Navigating When to Purchase Commercial, FedRAMP Moderate, and FedRAMP High Platforms to Support ITAR ComplianceITAR violations carry criminal and civil penalties that can result in debarment from federal contracts. This guide maps ITAR compliance requirements to Zscaler’s three platform tiers: 1) Zscaler Commercial, 2) Zscaler FedRAMP Moderate, and 3) Zscaler FedRAMP High.Zscaler’s FedRAMP Moderate and High platforms support a customer’s ITAR compliance program, with ITAR reports publicly available at zscaler.com/compliance/overview. Organizations handling ITAR-regulated data should understand which platform tier aligns to their specific compliance posture and that, overall, controls remain a customer responsibility regardless of platform selection. Understanding ITAR RequirementsThe International Traffic in Arms Regulations (ITAR), administered by the U.S. Department of State’s Directorate of Defense Trade Controls (DDTC), governs the manufacture, export, and brokering of defense articles and related services listed on the United States Munitions List (USML). Before evaluating any cloud security platform, organizations must understand what ITAR demands at the operational level:DDTC Registration: Organizations that manufacture, export, or broker defense articles or defense services must register with the Directorate of Defense Trade Controls (22 CFR Part 122 and Part 129).Access Restricted to U.S. Persons: ITAR-controlled technical data may only be accessed by U.S. persons (citizens, lawful permanent residents, or certain protected individuals) and entities incorporated in the U.S. unless specific DDTC authorization has been granted (22 CFR § 120.62).Deemed Exports: Disclosing or transferring ITAR-controlled technical data to a foreign person, even within the United States, is treated as an export (a ‘deemed export’) and requires prior DDTC authorization. This is the primary regulatory basis for restricting access to U.S. persons (22 CFR § 120.50).Prohibition on Unauthorized Export: ITAR-controlled technical data may not be exported without prior authorization from the DDTC (22 CFR § 127.1).Release of Technical Data: Under ITAR, technical data is “released” through visual or other inspection of a defense article that reveals technical data to a foreign person, oral or written exchanges with foreign persons, or the use of access information (such as decryption keys or network credentials) that enables a foreign person to access unencrypted technical data. A release to a foreign person constitutes an export under 22 CFR § 120.50 and requires prior DDTC authorization. Organizations using cloud security platforms that inspect, process, or store unencrypted ITAR-controlled technical data must ensure that platform personnel who can access that data in unencrypted form are U.S. persons or that appropriate DDTC authorization is in place (22 CFR § 120.50, 120.55, 120.56).Audit and Continuous Monitoring: DDTC expects organizations to maintain records demonstrating compliance with access controls, data handling policies, and export authorizations. Zscaler’s Three Platform TiersZscaler operates three distinct platform environments, each with different compliance postures relevant to ITAR-regulated workloads. Choosing which tier to operate in is a customer responsibility based on their compliance risk tolerance.Zscaler Commercial Platform Zscaler’s commercial platform delivers the full Zero Trust Exchange capability set for enterprise customers worldwide. It is cloud-native, operates across a global network of 160+ Points of Presence (PoPs), and is designed to support the security requirements of commercial and multinational companies and organizations.Key Attributes for the Commercial Platform:Compliance: ISO 27001, SOC2 Type 2, CSA STAR Level 2 and other industry and regional compliance certifications, attestations and standards. Please visit Zscaler’s Customer Compliance Center for more information. Locations: US & International. U.S.-person operational support coverage: Support personnel access may include non-U.S. persons, and the platform is not restricted to the U.S.-based infrastructure.Data Types: Suitable for non-ITAR/non-CUI workloads.Zscaler Commercial Platform ITAR PostureOrganizations handling ITAR-regulated technical data should not route that data through commercial-tier nodes without applying additional compensating controls. Organizations that do not handle ITAR-regulated technical data can leverage the commercial platform’s full capability set without compliance exposure Zscaler FedRAMP Moderate PlatformZscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) on the FedRAMP Moderate authorized platform are designed for U.S. federal agencies and government contractors processing Controlled Unclassified Information (CUI) at the Moderate baseline. This platform is physically separated from commercial infrastructure and operated with U.S. persons in support roles.Key Attributes of FedRAMP Moderate:Compliance: FedRAMP Moderate, CJIS, IRS 1075 FTI RequirementsLocations: US & International International locations are not enabled by default and require an additional configuration and purchase. U.S.