Jason Taken is a business broker, not an empowered official. HedgeStone will not hide a registration to make the teaser prettier. Aerospace and defense is the hub. Government contracts is the novation page. Foreign buyers and CFIUS is the investment-review page.
What is the difference between ITAR, EAR, and CFIUS on a sale?
ITAR is DDTC registration and defense-article / defense-service control. EAR is Commerce Control List and deemed-export risk through people. CFIUS is a national-security review of certain foreign investments, with mandatory-filing tests that can include critical technology plus a U.S. regulatory authorization, and certain foreign-government interest facts. Counsel maps which clocks apply. A blog table is not a filing.
Mandatory CFIUS facts cited in the research file include a 30-day pre-completion posture on covered filings and the 49% / 25% foreign-government substantial-interest test. Confirm current Treasury rules. Do not treat those numbers as a waiver of § 122.4(b).
| Clock | Trigger (confirm on the deal) | What does not satisfy it |
|---|---|---|
| ITAR § 122.4(b) 60-day notice | Foreign person owns or controls a registrant | A CFIUS filing |
| Registration amendment | Any change in the registrant | Silence because the buyer is U.S. |
| CFIUS (if mandatory) | Covered transaction tests | DDTC notice alone |
| Novation (if federal primes) | Agency recognition | Private assignment |
| Commercial close | LOI and diligence | Any of the above automatically |
A specialist keeps the teaser from identifying “the only ITAR shop in the county.” Confidentiality is tighter because the registration itself is an identifier.
How should you screen buyers before the CIM?
Ask early whether any foreign person will have ownership or control, including funds with foreign LPs that raise control questions. That is a counsel questionnaire, not a vibe. IBBA Q1 2026’s 83% of >$5 million deals with three-plus offers (Source: IBBA) is still an argument for a process. It is not an argument to send the technical data package to every inbound.
Stanford’s search median — about $16 million, ~6.2x EBITDA, ~25% margin (Source: Stanford GSB) — describes a buyer class that is often domestic. Still ask the control question. SBA 7(a) remains $5 million with a 10% injection (Source: SBA). SBA eligibility does not replace export-control eligibility.
BizBuySell’s 223-day 2025 manufacturing median (Source: BizBuySell) can absorb a 60-day notice if you start the foreign-person screen in month one. Discovering a foreign GP in month seven of exclusivity is how files die.
What belongs in the restricted data-room folder?
Registration, DDTC correspondence, Technology Control Plan, visitor logs, training records, voluntary disclosures, and a list of defense articles you actually produce or broker. Technical data stays behind a wall. QoE still happens on the financials. It does not get the drawing package.
The working-capital peg is ordinary AR / inventory / AP unless contracts say otherwise. Do not store ITAR technical data in the same zip file as the peg spreadsheet.
Deemed exports: foreign employees, foreign visitors, and remote access. If the TCP is a binder nobody follows, buyers will price a rebuild of the program. That is operations, not folklore.
What does an illustrative foreign-person miss look like?
Illustrative only.
A registrant signs an LOI with a sponsor. Diligence week four: a foreign-person control fact appears. DDTC 60-day notice now sits on the critical path. CFIUS may also apply. The commercial exclusive was 45 days. The exclusive expires. The seller blames “regulation.” The seller skipped the questionnaire.
A second file: domestic strategic, registration amendment mapped, TCP updated, no foreign control. Diligence is still slow because the quality system and the programs are real. The CIM told the truth. Close tracks the commercial calendar plus amendment time.
What should the teaser say?
“ITAR-registered operations; foreign-person control would trigger statutory notice.” That is enough. Do not print the registrant code. Do not print program names. Do not print a unique cell photo.
Sell my manufacturing business is the pillar.
How should a seller brief the empowered official before the first teaser goes out?
Sit with the person who already signs the registration and the TCP. Ask which defense articles you actually make or broker, which technical data lives on which servers, and which foreign employees or visitors already create deemed-export facts. Write the answers in a memo counsel can use. Do not write them in a CIM paragraph that a forward can leak.
If the empowered official is you, and you are also the estimator, the file has a key-person problem and a compliance problem in the same body. Budget a deputy before you promise a short stay. A buyer cannot inherit a registration that only lives in your head.
