What is JCP certification? JCP certification is approval from DLA's Joint Certification Program, filed as DD Form 2345 in the JCP Portal, that lets a U.S. or Canadian shop view export-controlled technical data such as controlled DLA drawings. To get JCP certified, prepare SAM, CAGE, SPRS and training first, then apply online. It lasts five years.
Most machine shops don't get stuck on the machining. They get stuck on the paperwork that comes before the print ever hits the shop floor.
If you want to quote defense parts, sooner or later you'll need to see a controlled drawing. For that, the Department of War and Canada's Department of National Defence use one gatekeeper: the Joint Certification Program (JCP), and its agreement, DD Form 2345.
Here's how we'd walk a shop through it, in the order the work actually happens.
What Is JCP Certification, in Short?
JCP is a joint U.S.–Canada certification managed by the Defense Logistics Agency's JCP Office. Once certified, a company can access unclassified military technical data that isn't released to the public, the kind of export-controlled drawings and specs that come with many defense part solicitations.
Your certification is the approved DD Form 2345, the Militarily Critical Technical Data Agreement. By signing, your company promises to use that data only for legitimate business, such as bidding on or performing government work, and to keep it out of the wrong hands.
It's valid for five years. Today, you apply online only, through the JCP Portal.
Does Your Shop Actually Need It?
Ask yourself one question: Do we need to look at drawings or tech data marked export-controlled?
If you're bidding DLA spare-parts RFQs on DIBBS or building to a prime's controlled package, the answer is usually yes. If you only make commercial-spec hardware with no controlled data, you may not need it.
JCP certifies a specific physical location tied to a CAGE code. If you run two plants with separate CAGE codes, plan on treating each one separately.
Phase 1: What Should a Shop Prepare Before Applying?
This is where most of the time goes. Do it before you ever open the portal.
Check your federal registrations
- SAM.gov is active and accurate. DLA says your SAM registration shouldn't expire within 90 days of submitting. SAM renews yearly and must stay active the whole time you're certified.
- Your CAGE code details are current. Address, legal name, and ownership should match SAM exactly.
- You're listed correctly as a manufacturer. DLA will return an application that says "manufacturer" in JCP while SAM doesn't show you as one.
Post your cybersecurity assessment
DLA requires a NIST SP 800-171 assessment posted in the Supplier Performance Risk System (SPRS). That holds even if you've started or finished a CMMC assessment.
The JCP pages require the score to be posted; they don't set a minimum score. An honest assessment, along with a real System Security Plan, is the right foundation. Re-do it every three years.
You'll also agree to follow DFARS 252.204-7012 for safeguarding covered defense information.
Pick your Data Custodian
This is the person accountable for who in your shop sees controlled data. For a U.S. facility, the DD Form 2345 requires a U.S. citizen or lawful permanent resident.
DLA's guidance says to choose an employee who knows your operations, has internal authority, and works at or supports the certified location. Don't use an outside consultant, a temp, or a shared inbox. You can also name an alternate.
Finish the training
Everyone applying completes DLA's "Introduction to Proper Handling of DoD Export-Controlled Technical Data." Sign the Certification Statement of Export Control Compliance at the end; you'll upload it.
Pull your proof of business
For a corporation or LLC, get a good-standing document from the Secretary of State in your state of incorporation (the one listed in SAM). It must be dated within 12 months. Sole proprietors can use a DBA filing, business license, lease, or similar.
DLA has also added location verification, so be ready to document that your shop physically exists and is operating.
Phase 2: How Do You Apply in the JCP Portal?
- Install Google Authenticator on a phone. The portal uses it for two-factor login.
- Go to the JCP Portal and click Register. Choose username/password or CAC.
- Download the JCP External Portal User Guide and the US Relevant Business Activity document. Keep them open while you fill things out.
- Choose JCP Certification Request. The online form covers every DD Form 2345 field.
- If you want DLA drawings, answer the DEV questions in the same application (more on DEV below).
- Upload your proof of business, training statement, and anything else your answers trigger, like a DDTC registration letter or export license.
- Submit, then log in at least every 35 days. DLA disables inactive accounts.
Phase 3: What Happens After You Submit DD Form 2345?
DLA advises starting an initial application at least 120 days before you need it. Right now DLA also notes extended processing times, with applications worked in the order received.
If a JCP analyst asks for a correction or document, you have 90 days to respond. Miss it, and the system cancels your application and you start over. Make sure the Data Custodian watches the inbox.
When you're approved, download your DD Form 2345 from the portal and file it somewhere safe. You'll need it again.
How Do You Get DLA Drawings Access Through DEV, DIBBS and TDMT?
Here's the part that surprises shops: for some DLA solicitations, a standard DD Form 2345 isn't enough.
Export-controlled data in DIBBS and DLA's Technical Data Management Transformation system (TDMT, which replaced cFolders) requires DLA Enhanced Validation (DEV). According to DLA, you need:
- An approved DD Form 2345
- A DIBBS account with TDMT enabled
- A legitimate business need tied to a DLA solicitation, contract, or approved R&D project
- Your export-control training certificate
The JCP Office reviews the request, then HQ DLA makes the final call. DEV is good for three years. For TDMT login, DLA's supplier resources page explains the AMPS registration and Okta multi-factor sign-in.
How Do You Keep JCP Certification Active?
- Report changes fast. New address, name, data custodian, signer, or type of work? DLA requires a revision in the portal within five business days.
- Watch your renewal clock. Start your five-year renewal at least 120 days before it expires.
- Re-do NIST every three years and keep SAM active every year.
- Control who sees the prints. Only share data with certified partners. DEV-restricted TDMT data can only go to DEV-validated companies.
Is CMMC Level 2 Required for JCP?
Not right now. The current requirement is a NIST SP 800-171 assessment in SPRS.
DLA's JCP page does say that after the CMMC phase-in period ending November 10, 2028, new or renewed JCP certifications would require CMMC Level 2 from a C3PAO. But on July 13, 2026, the Department of War suspended CMMC Phase II (planned for November 10, 2026) and began reviewing the program. Self-assessment requirements still apply. Keep an eye on the DLA JCP page for how the post-2028 requirement may change.
JCP Certification FAQ
What does "JCP certified" actually let me do?
Access unclassified, export-controlled military technical data for legitimate business, and request DEV for DLA's controlled drawings.
Can a Canadian partner be our Data Custodian?
No. Under the DD Form 2345, a U.S. location's custodian must be a U.S. citizen or lawful permanent resident.
Can I email my DD Form 2345 to DLA?
No. DLA only accepts applications through the JCP Portal.
Where can I get free help?
The JCP Office (jcp-admin@dla.mil) and your local APEX Accelerator.
Working With Iowa Shops on Defense Parts
PHLX Tactical is a small defense parts broker in Orange City, Iowa. We partner with AS9100, ISO, and ITAR-registered Iowa machine shops to help get DLA and defense parts quoted and built. If you're a manufacturer thinking about defense work, or you need a part made, we'd be glad to talk.
PHLX Tactical
403 4th St NW, Orange City, IA
Phone: 712-441-3691
This post is general information, not legal or compliance advice. Always confirm current requirements on the DLA JCP website.