-person operational support coverage: Tier 1 and Tier 2 support personnel accessing government platform environments are subject to screening controls consistent with federal requirements. Technical support provided by personnel from Tier 3 and above may be provided by a mixed population of US- and non-US personnel and may include OCONUS access. Entities managing ITAR-regulated technical data must assess if this operational support coverage aligns with regulatory prohibitions on foreign person access within their unique risk profile.Data Types: Controlled Unclassified Information (CUI) Zscaler FedRAMP High PlatformZscaler’s FedRAMP High authorized platform represents the most rigorous compliance posture available within the Zero Trust Exchange. It is designed to protect the government’s most sensitive unclassified data and is the recommended environment for organizations with ITAR-regulated technical data, or contractual requirements that demand the highest cloud security baseline.Key attributes of the FedRAMP High platform:Compliance: FedRAMP High, CJIS, IRS 1075 FTI RequirementsLocations: CONUS-only U.S.-Screened Personnel: All access to systems processing customer data on this platform is restricted to screened U.S. persons, consistent with ITAR’s foreign person access prohibition.Data Types: Controlled Unclassified Information (CUI)Zscaler FedRAMP High ITAR PostureZscaler’s FedRAMP High platform is designed to align with organizations with ITAR-regulated technical data. It is the only Zscaler platform tier for which complete US-person coverage is available. Hundreds of federal agencies and DIB customers currently use Zscaler’s FedRAMP authorized platforms to secure their missions. Platform Compliance ComparisonCompliance & CapabilitiesCommercialCloudFedRAMPModerateFedRAMPHighFedRAMP Authorization LevelN/AModerateHighFedRAMP 20x Classification ClassN/AClass CClass DITAR Compliance Report AvailableX✓✓Complete US-person CoverageX/✓U.S.-Person Access Controls (Support Staff)/✓✓U.S. Data SovereigntyX/✓Recommended for ITAR-regulated technical dataXX✓✓ = Supported / Customer Responsibility X = Not Available / No Commitment / = Partial / Risk Acceptance Required Zscaler Capabilities That Can Support ITAR ComplianceThe following capabilities are available across FedRAMP Moderate and High platforms with customer-driven ITAR-relevant configurations.Zero Trust Network Access (ZPA)Unlike legacy VPN architectures, Zscaler Private Access does not expose network topology to users or attackers. ZPA verifies every user and device before access is granted, enforcing least-privilege access to applications, not networks. This eliminates the risk of lateral movement to ITAR-regulated systems and prevents foreign-person attribution through network traffic analysis. ZPA’s application-level access model means ITAR technical data remains siloed within authorized application boundaries.Secure Web Gateway (ZIA) with 100% SSL/TLS InspectionZscaler Internet Access performs complete SSL/TLS inspection, including encrypted traffic, without performance degradation. This is operationally critical for ITAR compliance: without full inspection, encrypted exfiltration channels remain a blind spot. ZIA’s AI/ML-driven threat detection analyzes over 119 trillion annual transactions to identify and block emerging threats, including those targeting defense-sector organizations. Data Loss Prevention (DLP)Zscaler’s DLP capability performs AI-driven content inspection to detect and classify ITAR-regulated technical data, including CAD files, engineering specifications, and defense-related documentation. Inspecting encrypted traffic at scale ensures no blind spots exist for data exfiltration through SSL channels. DLP policies can be configured to block, warn, or log transfers of ITAR-sensitive content, and telemetry feeds directly into audit records required for DDTC compliance demonstration.Cloud Access Security Broker (CASB)Zscaler CASB provides visibility and control over cloud application usage, enabling organizations to detect when ITAR-regulated data is being uploaded to unauthorized cloud services. On FedRAMP Moderate and High platforms, CASB applies ITAR-aware policies, generating the audit record necessary to demonstrate that ITAR technical data is not being transmitted to unauthorized cloud environments or accessed by foreign-person-operated services.Advanced Threat ProtectionNation-state actors routinely target defense contractors handling ITAR-regulated technical data. ZIA blocks an average of 1,700 threats daily and 4.5 