What is JCP certification? JCP certification is DLA's approval, granted through the Joint Certification Program and DD Form 2345, that lets a U.S. or Canadian company access export-controlled military technical data, including DLA drawings attached to DIBBS solicitations. You apply online through the JCP Portal, and certification lasts five years.
You found a DIBBS RFQ for a part your shop could make. You click to view the drawings, and you hit a wall: the technical data is export-controlled, and you aren't certified to see it.
That wall is the Joint Certification Program, or JCP. If you're a small manufacturer, machine shop, or broker new to Defense Logistics Agency (DLA) contracting, JCP certification is one of the first things to put in place. Without it, many of the best-fit solicitations stay out of reach.
This guide explains what JCP is, who needs it, what DLA requires, and how to apply without the usual delays.
What Is the Joint Certification Program (JCP)?
The JCP is a joint U.S.–Canada program run by the DLA JCP Office. It certifies U.S. and Canadian companies to access unclassified military technical data that is not available to the public. That includes the export-controlled drawings, specifications, and technical data packages you need to quote and build defense parts.
According to DLA's JCP overview, access is governed by DoD Directive 5230.25 (Withholding of Unclassified Technical Data from Public Disclosure) and Canada's Technical Data Control Regulations.
The certification itself is the DD Form 2345, "Militarily Critical Technical Data Agreement." When you sign it, your company agrees to use the data only for legitimate business purposes, such as bidding on or performing a U.S. or Canadian government contract, and to protect it.
Why Does JCP Matter for DIBBS Technical Data and DLA Bids?
Plenty of DIBBS solicitations point to drawings you can't view without the right credentials. If you aren't certified, you can't see those drawings, and you can't price a part you can't see.
For DLA specifically, there are two levels to know:
- Standard JCP certification – your approved DD Form 2345, which covers access to unclassified, export-controlled military technical data in general.
- DLA Enhanced Validation (DEV) – an extra validation by DLA headquarters, beyond standard JCP, that grants access to export-controlled data in DIBBS and DLA's Technical Data Management Transformation (TDMT) system. DLA notes DEV was previously called EJCP.
In other words, an approved DD Form 2345 is required but may not be enough on its own for some DIBBS drawings. Plan for both if DLA is your main market.
Who Needs JCP Certification?
If your business needs to view, quote from, or work with export-controlled military technical data, you likely need it. That commonly includes:
- Machine shops and fabricators bidding DLA spare-parts RFQs
- Manufacturers subcontracting to primes that share controlled drawings
- Brokers and distributors who need to see technical data to source and quote
One note for brokers: DLA checks that your manufacturer or non-manufacturer status matches across the JCP application and SAM.gov. If you say you're a non-manufacturer but list manufacturing NAICS codes, DLA says your application will be returned until you justify those codes.
What Are the JCP Eligibility Requirements?
Per the DLA JCP instructions, U.S. applicants must:
- Be registered and physically located in the U.S. or Canada. DLA now also requires documents confirming each site physically exists and operates.
- Have an active SAM.gov registration and a CAGE code (NCAGE for Canada). DLA says your SAM registration should not expire within 90 days of submitting your application.
- Have a NIST SP 800-171 assessment posted in SPRS. DLA says this applies even if you've completed or started a CMMC assessment. The assessment must be renewed every three years. DLA's JCP pages require the assessment to be posted but do not list a minimum score.
- Follow DFARS 252.204-7012, the clause covering safeguarding of covered defense information.
- Complete the export-control training, "Introduction to Proper Handling of DoD Export-Controlled Technical Data," and upload its signed Certification Statement of Export Control Compliance.
- Name a Data Custodian. For a U.S. location, the DD Form 2345 requires the custodian to be a U.S. citizen or lawful permanent resident.
DLA also lists who can't be certified: companies outside the U.S. or Canada, companies without SAM or CAGE, companies without a NIST assessment in SPRS, entities on government exclusion lists, and anyone with export-control violations or a previously revoked JCP certification.
How Do You Get JCP Certified, Step by Step?
DLA no longer accepts emailed, mailed, or faxed DD Form 2345s. Everything goes through the JCP Portal.
- Confirm SAM and CAGE are current and accurate. Your company name, address, and NAICS codes should match what you'll enter in the portal.
- Post your NIST SP 800-171 assessment in SPRS.
- Complete the export-control training and sign the compliance statement.
