Any rocket capable of putting a spacecraft in orbit is going to fall under Category IV, paragraph (a), subparagraph (1), (2), or (4). Under Note 3 to paragraph (a), it explicitly calls out model and high power rockets defined in NFPA Code 1122 "made of paper, wood, fiberglass, or plastic containing no substantial metal parts and designed to be flown with hobby rocket motors that are certified for consumer use" as not under ITAR. The note further specifies that these rockets "must not contain active controls".
Various subsystems for that rocket (engines, guidance, staging mechanisms, thrust structure, injectors, umbilical connectors, etc) are also individually controlled under other paragraphs in Category IV.
Spacecraft that are covered by ITAR are covered under Category XV. Whether the spacecraft is covered depends on what it does. Most of the entries fall under remote sensing of various flavors.
Of particular interest for human spacecraft though:
Paragraph (e)(10)(i) may cover a spacecraft that wants to rendezvous
with another.
Paragraph (e)(11)(iv) covers higher power electric
propulsion.
Paragraph (e)(12) covers pretty much any thrusters that would be useful for human spacecraft. (150 lbf thrust, or total impulse greater than 841,000 Newton-seconds)
Paragraph (e)(13) covers the use of CMGs for attitude control.
Paragraph (e)(16) covers high capability star trackers
Paragraph (e)(19) covers reentry heat shields.