If you have an open voluntary disclosure, say so to counsel before the teaser, not after the NDA. Disclosures are not automatically fatal. Surprise disclosures are how exclusives evaporate.
What buyer questions are diligence, and which are a fishing expedition for technical data?
Diligence: registration status, whether any foreign-person control is contemplated, whether a TCP exists, whether training is current, whether there are open disclosures, whether federal primes sit on the book, whether EAR items mix with ITAR items.
Fishing: requests for drawings, CNC programs, process travelers on defense articles, or customer program names in week one. Those belong behind a wall after qualification, and sometimes behind a clean-team. A party that wants the programs before they want the add-back binder is collecting intelligence.
Government contracts add novation on top of export control. Do not let the two calendars be staffed by different people who never speak. One counsel chart with both clocks is cheaper than two surprises.
What does a domestic-buyer close still have to finish?
Registration amendment. Address and ownership updates. A TCP that names the new empowered official. Visitor-log discipline that survives the first customer audit after close. Access rights on the file server. A decision about foreign employees who were fine under the old informal practice and are not fine under a buyer who actually reads the TCP.
None of that is a 60-day foreign-person notice. All of it is work. Sellers who told the floor “nothing changes because the buyer is American” create the next disclosure.
Illustrative only: a 28-person precision shop, domestic strategic, no foreign control, AS9100 plus ITAR. Amendment filed. TCP rewritten over three weeks. Close holds. The teaser never printed a program name. That is the boring win.
How should you handle foreign employees, visitors, and remote programmers during a process?
Freeze informal remote access that was never on the TCP. Log visitors. If a foreign contract programmer has vault access, that is a diligence fact whether or not you like the person. A sale is when sloppy access becomes a disclosure.
Do not invite a foreign-person buyer’s engineer to “just look at the five-axis” before counsel clears the visit. Plant tours are already a rumor risk. On an ITAR file they are also a control risk.
If you use a cloud CAM vault, ask who the admin is and where the data resides. Buyers will ask. Having the answer is cheaper than discovering a foreign admin in week six.
Illustrative only: domestic buyer, one foreign-national programmer on EAR-controlled work only, TCP updated, access recertified. Close holds. The file that let a foreign visitor photograph a defense article during a “friendly tour” becomes a disclosure and a delay.
What should a domestic strategic still receive in a restricted folder on day one after NDA?
Registration confirmation, TCP existence, disclosure status, and a yes/no on any contemplated foreign-person control. Not drawings. Not programs. Not customer program names. That package lets their counsel start the amendment calendar without giving them the shop.
If they refuse to staff export counsel, they are the wrong exclusive on this file.
What should you do with old laptops, thumb drives, and personal email that still hold technical data?
A sale is when informal archives become a compliance finding. Collect devices. Ask counsel whether a forensic hold is needed. Stop using personal email for drawings. If a retired estimator still has a USB of programs, retrieve it. Buyers’ export counsel will ask where data lives. “Around” is not an answer.
If you cannot map the data, budget a program rebuild in the CIM as friction, not as a surprise in week six.
Illustrative only: domestic buyer, clean registration, three unmanaged USBs. Process pauses for a data map. The file that mapped devices in month one did not pause.
What should you tell a domestic searcher who has never hired export counsel?
That they must. Stanford medians do not staff a TCP (Source: Stanford GSB). If they will not budget counsel, they are the wrong exclusive. Do not educate them with drawings.
A last export habit: keep a visitor log that matches reality for 90 days before the teaser. A TCP nobody follows is a finding. A log that starts the week of the first tour is a costume. Start now.
One more export note: if you brokered a defense article years ago and still have the email archive, tell counsel. Old brokering facts can still sit in a registration history. Surprise archives are worse than disclosed old work.
If a retired employee still has badge access to the drawing vault, cut it before the first NDA package goes out. Old badges are a diligence finding waiting to happen.
If a cloud vault admin sits offshore, map that fact before the first restricted folder goes out.
Educational information only. DDTC, EAR, and CFIUS are licensed and empowered-official work. No notice guarantees approval or a close date.