ITAR Compliance Program Guidelines
ITAR visitor log: what DDTC’s guidelines say a Technology Control Plan should record about foreign person visitors
Your US partner’s compliance team has asked what the site records about foreign person visitors, and the document they are reading from is DDTC’s Compliance Program Guidelines. It lists six things a TCP visitor record should indicate, says of itself that it is guidance and not the regulation, and states no retention period. All of that is quoted below, and beside it is what an iPad at the door records towards each item: three of the six, and not the other three.
Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.
From £150 a month plus VAT, iPad and stand included. We are not export control advisers or consultants.
What the guidelines say
One list of six items, and four passages that say what the list is for
The guidelines are DDTC’s description of an effective ITAR compliance programme, arranged in elements. The visitor record sits in Element 3, Recordkeeping, under Technology Control Plans. The status line on page 3 and the risk areas in Element 6 say how much weight it carries.
Element 3, section C: Recordkeeping and Technology Control Plans
What a TCP should record about foreign person visitors
TCPs should also address how organizations will keep records regarding foreign-person visitors at their facilities. For example, organizations could document all foreign person visits and any special conditions attached to the visits. Such records should indicate: The visitor’s name and nationality or nationalities; The name and affiliation of the organization represented; The date of the visit; Persons, physical areas, and room numbers visited; Purpose of the visit with specific emphasis on products or services discussed; and A summary of the visit, including any issues or circumstances of note.
Six items, framed as should and could. Three of them, the name, the organisation and the date, are what any visitor log holds. The other three, nationality, the areas and rooms visited, and the purpose and summary, are what a TCP adds, and the page below says which of them a kiosk record carries and which it does not.
Element 3, section C
What a TCP is
Organizations that possess technical data and either employ foreign persons or conduct frequent meetings with foreign persons should consider creating and maintaining a Technology Control Plan (TCP). A TCP sets out an organization’s policies and procedures for protecting technical data and includes the following elements: Management commitment; Personnel-screening procedures; A physical security plan; An information security plan; and Training and awareness programs.
The visitor record sits inside the physical security plan of a document the guidelines say an organisation should consider creating. It is not a form the ITAR prescribes. What your TAA or MLA and your US partner require of a UK site is set by those documents and their provisos.
Page 3, status of the guidelines
Guidance, not the regulation
The guidelines contained in this document are not intended to serve as a basis for any registration or licensing decisions on the part of the public or DDTC. To the extent there is any discrepancy between these guidelines and either the AECA or the ITAR, the AECA and ITAR will prevail.
DDTC’s own words on what the document is. The visitor record list is a suggestion for an effective compliance programme, written for US registrants. It states no retention period for a TCP visitor record, and the page does not invent one.
Element 6, risk areas
Foreign person visitors and facility visits
Foreign Person Employees or Visitors: foreign person employees, visitors, etc. may pose a compliance risk to organizations if they are not properly authorized to have access to defense articles, including technical data, or receive defense services. Facility Visits: failing to verify the U.S.-person status of all visitors in advance of plant tours or facility visits in the U.S. creates the risk of inadvertent release of ITAR-controlled technical data.
Two of the common risk areas the guidelines list. The second is written for a US facility; at a UK site the question is who counts as a foreign person for your own authorisation, and that is your export control officer’s call, not the kiosk’s and not this page’s.
Pages 54, 55 and 58, checklist and audit questions
Escorts, badges and visitor access
Are foreign person visitors always escorted by a U.S. person employee of your organization? While visiting your organization, do visitors always wear badges that clearly indicate they are non-U.S. Persons? Do you have a process for visitor access? How do you process foreign national visitors? For example, screening, export analysis, badging, IT access, etc.
The questions a US partner’s compliance team may put to you, taken from the guidelines’ own self-assessment and audit lists. Escort and badge are the two a front desk can show; screening and export analysis happen before the visitor arrives and belong to the export control officer.
Quoted from the International Traffic in Arms Regulations (ITAR) Compliance Program Guidelines, U.S. Department of State, Directorate of Defense Trade Controls, the 63 page PDF on DDTC’s compliance portal, file dated 2 December 2022, read on 26 September 2026. DDTC’s own spelling is kept inside the quotations. Nothing in the guidelines tells you to buy anything: a TCP visitor sheet with the six columns, filled in by the host and kept with the TCP, is exactly what the document describes. What paper struggles with is the date last year your partner asks about, the departure time, and a badge that shows on its face who released it.
The record
Which of the six items the kiosk holds, and which it does not
Each line below describes what the kiosk’s code does, not what a brochure would like it to. Three of the six items are not in the record at all, and those lines say so first.
