ITAR visitor management: Beyond the front desk

A visitor doesn’t have to leave with a document for an export to happen. A drawing on a screen or a technical conversation during a facility tour can expose controlled information without anything crossing a border.

For organizations working with defense technology, that makes visitor management about more than getting people through reception. Your team needs to know what each person can access and how to keep the visit within those limits.

This guide walks through the process, from pre-arrival screening to the records you’ll want ready for a compliance review.

What does ITAR mean for visitor management?

The International Traffic in Arms Regulations, or ITAR, govern defense articles, technical data, and defense services. The U.S. Department of State’s Directorate of Defense Trade Controls (DDTC) administers the regulations. They can affect manufacturers, suppliers, engineering firms, and other businesses whose work involves ITAR-controlled items or services, not simply every company selling to the government.

Under ITAR, sharing controlled technical data with a foreign person can count as an export—even during a conversation or tour inside your facility. Your visitor process needs to prevent that sharing unless it’s authorized. Getting through reception doesn’t mean someone can see everything onsite.

Not sure which export rules apply? Check out our ITAR vs. EAR guide where we focus on putting ITAR access rules into practice.

Build the visitor process from arrival to departure

Your export compliance team should define the access rules. Reception, security, and hosts need clear instructions for putting them into practice.

1. Review the visit before arrival

Start with what the person is coming to do. A meeting in an office may need different preparation from a demonstration beside controlled equipment.

Collect the visitor’s name, company, host, purpose, and requested areas. Identify whether the visit could involve controlled technical data or defense services, and send it to the appropriate reviewer before confirming access. If the agenda changes, revisit the approval.

Give hosts a clear way to handle last-minute guests, substitutes, and requests to enter another area.

In Envoy: Pre-registration and custom sign-in fields collect visit details. Advanced Visitor Approvals can route requests to designated reviewers using the conditions your team sets. 

2. Confirm who has arrived

At arrival, match the person to the approved visit and check identification using your site’s procedure. Staff should know what to do if the name differs, the ID raises a concern, or someone arrives without identification.

Keep identity verification separate from the export access decision. Confirming someone’s identity doesn’t establish their U.S. person status or what they’re authorized to see.

In Envoy: ID Scanning checks supported identity documents for issues such as expiration or signs of tampering and routes unsuccessful checks for admin review. 

3. Screen against the appropriate watchlists

Your compliance team should select the restricted-party and denied-party lists relevant to the visit, including applicable DDTC restrictions. An internal blocklist can capture your organization’s own access restrictions, but it serves a different purpose from government list screening.

When a potential match appears, pause the access decision to have a qualified reviewer investigate, and record how the match was resolved. A clean screening result doesn’t establish U.S. person status or replace an export authorization. ITAR’s prohibited activities and debarment rules should still be considered.

In Envoy: The Visual Compliance integration screens invitees or arriving visitors against the lists selected in your Visual Compliance account. It can flag matches for review and record who approved or denied the visit. Block list supports your internal restrictions.

4. Verify U.S. person status and the basis for access

For individuals, U.S. person includes U.S. citizens, lawful permanent residents, and certain protected individuals, including qualifying refugees and asylees. It does not mean “U.S. citizens only.”

Have your export compliance team define the evidence and review needed for the planned access. A U.S. driver’s license, a local address, or employment by a U.S. company doesn’t by itself establish U.S. person status.

For a foreign person, the reviewer needs to determine whether the proposed activity requires authorization and whether a valid authorization or exemption covers it. Confirm the people, information, activities, and conditions involved before the visit proceeds.

In Envoy: Custom fields, required document uploads, and approval workflows bring together what your team needs for review. Your team decides who can access controlled information. An ID scan or uploaded document alone doesn’t grant access.

5. Collect NDAs and explain the visit rules

Use your site’s required documents to explain confidentiality, photography, device use, and permitted areas. Make sure visitors know whom to ask before taking a photo, opening a file, or changing their route.

An NDA can record a confidentiality commitment, but it doesn’t authorize a release that ITAR would otherwise prohibit. Document requirements should follow your contracts, authorizations, and site procedures.

