ITAR registration is the door. The program is the building.

Most US manufacturers carrying ITAR registration are operating without the documented and operating export-control program the State Department Directorate of Defense Trade Controls (DDTC) actually expects. Registration completes a paperwork step. The program is the operating discipline that includes a documented Technology Control Plan, an operating Restricted Party Screening process, a named Empowered Official with documented authority, audit-ready recordkeeping, a Foreign Person access-control regime, a licensing workflow with operational SLAs, and a Voluntary Self-Disclosure procedure. Building the program takes one to three months of structured work. Operating it after that takes two to ten percent of one administrative role's time, depending on transaction volume. Not building it leaves the company exposed to license revocation, debarment, and (in violation cases) criminal liability for the individuals named in the registration.