billion threats monthly using behavioral analysis and threat intelligence from Zscaler’s global sensor network. For DIB organizations, this threat protection layer is the first line of defense against the APT campaigns most likely to pursue ITAR-covered defense technology.FIPS-Validated EncryptionZscaler supports FIPS-validated encryption across all platform tiers. FIPS-validated end-to-end encryption is a primary mechanism to reduce residual risk. However, FIPS-validated encryption should not be used as a substitute for the contractual commitments available on FedRAMP Moderate and High platforms. While properly encrypted data in transit may fall outside the export definition, the carve-out does not eliminate the need for U.S.-person access controls on decryption keys and the underlying data. (22 CFR § 120.54(a)(5))ITAR “Release” Considerations for Cloud Security FeaturesSeveral Zscaler capabilities involve inspecting, analyzing, or processing customer traffic in unencrypted form. When that traffic contains ITAR-controlled technical data, these activities may constitute a “release” of technical data under 22 CFR § 120.56 if platform personnel who are foreign persons can access the unencrypted content. On Zscaler’s FedRAMP Moderate and High platforms, support personnel with access to customer environments are screened U.S. persons, which mitigates this risk. On the commercial platform, support personnel may include foreign persons, and Zscaler does not contractually restrict access on a nationality basis. Customers routing ITAR-controlled technical data through any Zscaler platform are responsible for evaluating whether the platform’s access controls are sufficient to prevent an unauthorized release under their specific compliance posture. ITAR Requirement MappingTo support customers in leveraging Zscaler to implement ZTNA to meet ITAR requirements, Zscaler provides the following table mapping Zscaler capabilities to some of ITAR’s requirements. This mapping applies to FedRAMP Moderate and High platform deployments.ITAR RequirementZscaler Platform CoverageCustomer ResponsibilityAccess Restricted to U.S. Persons (22 CFR § 120.62)ZIA and ZPA verify identity and device posture before granting application access.FedRAMP Gov platform support staff restricted to screened U.S. persons.ZPA enforces least-privilege access policies.Customers must screen internal users for U.S. person status. Customers must configure ZPA policies to enforce ITAR data access restrictions.Prohibition on Unauthorized Export (22 CFR § 127.1)CASB detects and blocks uploads of ITAR data to unauthorized cloud services.DLP identifies and prevents transmission of ITAR-regulated content.ZIA enforces outbound traffic policies.Customers must define DLP policies aligned to their ITAR technical data categories. Customers must obtain and document any required DDTC export authorizations.Data Residency and Transmission ControlsFedRAMP High platform restricts data processing to CONUS infrastructure.FIPS-validated encryption for in-transit data protection.Customers must select FedRAMP Moderate or High platform (not commercial) for ITAR workloads. Customers must document data flows and residency requirements.Audit and Continuous Monitoring (DDTC recordkeeping)ZIA and ZPA generate detailed session logs for audit review.DLP telemetry provides evidence of policy enforcement.CASB reports document cloud application governance posture.Customers must retain logs in accordance with DDTC record retention requirements. Customers must establish continuous monitoring processes aligned to their ITAR compliance program.DDTC Registration and Contractual CommitmentsZscaler provides contractual ITAR commitments on FedRAMP Moderate and High platforms.ITAR compliance reports available at zscaler.com/compliance/overview.Customers must register with DDTC independently. Customers must execute appropriate contractual agreements with Zscaler via the FedRAMP Gov platforms. Choosing the Right Zscaler PlatformThe decision framework for platform selection is straightforward: the nature of the data and the contractual requirements of the organization determine the appropriate platform tier.Select Zscaler FedRAMP High If:Your organization handles ITAR-regulated technical data in the course of normal operations.Your organization handles CUI in the course of normal operations.Your prime contract or government agreement requires a cloud platform with US-person contractual requirements.You need the Zscaler platform that provides the strongest available audit evidence for DDTC compliance demonstration.Select Zscaler FedRAMP Moderate If:Your organization handles ITAR-regulated technical data in the course of normal operations.Your organization handles CUI in the course of normal operations.You are pursuing CMMC Level 2 compliance.You need FedRAMP authorization for civilian