The US Market-Entry Playbook for Allied Defense Manufacturers

You have US defense revenue you cannot capture from abroad. A prime wants the part built here. A program carries a domestic-content threshold. The technical data cannot leave a US-person boundary. Whatever the trigger, the answer is the same shape: a real US operation, standing and running to a standard an assessor will accept.

That operation is four things, and they come up together. Most parents discover them in the wrong order, one at a time, each one arriving as a surprise that resets the schedule.

Ask the market who helps a foreign manufacturer build a compliant US operation and you get six answers. Every one of them is real, competent, and worth paying. Every one of them stops at the same place.

Most parents solve the missing step one of two ways. They hire a US-subsidiary general manager and hope, which asks one person to simultaneously learn ITAR, scope a CMMC assessment, hire a floor, and hit a prime's date. Or they split the problem between the law firm and the IT vendor and let the seams fall where they fall.

The seams are the whole problem. Your counsel scopes the ITAR boundary in a memo. Your IT vendor scopes the enclave around the systems it was shown. Nobody notices that the drawing also lives on a CNC controller, in the quality lab, and on the laptop your test engineer takes to the customer site, because no one in the room has ever owned a floor. The assessment finds it, or worse, it does not, and the next audit does.

One planning note belongs to that second tier and gets missed. A greenfield build, a new US facility you stand up yourself, currently sits outside CFIUS jurisdiction, which reviews acquisitions of existing US businesses and certain real estate. Buying an existing US shop puts CFIUS in play. That is a live input to your build-versus-buy decision, and it is not permanent: the 2025 America First Investment Policy memo signaled that greenfield authority may expand. Your counsel tracks it. I raise it because parents make the build-versus-buy call on cost and schedule, and then meet the review.

I am the operating layer. Everything below is what that layer actually does, in the order it has to happen.

Three classes of defense work exist. Each is a different build, a different cost, and a different calendar. A quote that does not name your class is a guess wearing a number.

The trap is reading your class off your product catalog. It does not work that way. Controlled technical data, not the visible part, is what pulls you into Class B. A high-reliability pressure sensor is a commercial component right up until its design data is specified into a DoD platform, and then it is not, and nothing about the sensor changed.

DFARS 252.204-7012 defines controlled technical information as technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Read that list of verbs again, slowly. Access. Use. Reproduction. Modification. Display. Every one of them is something your engineers do a hundred times a day, on the floor, in the ERP, on the test bench, at 200 percent zoom on a shop-floor monitor.

This is why the compliance boundary cannot be drawn by someone who has only seen your org chart. It has to be drawn by someone who knows where the drawing actually goes once a machinist opens it.

Canada, the United Kingdom, Germany, Italy, France, Japan, Australia, Spain, and Switzerland are all DFARS qualifying countries. So are Belgium, Denmark, Finland, the Netherlands, Norway, Poland, Sweden, and a dozen others. The list lives at DFARS 225.003, and it is the receipt behind the word allied.

The status does one thing. Under a reciprocal defense-procurement memorandum of understanding with the Department of Defense, qualifying-country end products and components receive a procurement preference against Buy American restrictions. That is real, it is valuable, and it is the reason your country is on my list at all.

What it does not do is the part that decides your build. Qualifying-country status does not waive ITAR. It does not waive CMMC. It does not clear FOCI. It does not move one byte of controlled technical data across the Atlantic or across the 49th parallel. Those regimes apply to a German-owned US operation exactly as they apply to a family-owned shop in Nashua.

I put this early because everything downstream depends on it. A parent that reads qualifying country and hears reduced compliance burden budgets for the wrong build, staffs for the wrong build, and finds out when the prime's flowdown arrives with a date attached.

Country-specific nuance sits on top of this, and it is real. AUKUS Pillar 2 is lowering export-control friction between the UK, the US, and Australia while significant carve-outs remain. Canada sits closest of any ally, and the regulation says so in its own words: for production planning purposes, Canada is part of the defense industrial base (DFARS 225.870-1). The same section routes contracting with Canadian contractors through the Canadian Commercial Corporation, which awards and administers those contracts subject to four named exceptions. France sits outside AUKUS and runs the standard regime. Each of those changes what crosses a border. None of them changes what you build once you are here.

Everything above is procurement. This section is criminal law, and it is where a foreign-parented operation actually gets hurt.

