.
Azure Government
Azure Government provides dedicated infrastructure and security controls designed for government agencies and contractors supporting federal missions. Organizations handling ITAR controlled technical data should verify that the specific Azure Government service used falls within Microsoft's documented export control boundary and contractual commitments.
Organizations with specialized applications, development requirements, or hosting needs often evaluate Azure Government when determining where ITAR data can be stored.
AWS GovCloud
AWS GovCloud is commonly used by organizations handling regulated workloads that require strict access controls and government-focused compliance support.
Many contractors choose AWS GovCloud when they need flexibility for cloud-native applications while maintaining security and compliance requirements. Organizations remain responsible for configuring access controls and ensuring only authorized U.S. persons administer workloads containing ITAR controlled technical data.
On-Premises Solutions
Some organizations choose to maintain ITAR-controlled information within tightly managed on-premises environments where they retain direct control over infrastructure and administrative access.
While this approach can provide additional control, it also places greater responsibility on the organization to manage security, monitoring, maintenance, and compliance activities.
Regardless of the platform selected, organizations must be able to demonstrate that access to regulated information is appropriately restricted and monitored.
How ITAR Storage Decisions Impact CMMC Compliance
ITAR compliance and CMMC compliance are often discussed separately, but they frequently overlap in practice.
Selecting the right cloud environment is only one step. Organizations must also demonstrate that access controls are properly implemented, monitored, and enforced.
NIST SP 800-171 places significant emphasis on access management, privileged account controls, audit logging, and monitoring activities. These same practices help support ITAR compliance by reducing the risk of unauthorized access.
CMMC requires implementation of NIST SP 800 171 security requirements protecting CUI. ITAR is an export control regulation. Although the two frequently overlap for defense contractors, compliance with one does not automatically establish compliance with the other.
ITAR Compliance Is About Access, Not Just Location
When contractors ask where ITAR data can be stored, the answer is not simply "in the United States."
ITAR compliance is fundamentally about controlling access to regulated technical information and ensuring that access is restricted to authorized U.S. persons. That is why evaluating administrative access, support models, and cloud provider controls is just as important as evaluating data residency.
For defense contractors, cloud environment decisions should be viewed through both cybersecurity and compliance lenses. The right solution should provide the controls, visibility, and documentation necessary to support both ITAR and CMMC requirements.
If your organization handles ITAR-controlled information, now is the time to review your cloud environment, evaluate who has access to regulated data, and identify potential gaps.
At MAD Security, these are conversations the team regularly has with defense contractors navigating ITAR compliance, CMMC compliance, and Department of Defense cybersecurity requirements. Whether managed internally or through managed security services, understanding the relationship between data location, access controls, and compliance obligations is critical to protecting sensitive information.
Ultimately, understanding the difference between data location and data access is the first step toward building a stronger, more compliant cybersecurity program.
Frequently Asked Questions (FAQs)