agencies or lower-sensitivity government workloads.You are migrating from commercial toward higher compliance posture.Admin Note: Depending on the supported product, technical support provided by personnel from Tier 3 and above may be provided by a mixed population of US- and non-US personnel and may include OCONUS access.Select Zscaler Commercial Platform If:Your organization does not handle ITAR-regulated technical data or CUI at the Moderate or High baseline.You are a commercial enterprise without federal contracting requirements that trigger FedRAMP or ITAR requirements.You require the full commercial capability set, including integrations with the global Azure commercial or AWS commercial ecosystems, and your workloads are not ITAR-restricted. ConclusionITAR compliance in a cloud security context is not a checkbox. It is a continuous operational discipline that begins with selecting the right platform and extends through policy configuration, access governance, audit, and documented risk management.Zscaler’s Zero Trust Exchange provides the security architecture and platform tiers necessary to support compliance at every level of the Defense Industrial Base:Zscaler FedRAMP High platform: The highest available unclassified security posture, with contractual ITAR commitments, and FedRAMP authorization. It provides the strongest available controls for organizations processing ITAR-regulated technical data.Zscaler FedRAMP Moderate platform: U.S. government-grade security with ITAR compliance reports for DIB and civilian agency workloads.Zscaler Commercial platform: Full Zero Trust Exchange capabilities for non-ITAR enterprise workloads.Choosing the right platform, and configuring it correctly, is a risk decision that belongs to the customer. Zscaler’s Federal and Defense segment is positioned to support that decision through platform guidance, compliance documentation, and field advisory engagement with CISOs, CIOs, and compliance officers across the Defense Industrial Base.This guide is for informational purposes only and does not constitute legal or export-control advice. Information is current as of August 19, 2026 and subject to change. Zscaler makes no representations or warranties regarding the applicability of this guide to any organization’s specific compliance requirements. Consult qualified export-control counsel before making platform or compliance decisions based on this guide.
[#item_full_content] Navigating When to Purchase Commercial, FedRAMP Moderate, and FedRAMP High Platforms to Support ITAR ComplianceITAR violations carry criminal and civil penalties that can result in debarment from federal contracts. This guide maps ITAR compliance requirements to Zscaler’s three platform tiers: 1) Zscaler Commercial, 2) Zscaler FedRAMP Moderate, and 3) Zscaler FedRAMP High.Zscaler’s FedRAMP Moderate and High platforms support a customer’s ITAR compliance program, with ITAR reports publicly available at zscaler.com/compliance/overview. Organizations handling ITAR-regulated data should understand which platform tier aligns to their specific compliance posture and that, overall, controls remain a customer responsibility regardless of platform selection. Understanding ITAR RequirementsThe International Traffic in Arms Regulations (ITAR), administered by the U.S. Department of State’s Directorate of Defense Trade Controls (DDTC), governs the manufacture, export, and brokering of defense articles and related services listed on the United States Munitions List (USML). Before evaluating any cloud security platform, organizations must understand what ITAR demands at the operational level:DDTC Registration: Organizations that manufacture, export, or broker defense articles or defense services must register with the Directorate of Defense Trade Controls (22 CFR Part 122 and Part 129).Access Restricted to U.S. Persons: ITAR-controlled technical data may only be accessed by U.S. persons (citizens, lawful permanent residents, or certain protected individuals) and entities incorporated in the U.S. unless specific DDTC authorization has been granted (22 CFR § 120.62).Deemed Exports: Disclosing or transferring ITAR-controlled technical data to a foreign person, even within the United States, is treated as an export (a ‘deemed export’) and requires prior DDTC authorization. This is the primary regulatory basis for restricting access to U.S. persons (22 CFR § 120.50).Prohibition on Unauthorized Export: ITAR-controlled technical data may not be exported without prior authorization from the DDTC (22 CFR § 127.1).Release of Technical Data: Under ITAR, technical data is “released” through visual or other inspection of a defense article that reveals technical data to a foreign person, oral or written exchanges with foreign persons, or the use of access information (such as decryption keys or network credentials) that