Start with the good news, because most parents have this backwards. Under ITAR, a US person includes any corporation, business association, partnership, society, trust, or any other entity, organization, or group that is incorporated to do business in the United States. Your US subsidiary, once incorporated to do business here, is a US person. Foreign ownership does not change that. The entity is not the problem.

The people are. ITAR defines an export to include releasing or otherwise transferring technical data to a foreign person in the United States, and names that a deemed export. It goes further. Any release in the United States of technical data to a foreign person is deemed to be an export to all countries in which the foreign person has held or holds citizenship or holds permanent residency.

Now read that against your actual org chart. Your US entity is a US person. The German engineer it employs in Massachusetts is not. Handing that engineer a controlled drawing is an export to Germany, performed in a conference room off Route 495, with no package, no border, and no customs form. Your parent's CTO reviewing a design over video from Brescia is an export to Italy. Your group ERP, replicating that drawing to a server in Frankfurt on the nightly sync, is an export every night at 2 a.m., automatically, whether or not a human ever opens the file.

That is why the US-person data boundary is a build and not a policy. A policy says the parent should not access controlled data. A boundary makes the access technically impossible except through an authorized path, and produces the evidence that it was. Identity and access management, network segmentation, ERP and PLM scoping, MES and test-equipment isolation, and a documented release process that puts a named human decision in front of every transfer out of the boundary.

The Canadian exemption at 22 CFR 126.5 produces the sharpest version of this misconception, and it earns a paragraph. It authorizes license-free export of certain unclassified USML items from the US to a Canadian-registered person. It carries real limits, including items excluded by Supplement No. 1 to Part 126 and prior DDTC approval for reexport or retransfer. It is a US-to-Canada export authorization. It is not a general license for a Canadian parent to reach into its US subsidiary's controlled technical data. Reading it that way is how a Canadian-parented operation ends up drafting a voluntary self-disclosure.

Transfers to the parent happen under DDTC authorization or not at all. That is not a policy position I am asking you to adopt. It is the design constraint the entire IT and OT architecture gets built around, and it is the first thing I set, because every later decision inherits it.

One line in the ITAR catches foreign-parented manufacturers who did not think the ITAR applied to them yet.

22 CFR 122.1 requires any person who engages in the United States in the business of manufacturing or exporting or temporarily importing defense articles, or furnishing defense services, to register with the Directorate of Defense Trade Controls. Then it adds the sentence people skip: a manufacturer who does not engage in exporting must nevertheless register.

You do not have to export anything. You do not have to ship a part, transfer a drawing, or intend to. If your US operation manufactures a defense article, you register. The regulation is explicit that engaging in that business requires only one occasion of manufacturing.

And registration is not authorization. The rule says so in its own words: registration does not confer any export rights or privileges. It is primarily a means to provide the US Government with necessary information on who is involved in certain manufacturing and exporting activities, and it is generally a precondition to the issuance of any license or other approval. Parents routinely read a completed registration as a green light. It is a prerequisite to asking for one.

The rule carries narrow exemptions, including one for persons who engage in the fabrication of articles solely for experimental or scientific purposes, which is where a prototype-stage operation sometimes sits for a while. It is narrow, it stops applying the moment you are building for a program, and your export-control counsel makes that call, not me.

Your counsel files the registration. I make sure the operation the filing describes is the operation you are actually running, because a registration that describes a fiction is worse than no registration at all.

CMMC stopped being a policy conversation and became a clause. DFARS 252.204-7021 requires a contractor to have and maintain, for the duration of the contract, a current CMMC status at the level the contracting officer specifies, for all information systems used in performance that process, store, or transmit federal contract information or CUI. It requires an annual affirmation of continuous compliance by a named affirming official in SPRS. And it requires you, before awarding a subcontract, to confirm your own subcontractor's status. No status, no award. No affirmation, no continuation.

The phase-in is defined in the CMMC program rule at 32 CFR 170.3, and it runs in four one-year steps. Phase 1 begins on the effective date of the complementary 48 CFR CMMC acquisition final rule. That rule, DFARS Case 2019-D041, was published on September 10, 2025 and took effect on November 10, 2025. Phase 2 begins one calendar year following the start date of Phase 1, and Phase 2 was the step that would have made a CMMC Status of Level 2 with a certified third-party assessment a condition of contract award.

