Defense and manufacturing
Visitor screening for defense, manufacturing and ITAR-adjacent sites.
Two questions come up for every visitor at a defense supplier or a dual-use manufacturer. Is this person, or their company, a restricted party? And may this person see what is on the other side of the door? List screening answers the first. Only citizenship, permanent residency and an export authorization answer the second. A visitor system should help with both and claim neither on its own.
Quick answer. Screen every visitor and their company against the OFAC SDN List and the Consolidated Screening List, which includes the BIS Entity List, Denied Persons List and the State Department's ITAR debarred list. Separately, capture each visitor's citizenship and permanent residency, because showing ITAR or EAR controlled technical data to a foreign person in the US is a deemed export even when that person clears every list. Then keep a visitor log that meets NIST SP 800-171 and, for cleared facilities, NISPOM.
Reviewed 2026-10-20 against eCFR text and Department of Defense guidance current on that date. Not legal advice; export authorization questions belong with your empowered official or counsel.
Question one: is the visitor a restricted party?
For defense and dual-use manufacturers, the export lists matter as much as OFAC's. The Consolidated Screening List combines them: on 20 October 2026 it held 3,419 Entity List entries, 1,596 Denied Persons List entries, 801 ITAR debarred entries, 222 Unverified List entries and 70 Military End User entries alongside 19,457 SDN entries. A screen against the SDN List alone checks none of the export lists.
Ownership is the blind spot. OFAC's 50 Percent Rule blocks companies owned 50% or more by blocked persons even when they are not listed. Commerce issued a similar rule for Entity List and Military End User affiliates, effective 29 September 2025, then suspended it for a year; the suspension is due to end on 9 November 2026 unless extended. Unlisted affiliates do not appear in any list file, so a known ownership link has to be escalated by a person.
Question two: may the visitor see it?
Under the ITAR, releasing technical data to a foreign person in the United States is an export to every country where that person holds or has held citizenship or holds permanent residency (22 CFR 120.50). A release includes "visual or other inspection by foreign persons of a defense article that reveals technical data" (22 CFR 120.56). A plant tour past an assembly line can be a release.
The EAR works the same way for controlled technology and source code (15 CFR 734.13 and 734.15), with one difference: the EAR treats the release as an export to the person's most recent country of citizenship or permanent residency, not all of them.
A US person under the ITAR includes US citizens, lawful permanent residents (green card holders) and certain protected individuals (22 CFR 120.62). So "US person" is not the same as "US citizen", and the question at the door needs to ask about permanent residency as well as citizenship.
The working control is a Technology Control Plan. BIS guidance on deemed export licenses treats a TCP as a required attachment, and NISPOM requires one for foreign nationals employed at, or visiting on a long-term basis, a cleared facility (32 CFR 117.19(e)(4)(v)). TCPs typically specify badging, escorts and segregated work areas.
Cleared facilities: NISPOM visitor rules
- Positive identification. For classified visits, the contractor must have procedures to ensure positive identification of visitors, appropriate clearance and need-to-know (32 CFR 117.16(a)).
- Foreign visitor records. Keep a record of foreign visitors for one year when the visit involves access to classified information (32 CFR 117.19(e)(4)(iii)).
- Authorization first. Foreign visitors may access classified information only as authorized by an export license, an approved visit request or another exemption (32 CFR 117.19(e)(4)).
Classified visit requests run through the systems your cognizant security agency designates. A commercial visitor system records the visit; it does not replace them.
CUI contractors: NIST SP 800-171 and CMMC
NIST SP 800-171 Revision 2, the version CMMC references, includes two visitor controls: 3.10.3, escort visitors and monitor visitor activity, and 3.10.4, maintain audit logs of physical access. Revision 3 folds both into control 03.10.07. CMMC Level 1 carries the same duties through FAR 52.204-21(b)(1)(ix).
On timing: CMMC Phase 1 began on 10 November 2025. The Department suspended the move to Phase 2 by memo on 13 July 2026, and Class Deviation 2026-O0025 limits assessments to self-assessment for now. The underlying NIST SP 800-171 obligations under DFARS 252.204-7012 continue, and a visitor log is the evidence for 3.10.4 whatever the assessment phase.