enables a foreign person to access unencrypted technical data. A release to a foreign person constitutes an export under 22 CFR § 120.50 and requires prior DDTC authorization. Organizations using cloud security platforms that inspect, process, or store unencrypted ITAR-controlled technical data must ensure that platform personnel who can access that data in unencrypted form are U.S. persons or that appropriate DDTC authorization is in place (22 CFR § 120.50, 120.55, 120.56).Audit and Continuous Monitoring: DDTC expects organizations to maintain records demonstrating compliance with access controls, data handling policies, and export authorizations. Zscaler’s Three Platform TiersZscaler operates three distinct platform environments, each with different compliance postures relevant to ITAR-regulated workloads. Choosing which tier to operate in is a customer responsibility based on their compliance risk tolerance.Zscaler Commercial Platform Zscaler’s commercial platform delivers the full Zero Trust Exchange capability set for enterprise customers worldwide. It is cloud-native, operates across a global network of 160+ Points of Presence (PoPs), and is designed to support the security requirements of commercial and multinational companies and organizations.Key Attributes for the Commercial Platform:Compliance: ISO 27001, SOC2 Type 2, CSA STAR Level 2 and other industry and regional compliance certifications, attestations and standards. Please visit Zscaler’s Customer Compliance Center for more information. Locations: US & International. U.S.-person operational support coverage: Support personnel access may include non-U.S. persons, and the platform is not restricted to the U.S.-based infrastructure.Data Types: Suitable for non-ITAR/non-CUI workloads.Zscaler Commercial Platform ITAR PostureOrganizations handling ITAR-regulated technical data should not route that data through commercial-tier nodes without applying additional compensating controls. Organizations that do not handle ITAR-regulated technical data can leverage the commercial platform’s full capability set without compliance exposure Zscaler FedRAMP Moderate PlatformZscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) on the FedRAMP Moderate authorized platform are designed for U.S. federal agencies and government contractors processing Controlled Unclassified Information (CUI) at the Moderate baseline. This platform is physically separated from commercial infrastructure and operated with U.S. persons in support roles.Key Attributes of FedRAMP Moderate:Compliance: FedRAMP Moderate, CJIS, IRS 1075 FTI RequirementsLocations: US & International International locations are not enabled by default and require an additional configuration and purchase. U.S.-person operational support coverage: Tier 1 and Tier 2 support personnel accessing government platform environments are subject to screening controls consistent with federal requirements. Technical support provided by personnel from Tier 3 and above may be provided by a mixed population of US- and non-US personnel and may include OCONUS access. Entities managing ITAR-regulated technical data must assess if this operational support coverage aligns with regulatory prohibitions on foreign person access within their unique risk profile.Data Types: Controlled Unclassified Information (CUI) Zscaler FedRAMP High PlatformZscaler’s FedRAMP High authorized platform represents the most rigorous compliance posture available within the Zero Trust Exchange. It is designed to protect the government’s most sensitive unclassified data and is the recommended environment for organizations with ITAR-regulated technical data, or contractual requirements that demand the highest cloud security baseline.Key attributes of the FedRAMP High platform:Compliance: FedRAMP High, CJIS, IRS 1075 FTI RequirementsLocations: CONUS-only U.S.-Screened Personnel: All access to systems processing customer data on this platform is restricted to screened U.S. persons, consistent with ITAR’s foreign person access prohibition.Data Types: Controlled Unclassified Information (CUI)Zscaler FedRAMP High ITAR PostureZscaler’s FedRAMP High platform is designed to align with organizations with ITAR-regulated technical data. It is the only Zscaler platform tier for which complete US-person coverage is available. Hundreds of federal agencies and DIB customers currently use Zscaler’s FedRAMP authorized platforms to secure their missions. Platform Compliance ComparisonCompliance & CapabilitiesCommercialCloudFedRAMPModerateFedRAMPHighFedRAMP Authorization LevelN/AModerateHighFedRAMP 20x Classification ClassN/AClass CClass DITAR Compliance Report AvailableX✓✓Complete US-person CoverageX/✓U.S.