Then the program moved, and the regulation did not. On July 13, 2026, the Department suspended the Phase II requirements originally scheduled for November 10, 2026, established a CMMC reform task force, and left implementation paused in Phase 1. No replacement date has been named. As of July 2026, CMMC Level 2 is reached by a self-assessment every three years against the 110 security requirements in NIST SP 800-171 Revision 2, with an annual affirmation into SPRS, and the Department has said it will enforce through self-assessments and select government-led assessments during the review. The Phase I requirements remain, in the Department's own words, firmly in place. Read the rule and you get a schedule. Read the program and you get the truth, and this document is written for people who have to act on the second one.

Now read the suspension for the part the headline skipped, because that is the part that decides your build. The Department stated in terms that this action does not eliminate the requirement for companies to protect information in accordance with DFARS clause 252.204-7012. The certificate was suspended. The obligation was not. The clause is still in your contract, the 110 requirements are still the standard, and your prime still cannot award you covered work unless your assessment is current, which is the gate DFARS 252.204-7020(g)(2) puts in front of the buyer deciding who it trusts with controlled technical data.

That is a harder deadline than November was, not a softer one. A date invites a parent to schedule the work for October. What replaced it does not wait: the clause binds today, and the assessment is now your own organization's statement to the government rather than an assessor's finding. Your government-contracts counsel owns that statement's legal exposure. I own whether the floor actually runs the controls you affirm. And note where the reform is aimed, because it is not where the compliance vendors are pointing: lowering barriers for small, medium, and non-traditional businesses, and replacing bureaucratic compliance with scalable, resilient cybersecurity measures. A review pointed at real cybersecurity instead of administrative overhead does not rescue an operation that bought a binder. It rewards the one that built the floor.

Level 2 is not a bespoke DoD invention. 32 CFR 170.14 states it plainly: the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2. If your parent runs a mature ISO 27001 program, that discipline helps. It does not map one to one, because 800-171 scopes to wherever CUI actually lives, and in a manufacturing operation CUI lives on the floor.

Then there is the clause that decides whether your parent's IT department stays in the picture at all. DFARS 252.204-7012 requires that if you use an external cloud service provider to store, process, or transmit covered defense information, that provider must meet security requirements equivalent to those established by the Government for the FedRAMP Moderate baseline, and must comply with the clause's incident reporting, media preservation, and forensic access obligations. Your group's European tenant. Your parent's shared ERP instance. The PLM your engineering organization runs globally, the one your CTO will absolutely assume the US site will just connect to. Each of those is in scope the moment it touches covered defense information, and most of them do not clear that bar.

The same clause defines a covered contractor information system as an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits covered defense information. That definition does not say office IT. If the drawing is on the CNC controller, the controller is in scope. This is the entire argument for converging IT and OT before the assessment instead of after it, and it is why an enclave sold as a compliance solution can leave your floor sitting outside the boundary it was bought to protect.

And the clause has a stopwatch in it. Rapidly report means within 72 hours of discovery of any cyber incident, filed with DoD through the DIBNet portal, which requires a DoD-approved medium assurance certificate you have to obtain before you need it rather than during. A parent whose incident response routes through a European SOC, a group legal review, and a time zone will not make 72 hours on the day it counts.

Foreign Ownership, Control, or Influence is the regime that decides whether a foreign-owned US entity can hold a facility clearance. It is administered by the Defense Counterintelligence and Security Agency. DCSA is the referee. It is not a vendor, and no operator negotiates with it.

First the scoping question, because it saves this audience real money. A facility clearance and FOCI mitigation attach to classified work, which is Class C. If your US operation is doing Class B work, controlled technical data and CUI without classified information, you are very likely outside the facility-clearance path entirely. Confirm that with counsel rather than assuming in either direction: parents both over-budget for clearance programs they will never need, and get surprised when a specific customer or program raises foreign-ownership questions on unclassified work.

Where it does apply, the thing to understand is that FOCI mitigation is not a document you sign and file. The instruments DCSA uses, board resolutions, security control agreements, special security agreements, proxy arrangements, reach directly into how your company is governed. Who sits on the board. Which of your own executives may be briefed on what. Which reports flow to the parent and which stop at the US border. Who at the parent may direct the US entity's operations, and who may not.