- Name, organisation, dateThe sign in form asks for the visitor’s name, their company, the person they have come to see and, if they drove in, a vehicle registration. Name, company and host are required. The date and time are stamped by the server, not typed, and the visitor signs out by name so the departure is stamped too.
- NationalityNot recorded. The form has no nationality field, and the kiosk stores no answers to anything, so a line in your declaration asking visitors to state a nationality would be read and accepted but never captured. Nationality, and who is a foreign person for your authorisation, is established by your export control officer before the visit and recorded by them. The kiosk gives them the visit to record it against.
- Persons visitedThe host is required on every sign in, stored with the visit, and told by name in Microsoft Teams or Slack the moment the visitor arrives. One host per visit; a visitor who meets three people is on the record against the one who signed them in.
- Physical areas, room numbers, purpose, summaryNot recorded. The form is fixed and has no field for any of them. If your TCP wants the areas visited, the purpose and a summary, those are the host’s notes on the visit, kept beside the kiosk record for the same period. We would rather say that here than on the call.
- Badges that indicate a foreign personWith the badge module, the label carries a clearance level you define, a label and a colour of your own choosing, with no built-in levels. A site can define a level whose label and colour mean what its TCP needs them to mean, and where the site requires approval nothing prints until a named approver enters a PIN. Who is assigned which level is the approver’s decision, not the kiosk’s.
- EscortedThe host is named and told at once, and the clearance colour tells anyone on the floor whether the wearer should be alone. The kiosk cannot see whether the escort stayed with them.
- RetainedThe guidelines state no retention period for a TCP visitor record. The ITAR’s five year rule on page 24 is for the records the ITAR requires, and whether your TCP visitor record is one of them is your export control officer’s reading. You set one retention period for the company, from one day to two years, with a year the default; if your TCP needs five, the kiosk record on its own cannot hold it that long, and the exported file can.
- Where it livesIn the European Union, in Ireland, on ISO 27001 certified infrastructure, under a data processing agreement supplied as standard. The security page lists every sub-processor and where each one is. Whether a third party processor may hold a register of foreign person visits under your TCP is a question for your export control officer.
The kiosk does not make a site compliant, authorised or approved. It produces a timestamped record for the passages named on this page, and your export control officer and your partner decide what that record is worth.
The visitor management kiosk in fullThe same door for the Facility Security Controller, under the MOD’s FSC guidanceThe same door under a US prime’s CMMC requirementsA non-disclosure wording accepted at the door, and the record of itWhere the data lives, and who touches it
On the questionnaire
What your partner asks, and what you put in front of them
| What you are asked | What you show them |
|---|---|
| Do you keep a record of foreign person visitors? | The visitor record for every visitor, with name, organisation, host and both times, and the export control officer’s own record of nationality, areas and purpose kept beside it. |
| Are foreign person visitors escorted? | A host named on every visit and told at once; with the badge module, a clearance colour on the printed badge set when the approver released it. |
| Do visitors wear badges that indicate they are non-U.S. persons? | With the badge module, a clearance level whose label and colour you define, printed on the badge after a named approver’s PIN. |
| Who was on site on this date? | A list filtered to that day with the host against each name, exported to a file the auditor can keep. |
| How long do you keep the record? | The retention period set for the company, with the exported file kept for as long as your TCP requires beyond it. |
Badges, made visible
A badge printed only after a named approver’s PIN
The visitor signs in and waits. The host is told, walks over and enters a PIN on the kiosk. No approval, no badge. The clearance label and colour on the label are yours to define, which is how a badge can carry whatever your TCP needs it to say.
The badge module is an add-on at £150 a month plus VAT, label printer included. The platform works without it. The player loads from YouTube only when you press play; nothing is sent to Google before that. What happens when you do.
Before you ask
The questions export control officers ask
Does the ITAR require a visitor log?
The regulation itself is not quoted on this page. DDTC’s Compliance Program Guidelines, which say of themselves that they are not a basis for any licensing decision and that the ITAR prevails over them, suggest that a Technology Control Plan should address how an organisation keeps records of foreign person visitors, and list six things such records should indicate. That is guidance on an effective compliance programme, not a regulatory form, and a UK site meets it through the terms of its TAA or MLA and its US partner’s requirements.
What should a TCP visitor record contain?
The guidelines list the visitor’s name and nationality or nationalities, the name and affiliation of the organisation represented, the date of the visit, the persons, physical areas and room numbers visited, the purpose of the visit with specific emphasis on products or services discussed, and a summary of the visit including any issues or circumstances of note. The kiosk record carries the name, the organisation, the date and the host. The rest is the host’s and the export control officer’s to write.
