ITAR, DFARS, and Domestic Sourcing: How to Vet a VPX Hardware Supplier

Quality and compliance engineers qualifying a mechanical or thermal hardware supplier for a defense program are usually checking a handful of things at once, ITAR registration, DFARS compliance, domestic sourcing, and supply chain traceability. These get treated as interchangeable more often than they should. A supplier can be domestically based and still fall short on traceability documentation. A supplier can be ITAR registered and still miss DFARS clauses that apply to the same contract. Vetting a supplier correctly means evaluating each of these on its own terms, then checking how they fit together.

What Does ITAR Actually Require From a Hardware Supplier?

ITAR (International Traffic in Arms Regulations) is a State Department export-control regime. It governs the transfer of defense articles and defense-related technical data to foreign persons, whether that transfer happens by physically shipping a part overseas or by sharing drawings, specifications, or manufacturing data with a foreign national, including one working inside the United States, which is treated as a "deemed export" under ITAR.

A supplier that manufactures VPX mechanical hardware, wedgelocks, ejectors, or heatframes for defense programs typically needs to be ITAR registered with the Directorate of Defense Trade Controls. Registration establishes that the company has a compliance program in place for handling controlled technical data and defense articles. It does not certify anything about where a supplier's raw materials or components come from.

What Does DFARS Add on Top of ITAR?

DFARS (Defense Federal Acquisition Regulation Supplement) is issued by the Department of Defense, not the State Department, and it governs the contract itself rather than the export of defense articles. Where ITAR controls who can access a defense article or its technical data, DFARS sets requirements a supplier has to meet to hold a DoD contract or subcontract at all, cybersecurity controls for Controlled Unclassified Information, supply chain security and supplier screening, data rights, and small business subcontracting goals among them.

For a mechanical or thermal hardware supplier, applicable DFARS requirements depend on the contract and the clauses flowed down by the customer. Depending on the procurement, those requirements may address areas such as cybersecurity and controlled information, sourcing restrictions, specialty metals, counterfeit-part prevention, or other supply-chain requirements.

Is a Domestically Sourced Supplier Automatically ITAR or DFARS Compliant?

No. Both regulations are about how a company controls access, data, and its supply chain, not about where its manufacturing sits. A domestic supply chain does reduce exposure under both, fewer border crossings and fewer international subcontractors means fewer opportunities for controlled technical data to reach a foreign person, and fewer sub-tier vendors to screen against DFARS sourcing restrictions. But that's a byproduct of domestic sourcing, not a substitute for actual ITAR registration and a DFARS-compliant contracting program.

What Does "Domestic Sourcing" Actually Mean in Practice?

Domestic sourcing means a supplier's manufacturing and the large majority of its supply base are located inside the United States. During supplier qualification, that's worth checking in three specific places.

• Domestic manufacturing and machining: Machining and assembly performed at a US facility, whether in-house or through a domestic subcontractor, rather than outsourced overseas and merely finished or labeled domestically.
• Domestic outside processing: Plating, heat treating, and other secondary processes sourced from US-based vendors rather than shipped abroad and back.
• Raw material origin: Aluminum, fasteners, and other raw materials sourced domestically where possible, and disclosed honestly where they aren't.

WaveTherm's COTS product lines, SOLIDWEDGE™ wedgelocks, ejectors, and OpenCOTS heatframe kits, clear that bar completely. Assembly and a significant portion of the machining happen in-house at WaveTherm's Raleigh, NC facility, and the machining that is outsourced goes to domestic shops only, never overseas. Outside processing and raw materials behind those product lines are also 100% domestically sourced. The one exception is WaveTherm's test and validation fixture products, which include some non-domestic content. WaveTherm is also AS9100 certified, so that sourcing comes with the traceability documentation a program office can actually verify.

How Does Traceability Tie Into Domestic Sourcing and ITAR?

Traceability is the ability to document where a part's materials came from and where it was processed at each stage of manufacturing. It's what turns a domestic sourcing claim into something a program office can actually audit, and it's also what makes an ITAR compliance program credible under review. Keeping manufacturing and critical processes inside a domestic supply chain gives a supplier direct oversight of every stage a part passes through, which means faster root cause analysis when a part fails and simpler corrective actions and audits, since the supplier isn't coordinating across time zones and overseas intermediaries to get an answer.

Formal quality management standards like AS9100 already require configuration management and traceability throughout the product lifecycle. A domestic supply chain doesn't replace that requirement, but it makes it substantially easier to meet.

How Does WaveTherm Answer These Questions?

A compliance engineer vetting WaveTherm against everything above should get straight answers on each point.

• ITAR registered? Yes, registered with the Directorate of Defense Trade Controls, with experience handling the requirements that come with controlled defense programs.
• Domestic manufacturing? Assembly and a significant portion of machining happen in-house at WaveTherm's Raleigh, NC facility. Additional machining is outsourced, but only to domestic shops, never overseas.
• Domestic outside processing and raw materials? 100% domestic across WaveTherm's COTS product lines. The one exception is WaveTherm's test and validation fixture products, which include some non-domestic content.
• Quality certifications? AS9100 certified, which comes with the configuration management and traceability documentation that certification requires.

That's the level of detail a program office should expect from any mechanical or thermal hardware supplier before relying on it for a controlled defense program.