There is no formal list of procedures you need to protect ITAR information. You need to use something like "standard security procedures" to keep the information away from foreigners.

What this means in practice is you consult your organizations lawyers, draft a policy, and follow it to the letter so you don't go to jail. You personally are liable (jail time and fines) if the information leaks out. Having an approved policy that you are following is really the only protection.

As colechristensen said, IP is not adequate identification. Anyone with time to kill can proxy themselves into a US IP.

No. There are plenty of Non-US Persons (people without greencards or citizenship) in the U.S. and IP is not adequate identification anyway.