In Envoy: Visitors can read and sign an NDA or site agreement through documents before arrival or at check-in. Signed copies are saved with the visitor record, so they’re easy to find later.

6. Limit access to the approved areas

Translate the approval into practical boundaries: which rooms the visitor can enter, when access starts and ends, and what can be shown or discussed.

Prepare the space as well as the route. Close unrelated drawings, clear whiteboards, and check whether nearby work could expose controlled information. A visitor approved for one meeting shouldn’t automatically receive access to the surrounding production floor.

In Envoy: Badge printing makes visitors easy to recognize. Access control integrations, such as LenelS2 Netbox, can map visitor types to configured access levels and limit credential duration. Your access control system enforces the door permissions.

7. Make escort responsibilities clear

Where your site procedure or authorization requires an escort, name the employee responsible and explain the limits of the visit. The escort should know the approved route, permitted discussion topics, and what to do if plans change.

An escort’s presence doesn’t authorize the sharing of controlled data. Their role is to help keep the visit within its approved scope.

In Envoy: Host notifications let employees know when visitors arrive. Custom fields or private notes can show who’s escorting the visitor and when someone else takes over, but staff still need to make sure the visitor stays with their escort.

8. Close the visit and preserve the records

At departure, collect reusable badges, end temporary access, and record sign-out promptly. Document any change in scope or incident that needs follow up.

Keep the visit connected to its screening results, access decision, signed documents, and relevant authorization reference. Door activity and export approval records may live in separate systems, so use a consistent reference to connect them.

In Envoy: The visitor log and visitor data exports bring together visit details, custom fields, and sign-in and sign-out times. CSV or PDF exports support reviews, while your other systems supply the underlying access and export records.

What should you be able to show during a review?

Choose a recent visit and check whether your team can explain who approved it, what access was allowed, and how the visit followed those limits.

Your visitor records, together with screening, access control, and export compliance records, should help you show:

• Visitor, company, host, and purpose. Who visited and why.
• Identity check. How staff confirmed the visitor’s identity.
• Screening result and review. How potential matches were resolved.
• Status and access decision. Who reviewed and approved access, with any authorization reference.
• Signed agreements. Which site rules or confidentiality terms the visitor accepted.
• Approved areas and escort. Where the visitor could go and who was responsible for accompanying them.
• Arrival, departure, and access removal. When the visitor arrived, left, and had temporary access turned off.

How long should you keep the records?

ITAR’s recordkeeping rules generally require covered records to be kept for five years. The clock starts from the relevant license or approval’s expiration or the transaction date—not automatically when a visitor checks in.

Your export compliance team should decide which visitor records to keep and when that clock starts. Covered electronic records also need to track changes, including who made them and when, so a visitor log export alone may not cover everything you need.

Why getting this right matters

ITAR violations can lead to civil penalties and debarment. Willful violations can carry criminal penalties of up to $1 million per violation, 20 years in prison, or both.

DDTC and other authorized agencies can ask to inspect and copy your ITAR records, so your team needs to be able to find them and explain its access decisions.

Before your next review, follow one visit from the initial request to sign out. Did the visit stay within what was approved? Was temporary access turned off on time? Can you find the supporting records?

Explore Envoy’s trade compliance solutions, or book a demo to see how the visitor workflows could fit your site.

—

Frequently asked questions

Does ITAR require a visitor management system?

ITAR does not require a particular visitor management platform. Software can help your team apply access procedures and retrieve records, but compliance depends on the full process.

Can foreign persons visit an ITAR facility?

Yes, foreign persons can visit, but your export compliance team needs to check what they can see and do, and whether special approval is needed. Having an escort or signing an NDA doesn’t replace that check.

Does a U.S. driver’s license prove U.S. person status?

No. A driver’s license can help establish identity, but it doesn’t by itself establish U.S. person status under ITAR. Follow your export compliance team’s verification process.

Does every visitor need an escort?

There isn’t one escort rule for every ITAR-related visit. Follow your site’s access procedures and any conditions attached to the relevant authorization.

Can Envoy support ITAR-compliant visitor management?

Envoy supports pre-registration, identity checks, screening integrations, approvals, signed documents, badges, access control integrations, and visit records. Your export compliance team remains responsible for deciding who may access controlled items and information.