-Person Access Controls (Support Staff)/✓✓U.S. Data SovereigntyX/✓Recommended for ITAR-regulated technical dataXX✓✓ = Supported / Customer Responsibility X = Not Available / No Commitment / = Partial / Risk Acceptance Required Zscaler Capabilities That Can Support ITAR ComplianceThe following capabilities are available across FedRAMP Moderate and High platforms with customer-driven ITAR-relevant configurations.Zero Trust Network Access (ZPA)Unlike legacy VPN architectures, Zscaler Private Access does not expose network topology to users or attackers. ZPA verifies every user and device before access is granted, enforcing least-privilege access to applications, not networks. This eliminates the risk of lateral movement to ITAR-regulated systems and prevents foreign-person attribution through network traffic analysis. ZPA’s application-level access model means ITAR technical data remains siloed within authorized application boundaries.Secure Web Gateway (ZIA) with 100% SSL/TLS InspectionZscaler Internet Access performs complete SSL/TLS inspection, including encrypted traffic, without performance degradation. This is operationally critical for ITAR compliance: without full inspection, encrypted exfiltration channels remain a blind spot. ZIA’s AI/ML-driven threat detection analyzes over 119 trillion annual transactions to identify and block emerging threats, including those targeting defense-sector organizations. Data Loss Prevention (DLP)Zscaler’s DLP capability performs AI-driven content inspection to detect and classify ITAR-regulated technical data, including CAD files, engineering specifications, and defense-related documentation. Inspecting encrypted traffic at scale ensures no blind spots exist for data exfiltration through SSL channels. DLP policies can be configured to block, warn, or log transfers of ITAR-sensitive content, and telemetry feeds directly into audit records required for DDTC compliance demonstration.Cloud Access Security Broker (CASB)Zscaler CASB provides visibility and control over cloud application usage, enabling organizations to detect when ITAR-regulated data is being uploaded to unauthorized cloud services. On FedRAMP Moderate and High platforms, CASB applies ITAR-aware policies, generating the audit record necessary to demonstrate that ITAR technical data is not being transmitted to unauthorized cloud environments or accessed by foreign-person-operated services.Advanced Threat ProtectionNation-state actors routinely target defense contractors handling ITAR-regulated technical data. ZIA blocks an average of 1,700 threats daily and 4.5 billion threats monthly using behavioral analysis and threat intelligence from Zscaler’s global sensor network. For DIB organizations, this threat protection layer is the first line of defense against the APT campaigns most likely to pursue ITAR-covered defense technology.FIPS-Validated EncryptionZscaler supports FIPS-validated encryption across all platform tiers. FIPS-validated end-to-end encryption is a primary mechanism to reduce residual risk. However, FIPS-validated encryption should not be used as a substitute for the contractual commitments available on FedRAMP Moderate and High platforms. While properly encrypted data in transit may fall outside the export definition, the carve-out does not eliminate the need for U.S.-person access controls on decryption keys and the underlying data. (22 CFR § 120.54(a)(5))ITAR “Release” Considerations for Cloud Security FeaturesSeveral Zscaler capabilities involve inspecting, analyzing, or processing customer traffic in unencrypted form. When that traffic contains ITAR-controlled technical data, these activities may constitute a “release” of technical data under 22 CFR § 120.56 if platform personnel who are foreign persons can access the unencrypted content. On Zscaler’s FedRAMP Moderate and High platforms, support personnel with access to customer environments are screened U.S. persons, which mitigates this risk. On the commercial platform, support personnel may include foreign persons, and Zscaler does not contractually restrict access on a nationality basis. Customers routing ITAR-controlled technical data through any Zscaler platform are responsible for evaluating whether the platform’s access controls are sufficient to prevent an unauthorized release under their specific compliance posture. ITAR Requirement MappingTo support customers in leveraging Zscaler to implement ZTNA to meet ITAR requirements, Zscaler provides the following table mapping Zscaler capabilities to some of ITAR’s requirements. This mapping applies to FedRAMP Moderate and High platform deployments.ITAR RequirementZscaler Platform CoverageCustomer ResponsibilityAccess Restricted to U.S. Persons (22 CFR § 120.62)ZIA and ZPA verify identity and device posture before granting application access.FedRAMP Gov platform support staff restricted to screened U.S. persons.ZPA enforces least-privilege access policies.Customers must screen internal users for U.S. person status. Customers