Aerospace & Defense (ITAR / EAR / CMMC 2.0) Engineering Procurement: US-Person Staffing, Cloud CAD Traps & Air-Gapped AI

01The regulatory frame: ITAR, EAR, DFARS and CMMC

Four rule sets drive engineering procurement in this sector. They overlap, and each has its own regulator.

• ITAR (22 CFR Parts 120-130). Controls defense articles on the US Munitions List, the technical data that describes them, and defense services. Sharing ITAR technical data with a foreign person, including a foreign national employee inside the US, is generally an export that needs authorization. Most CAD models, drawings and simulation decks for USML items are technical data.
• EAR (15 CFR Parts 730-774). The Commerce Department's rules for dual-use items and the 600-series items that moved off the USML. Licensing depends on the ECCN, destination and end use. Many commercial aerospace parts fall here rather than under ITAR.
• DFARS 252.204-7012. Requires contractors handling covered defense information to implement NIST SP 800-171, report cyber incidents within 72 hours, and use cloud services that meet security requirements equivalent to the FedRAMP Moderate baseline.
• CMMC 2.0 (32 CFR Part 170). The program that verifies those controls. Level 1 covers federal contract information with annual self-assessment. Level 2 covers controlled unclassified information and maps to the 110 NIST SP 800-171 requirements, with self-assessment or third-party (C3PAO) assessment depending on the contract. Level 3 adds requirements from NIST SP 800-172 with government assessment. The DFARS clause that puts CMMC into contracts is being phased in; check each solicitation for the level it names.

Export classification comes first. If no one has classified the data, you cannot decide who may touch it or where it may be stored.

02US-person staffing: what to require from agencies and outsourcers

A US person under the ITAR is a US citizen, a lawful permanent resident, or a protected individual such as a refugee or asylee. Visa status alone does not qualify. Staffing contracts should make the agency, not just the engineer, accountable for this.

• Verification before access. Require the agency to verify US-person status from documents before the start date and certify it in writing for each placement. Your own export compliance team should still record the check.
• No unapproved subcontracting. Many staffing MSAs allow the agency to subcontract to other vendors. Prohibit it for controlled programs without your written consent.
• Offshore bureaus. Offshore CAD and FEA bureaus at $18-$32/hr are generally not usable for ITAR technical data without a DDTC authorization such as a technical assistance agreement. Use them only for work your export team has classified as uncontrolled, or as EAR items eligible to the destination.
• Clearances. A security clearance is separate from US-person status. Cleared roles command a premium and long lead times; budget at the upper end of the $72-$135/hr bill-rate range.

Agency markups of 42%-65% apply here as anywhere. On a $70/hr base wage, a 55% markup gives a $108.50/hr bill rate, about $225,700 a year at 2,080 hours. Ask whether the markup is higher for cleared roles and why. Compare with the staffing vs outsourcing TCO calculator.

03Cloud CAD and PLM traps

Cloud-hosted CAD, PDM and PLM are convenient, and the default commercial tenant is often not where ITAR data or CUI should live. Check these before signing.

Both the ITAR and the EAR contain carve-outs that treat certain end-to-end encrypted unclassified technical data as not exported when specific conditions are met. Read the current text with counsel before relying on them; the conditions on encryption standards and key access are strict. Government-cloud tiers of collaboration and CAD services are commonly priced above commercial tiers, so get that figure in the quote, not at renewal. See the CAD platform TCO comparison for base seat costs.

04The technology control plan is a procurement document

A technology control plan (TCP) describes how a site keeps controlled data away from people not authorized to see it: badge zones, vault permissions, screen policies, visitor rules, and who approves exceptions. Many buyers treat it as a security document. It is also the reference every supplier contract should point to.

• Staffing. Each contract engineer signs the TCP acknowledgement on day one, and the agency agrees to notify you before any change in the engineer's status.
• Software vendors. On-site support visits and remote support sessions follow the TCP. A remote screen-share by a support engineer outside the US can be an export if a controlled model is open.
• Outsourcers and test labs. The TCP sets which data classes leave the building and how they are marked. Ask suppliers how they mark and segregate controlled files in their own systems.

Penalties for ITAR and EAR violations can be severe, including civil fines assessed per violation and debarment. That is why a supplier who answers TCP questions vaguely is a cost risk, not a compliance detail. Voluntary disclosure procedures exist under both regimes; involve counsel early if something goes wrong.

05AI copilots and air-gapped engineering

Public AI services that send prompts and files to a vendor-hosted model are generally not acceptable for ITAR technical data or CUI. Engineers pasting a part description or uploading a STEP file into a consumer chatbot may have made an export. Decide the policy before the tools arrive.

• Classify the use case. Searching uncontrolled supplier catalogs is different from summarizing a controlled design review.
• Ask for deployment options. On-premises, private VPC in a US government cloud region, or fully offline models. Get the data-retention terms in the contract: zero retention, no training on your data, US-person-only support.
• Check the CAD plugin path. A copilot that runs inside the CAD client may still call an external API. Ask for a network diagram.
• Log usage. Your CMMC audit and access control evidence should cover AI tools like any other system that touches CUI.

Expect enterprise or on-prem pricing to be custom and well above per-seat Pro tiers of $19-$39/user/month. Score the security posture and ROI together with the AI CAD copilot ROI scorecard, and see the enterprise PLM AI security audit for the questions in depth.

06Cost model: building a compliant engineering enclave for 25 engineers

A 25-engineer design group moving controlled work into a compliant enclave. CAD and simulation figures are house benchmarks; enclave and assessment lines are observed market ranges to check against written quotes.

The enclave and assessment lines are 15%-35% of the total here. The software lines are where audits usually find money: if floating-seat telemetry shows 9 of the 25 NX seats idle at peak, cutting them saves 9 x $11,500 = $103,500 a year, which pays for most of the assessment. Run the seat math with the CAD and PLM license audit calculator.

07Phased procurement checklist

Phase 1: Classify

• Jurisdiction and classification for each program's data: ITAR category, EAR ECCN, or uncontrolled.
• Map which systems hold which data: CAD vault, PLM, simulation clusters, email, AI tools.
• Read every active contract for DFARS 252.204-7012 and the CMMC level named.

Phase 2: Contract

• Staffing MSAs: US-person certification, no subcontracting without consent, technology control plan acknowledgement.
• Software and cloud: US-only data residency, US-person support, incident flow-down, government-tier pricing locked for the term.
• Outsourcers: written statement of which data classes they may receive, and any DDTC or BIS authorization relied on.

Phase 3: Operate and evidence

• System security plan and plan of action covering every engineering system.
• Quarterly access review of CAD vault and PLM against the US-person roster.
• Annual affirmation and reassessment schedule per your CMMC level.

Defense engineering corridors with dense cleared labor pools are covered in the NJ, MD and VA federal defense rates guide and the Seattle aerospace benchmarks.

08Run the numbers: aI CAD and engineering copilot ROI and ITAR / IP security scorecard

The same benchmarks as this sheet, with your inputs. Share link and printable brief open the full calculator page.