- Gather your Proof of Business. For corporations and LLCs, DLA wants a document from the Secretary of State in your state of incorporation (as listed in SAM) showing good standing, dated within 12 months. Sole proprietors can use items like a DBA filing or business license.
- Install Google Authenticator for the portal's two-factor login.
- Register in the JCP Portal using a username and password or a CAC, then download the JCP External Portal User Guide.
- Complete the application. It captures all DD Form 2345 information. If you need DLA drawings, answer the DEV questions so DEV can be processed along with your JCP request.
- Upload documents and submit. Depending on your answers, you may also need items such as a DDTC registration letter or export license.
- Respond to analyst requests within 90 days. If you don't, the system automatically rejects or cancels your application.
How Long Does JCP Certification Take?
DLA advises starting an initial application at least 120 days before you need the certification. It also currently notes that processing timelines are extended due to operational demands, with applications handled in the order received.
Translation: don't wait for the perfect RFQ to show up. Apply now so you're ready when it does.
Once approved, JCP certification runs on a five-year cycle. DLA asks you to start renewals at least 120 days before your five-year expiration. DEV approvals are valid for three years.
How Does JCP Connect to DIBBS and TDMT?
To view export-controlled data in DIBBS and TDMT, DLA lists these requirements:
- An approved DD Form 2345 (uploaded with your DEV request)
- A DIBBS account with TDMT enabled
- A legitimate business need tied to a DLA solicitation, contract, or approved R&D project
- The export-control training certificate
TDMT replaced DLA's old cFolders system. Per DLA's EBS Supplier Resources, vendors register in DLA's AMPS system and sign in with Okta multi-factor authentication. You reach TDMT through DIBBS or directly.
DLA's JCP Office reviews DEV packages first, then HQ DLA does the final validation. Final DEV access is granted by HQ DLA, not the JCP Office.
What Mistakes Slow Down JCP Applications?
- Mismatched records. Name, address, or business type that differs between SAM, CAGE, and the portal.
- Stale Proof of Business. Documents older than 12 months, or not from the right Secretary of State.
- A SAM renewal coming due. Expiring within 90 days of submission invites problems.
- Missing the 90-day response window on analyst questions.
- Letting the portal account lock. DLA disables JCP Portal accounts not logged into for 35 days.
- Choosing the wrong Data Custodian. DLA warns against outside third parties, temps, or a shared mailbox instead of a responsible person.
- Forgetting revisions. Certified companies must submit a revision within five business days of changes to certified information, such as a new custodian or address.
Do You Need CMMC Level 2 for JCP?
CMMC Level 2 certification is not currently required for JCP. What DLA requires today is a NIST SP 800-171 assessment posted in SPRS.
DLA's JCP page does include forward-looking language: after the CMMC phased implementation period (November 10, 2025 – November 10, 2028), companies seeking new or renewed JCP certification would need a CMMC Level 2 certification from a C3PAO, posted in SPRS.
However, on July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase II requirements, which had been scheduled for November 10, 2026, and began a program review. Phase I self-assessment requirements remain in place, and the DoW CIO notes this does not remove DFARS 252.204-7012 obligations. How this affects the post-2028 JCP language hasn't been spelled out, so check the DLA JCP page for updates.
Frequently Asked Questions
Is JCP certification the same as ITAR registration?
No. ITAR registration is with the State Department's DDTC. DLA says not every JCP applicant needs DDTC registration; it depends on your business activities.
Does JCP cost anything?
The DLA JCP pages don't list an application fee. Free help is available from APEX Accelerators, which DLA points to for SAM and contracting support.
Can I share DLA drawings with a subcontractor?
Only with the right certification on both sides. DLA says DEV-restricted TDMT data may only go to DEV-validated entities, and primes must verify a sub's authorization first.
Who do I contact with questions?
The JCP Office at jcp-admin@dla.mil, or the DLA Customer Interaction Center at 1-877-DLA-CALL (1-877-352-2255).
Find the Opportunities Worth Getting Certified For
JCP certification opens the door to export-controlled drawings. The next step is finding solicitations that fit your shop. FedOpp brings federal solicitation intelligence from SAM.gov, DIBBS, DLA Urgent Need, the DLA no-bid list, prime subcontract notices, and SBIR awards into one place, so you can spend less time searching and more time quoting.
This article is for general education and isn't legal or compliance advice. Requirements change; always confirm current rules on the DLA JCP website.