must configure ZPA policies to enforce ITAR data access restrictions.Prohibition on Unauthorized Export (22 CFR § 127.1)CASB detects and blocks uploads of ITAR data to unauthorized cloud services.DLP identifies and prevents transmission of ITAR-regulated content.ZIA enforces outbound traffic policies.Customers must define DLP policies aligned to their ITAR technical data categories. Customers must obtain and document any required DDTC export authorizations.Data Residency and Transmission ControlsFedRAMP High platform restricts data processing to CONUS infrastructure.FIPS-validated encryption for in-transit data protection.Customers must select FedRAMP Moderate or High platform (not commercial) for ITAR workloads. Customers must document data flows and residency requirements.Audit and Continuous Monitoring (DDTC recordkeeping)ZIA and ZPA generate detailed session logs for audit review.DLP telemetry provides evidence of policy enforcement.CASB reports document cloud application governance posture.Customers must retain logs in accordance with DDTC record retention requirements. Customers must establish continuous monitoring processes aligned to their ITAR compliance program.DDTC Registration and Contractual CommitmentsZscaler provides contractual ITAR commitments on FedRAMP Moderate and High platforms.ITAR compliance reports available at zscaler.com/compliance/overview.Customers must register with DDTC independently. Customers must execute appropriate contractual agreements with Zscaler via the FedRAMP Gov platforms. Choosing the Right Zscaler PlatformThe decision framework for platform selection is straightforward: the nature of the data and the contractual requirements of the organization determine the appropriate platform tier.Select Zscaler FedRAMP High If:Your organization handles ITAR-regulated technical data in the course of normal operations.Your organization handles CUI in the course of normal operations.Your prime contract or government agreement requires a cloud platform with US-person contractual requirements.You need the Zscaler platform that provides the strongest available audit evidence for DDTC compliance demonstration.Select Zscaler FedRAMP Moderate If:Your organization handles ITAR-regulated technical data in the course of normal operations.Your organization handles CUI in the course of normal operations.You are pursuing CMMC Level 2 compliance.You need FedRAMP authorization for civilian agencies or lower-sensitivity government workloads.You are migrating from commercial toward higher compliance posture.Admin Note: Depending on the supported product, technical support provided by personnel from Tier 3 and above may be provided by a mixed population of US- and non-US personnel and may include OCONUS access.Select Zscaler Commercial Platform If:Your organization does not handle ITAR-regulated technical data or CUI at the Moderate or High baseline.You are a commercial enterprise without federal contracting requirements that trigger FedRAMP or ITAR requirements.You require the full commercial capability set, including integrations with the global Azure commercial or AWS commercial ecosystems, and your workloads are not ITAR-restricted. ConclusionITAR compliance in a cloud security context is not a checkbox. It is a continuous operational discipline that begins with selecting the right platform and extends through policy configuration, access governance, audit, and documented risk management.Zscaler’s Zero Trust Exchange provides the security architecture and platform tiers necessary to support compliance at every level of the Defense Industrial Base:Zscaler FedRAMP High platform: The highest available unclassified security posture, with contractual ITAR commitments, and FedRAMP authorization. It provides the strongest available controls for organizations processing ITAR-regulated technical data.Zscaler FedRAMP Moderate platform: U.S. government-grade security with ITAR compliance reports for DIB and civilian agency workloads.Zscaler Commercial platform: Full Zero Trust Exchange capabilities for non-ITAR enterprise workloads.Choosing the right platform, and configuring it correctly, is a risk decision that belongs to the customer. Zscaler’s Federal and Defense segment is positioned to support that decision through platform guidance, compliance documentation, and field advisory engagement with CISOs, CIOs, and compliance officers across the Defense Industrial Base.This guide is for informational purposes only and does not constitute legal or export-control advice. Information is current as of August 19, 2026 and subject to change. Zscaler makes no representations or warranties regarding the applicability of this guide to any organization’s specific compliance requirements. Consult qualified export-control counsel before making platform or compliance decisions based on this guide.