Does the kiosk record nationality?
No. The sign in form is name, company, host and a vehicle registration, and the kiosk stores no answers to anything else, so it cannot capture a nationality even if your declaration asks visitors to state one. Nationality, and whether a visitor is a foreign person for your authorisation, is established by your export control officer before the visit, and their record sits beside the kiosk’s.
Can the badge mark a visitor as a non-U.S. person?
With the badge module, yes, in the sense that the badge carries a clearance level you define, with a label and a colour of your own choosing and no built-in levels. What the level is called and who is assigned it are your decisions, made by the approver whose PIN releases the badge. The kiosk does not decide anybody’s status.
How long must ITAR visitor records be kept?
The guidelines state no retention period for a TCP visitor record. They do restate the ITAR’s rule that the records the ITAR requires are maintained for a period of five years from the expiration of the license or other approval, or from the date of the transaction. Whether your visitor record falls under that rule is a reading for your export control officer. The kiosk holds records for a period you set, up to two years; the exported file can be kept for as long as you need.
We are a UK site. Do the US person and non-U.S. person questions apply to us?
The guidelines are written for US organisations, and at a UK site almost everyone is a non-U.S. person. What matters for you is who counts as a foreign person relative to your own TAA or MLA, which turns on the authorisation’s terms, its provisos and the nationalities it covers. That is your export control officer’s question. The kiosk’s part is smaller and the same for everyone: who came in, who they came to see, what they accepted and when they left.
Being straight with you
What this does not do
- We are not DDTC, not an export control adviser, not a US person and not your US partner’s compliance team. This is general information about a published guidance document, not export control advice.
- The guidelines are guidance for US registrants. What a UK site must do is set by its TAA or MLA and their provisos, and who counts as a foreign person for that authorisation is your export control officer’s call.
- The kiosk records no nationality, no areas or room numbers, no purpose and no summary. Of the six items the guidelines list, it carries three, and this page says which.
- It does not screen anyone against restricted party lists, verify anyone’s status or control doors. It records who came in, who they came to see, what they accepted and when they left.
- The guidelines state no retention period for a TCP visitor record. The kiosk holds a record for at most two years; a longer period is the exported file’s job.
- If your partner has raised a specific finding, bring their wording to the call and we will tell you honestly whether this closes it.
Sources
Check any of this yourself
- DDTC, ITAR Compliance Program GuidelinesThe 63 page PDF DDTC serves from its compliance portal, file dated 2 December 2022. Element 3 section C, Element 6 and the checklist and audit questions are quoted from it. Read 26 September 2026.
- DDTC, ITAR ComplianceThe compliance page on the DDTC portal where the guidelines are published, and the place to check for a revision.
General information about a published guidance document, not export control advice. The ITAR itself is not quoted here; read it, and your authorisation, with your export control officer.
Also asked of sites like yours
The other things somebody may ask you to evidence
Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.
Every standard on one page: the clause numbers, the version and the date each was read, on one printable table.
- GDPR and the visitor book
- CMMC physical security
- List X visitor control
- Def Stan 05-138 visitor access
- ISO 27001 visitor access
- PCI DSS visitor log
- AEO visitor access control
- CTPAT visitor log
- TISAX visitor management
- TAPA FSR visitor log
- BRCGS visitor control
- BRCGS packaging visitor control
- BRCGS storage and distribution visitors
- BRCGS unannounced audit
- Visitor control non-conformity
- SALSA visitor control
- IFS Food visitor hygiene
- UFAS feed mill visitor control
- GMP visitors in production areas
- GDP wholesale visitor control
- Fire roll call
- Contractor management
- Construction work in occupied premises
- HSE inspection records
- ISO 45001 contractor control
- Visitor NDA sign in
- Visitor record retention
- What a visitor log must contain
- Standards calendar
- Sign in sheet template
- Visitor health questionnaire template
- Contractor induction template
- Permit to work template
- Hot work permit template
- Fire drill record template
Advise sites on this standard? Referral terms are on one page.
Next step
Bring your partner’s wording to the call
Fifteen minutes on the phone. Read us the question your partner’s compliance team asked about visitors, and we will tell you straight which items a kiosk record answers, which three it does not, and where those three live instead.
Book a 15 minute callNo site visit needed and nothing to install. If it is not a fit we will say so on the call.
Would rather email? [email protected]
Not the person who signs it off? Send them the one page business case