How the pieces fit at the door
| Need | Where it comes from | What BeckonDesk does | What stays with you |
|---|---|---|---|
| Restricted-party screening | OFAC strict liability; Entity List, Denied Persons and ITAR debarment restrictions | Screens each visitor's name and company at sign-in against the OFAC SDN List, the Consolidated Screening List, the UN Security Council list and your own watchlist, with the government lists refreshed nightly. Kiosk sign-ins at 80 or above are held for an admin; 88 or above are refused. | Reviewing holds against the visitor's ID and deciding |
| Citizenship and permanent residency | 22 CFR 120.50, 120.62; 15 CFR 734.13 | Sign-in questions you write, such as "Are you a US citizen or lawful permanent resident?", with a chosen answer that can refuse entry or send the visit for approval | Whether a license or exemption covers the person, and what they may see |
| Host approval | Your TCP and internal procedures | A visit held by a sign-in question goes to the host, who approves or denies it from a link in email, Microsoft Teams or Slack | Training hosts on what they are approving |
| Non-disclosure agreement | Your TCP and contracts | An NDA required by visitor type, signed at the kiosk and stored with the visit, with agreement versions kept | The agreement text |
| Identity check | NISPOM positive identification | At pre-registration, reads the barcode on a US driver's license or the machine-readable zone of a passport and checks name and expiry. It does not detect forged documents. | Inspecting the document in person |
| Escort | NIST SP 800-171 3.10.3 | Records the host for every visit and prints a visitor badge | The escort itself |
| Physical access log | NIST SP 800-171 3.10.4; NISPOM one-year foreign visitor records | Time in and time out for every visit, exportable as CSV, with retention set per workspace (365 days by default, or kept indefinitely) | Setting retention to at least what applies to you |
| Evacuation accountability | OSHA 29 CFR 1910.38(c)(4) | A live list of everyone signed in, for roll call from a phone | Running the muster |
What BeckonDesk is not
- It does not decide whether a foreign person may receive ITAR or EAR controlled technical data. That determination needs citizenship, residency and authorization facts that only your export compliance function can weigh.
- It is a commercial cloud service hosted in Microsoft Azure in the United States. It is not FedRAMP authorized and is not built to store classified information or controlled unclassified information.
- It does not process classified visit requests or visit authorization letters.
Frequently asked
Does sanctions screening satisfy ITAR deemed export requirements?
No. Sanctions and restricted-party screening checks whether a person or company appears on a government list. A deemed export under the ITAR or EAR depends on whether a foreign person receives controlled technical data or technology, which turns on their citizenship and permanent residency and on whether a license or exemption covers the release. A visitor can clear every list and still need an authorization.
Who counts as a US person under the ITAR?
Under 22 CFR 120.62, a US person includes US citizens, lawful permanent residents and certain protected individuals, as well as US-incorporated companies and US government entities. A green card holder is a US person for ITAR purposes even though they are not a citizen.
Does NIST SP 800-171 require a visitor log?
Revision 2, the version CMMC uses, requires organizations to escort visitors and monitor visitor activity (3.10.3) and to maintain audit logs of physical access (3.10.4). A visitor log with sign-in and sign-out times is the usual evidence for both. Revision 3 combines these into control 03.10.07.
How long must a cleared contractor keep foreign visitor records?
NISPOM requires a record of foreign visitors to be kept for one year when the visit involves access to classified information, under 32 CFR 117.19(e)(4)(iii). Other rules or contracts can require longer.
Related reading
- Visitor management systems with sanctions screening: what to ask
- OFAC visitor screening: how it works
- Visitor sanctions screening checklist: 36 items
- Visitor management for manufacturing
- Visitor management for regulated facilities
Sources
- 22 CFR 120.50, 120.56 and 120.62 (ITAR export, release, US person)
- 15 CFR 734.13 and 734.15 (EAR export and release); BIS deemed exports
- 32 CFR 117.16 and 117.19 (NISPOM visits and foreign visitors)
- NIST SP 800-171 Rev. 2 and Rev. 3; FAR 52.204-21
- DFARS CMMC rule, 90 FR 43560; DARS class deviations (2026-O0025)
- BIS one-year suspension of the affiliates rule
- Consolidated Screening List (entry counts from the CSV, 20 October 2026)
Screen, ask, record. At every gate.
Restricted-party screening, your own sign-in questions, NDAs and a visitor log your auditor can export. $79 per location per month, 30-day free trial.