Your counsel drafts that instrument. I live in its consequences. A special security agreement that walls the parent off from the subsidiary's technical operations is a legal document on Tuesday and an operating model on Wednesday: a reporting line that has to actually exist, a data flow that has to actually stop, an executive who genuinely cannot see a number they have reviewed every month for a decade. Building an operation that satisfies the instrument and still ships product is the work, and it is not legal work.

The published guidance here is thin and written for lawyers. DCSA documents the regime. The Center for Development of Security Excellence publishes a student guide. The DoD CIO's Standards Guide for Foreign Partners is a controls overlay. Not one of them tells you what to do with your org chart on Monday morning.

The build runs in parallel, not in sequence, because a prime gate does not wait for you to finish one phase before starting the next. The operating model, the IT and OT environment, and the compliance posture come up together.

What makes a quarter realistic is doing the four builds concurrently instead of serially, and knowing the dependencies well enough to start the right thing on day one.

The serial version is the one I get called into. Form the entity. Then pick the site. Then hire a general manager. Then discover the ITAR scope. Then call an IT vendor. Then find out the enclave does not cover the shop floor. Then rescope the assessment, which moves the prime gate, which moves the hiring plan. That version does not have a duration. It keeps discovering its own requirements, and every discovery resets something upstream.

The parallel version front-loads the two decisions everything else inherits: your work class, and where the data boundary falls. Get those right in the first thirty days and the rest is execution against a known shape. Get them wrong and no amount of speed later recovers it.

The sequence is the deliverable. Not the checklist, not the enclave, not the report. The order.

New England is the landing zone. Not because I am here, though I am, in Brookline, New Hampshire. Because the primes, the sub-tier supply base, and the compliance depth are already here, and a supplier standing up within driving distance of the line it feeds is worth something that does not show up in a site-selection spreadsheet.

The pattern is proven at both ends of the scale. In April 2026, American Rheinmetall, the US subsidiary of the German group, achieved CMMC Level 2 certification across its US production facilities. That is the large-cap version of this exact build, and it is a public, dated fact you can check yourself before you call me.

At the other end, GEFRAN, an Italian sensor and automation multinational, manufactures in North Andover, Massachusetts, less than an hour from my base. GEFRAN is not a defense supplier, and that is precisely the point: this corridor already holds European precision manufacturers running real US plants. The defense build is a posture added to a pattern that is already here and already working.

I ran GEFRAN's North America operations. I have been the foreign parent's operator in the United States, standing on the exact ground an Italian or a German parent is walking onto. And I am doing it now, standing up US defense manufacturing operations for a Canadian-parent subsidiary. The sequence in this document is the engagement I am running, not a framework assembled for a brochure.

The case for the corridor specifically, the prime density, the supplier base, the labor pool, and the reasons a Brescia or an Ontario parent lands here rather than in a lower-cost state, is the subject of The New England Landing Zone. The architecture of the data boundary itself, the digital thread that has to satisfy an ITAR data border and a CMMC assessment at the same time, is the subject of One Thread, Two Flags. The country lanes, Canada's CCC channel, the AUKUS carve-outs, the Mittelstand path, are taken apart one at a time in the market-entry briefs.

I stand up and run the compliant US operation: the floor, the operating model, the IT and OT build, the US-person data boundary, and the readiness evidence for the gate you are racing. Entity formation, FOCI mitigation, and site selection stay with your corporate counsel, your export-control counsel, and a site-selection advisor. I coordinate with them and own the operating outcome.

That boundary is deliberate, and it is the reason the engagement works. You already have advisors for the legal instrument, and none of them is going to run your floor. A firm that claims all of it is claiming a legal practice it does not have, and this audience checks.

What I add is the layer the six tiers leave open. An engineer who has operated: a manufacturer's CEO who signed the front of a paycheck, a general manager of a foreign subsidiary's North America operations, an operator who sat in the AS9100 audit chair rather than reviewing it from a slide, and who ran an MRP cutover on a live floor without losing a shipment.

The engagements are the existing three. A 30-Day Operational Triage that produces a defensible written plan rather than a deck. A Fractional COO retainer that embeds the operating leadership through the build. A Strategic Consultancy scoped firm-fixed-price against one defined event. A market-entry build usually opens with the triage and continues as fractional leadership through the first ninety days, because that is when the decisions that cannot be undone get made.

A maximum of four concurrent engagements. Capacity is the constraint and the proof, because four is the real limit of doing this work at the depth it requires. Every engagement is held under NDA.