DD Form 2345 and JCP certification: how to get access to DLA drawings
DLA posts the drawings for its solicitations in cFolders, and the export-controlled ones stay locked until your company is JCP certified and approved by DLA. Here is what that involves, step by step, with a link to the official source for each one.
What JCP certification is
The Joint Certification Program (JCP) is run jointly by the United States and Canada. DLA says that once certified, U.S. and Canadian companies can access unclassified military technical data that is not available to the public: the kind of drawings, specifications and technical information you need to quote or make a defense part.
The application is the DD Form 2345, the Military Critical Technical Data Agreement. DLA's JCP office is the only DoD and Canadian DND office that reviews and certifies it. When you are approved, the certified DD Form 2345 is your certificate, and the Government of Canada notes it carries a seven-digit certification number.
Certification is tied to a location. The Government of Canada says each subsidiary, division or site that will receive technical data must be certified separately, and data can only go to the certified location on the form.
Who can apply
DLA says your business must be registered and physically located in the U.S. or Canada, have an active SAM registration and a CAGE or NCAGE code, have a NIST SP 800-171 assessment in SPRS, and follow DFARS 252.204-7012 for protecting sensitive information. Some Canadian applicants have different requirements; DLA and the Government of Canada list them separately.
DLA lists these as ineligible:
- Companies outside the U.S. or Canada
- Companies not registered in SAM, or without a valid CAGE/NCAGE code
- Companies without a NIST SP 800-171 assessment documented in SPRS
- Companies or representatives who have violated U.S. or Canadian export-control law, or had a JCP certification revoked
- Entities debarred or suspended from government contracts
Have these ready before you apply
From DLA's pre-application list for U.S. companies.
- 1
SAM registration and a CAGE code
Register in SAM.gov and get a CAGE code (an NCAGE code in Canada). DLA says your SAM registration must be active and accurate, and should not expire within 90 days of your JCP application. SAM registration expires every year.
- 2
NIST SP 800-171 assessment in SPRS
Complete a NIST SP 800-171 cybersecurity self-assessment and upload the result to the Supplier Performance Risk System (SPRS). DLA says it has to be redone every three years.
- 3
Export-control handling training
Complete DLA's Introduction to Proper Handling of DoD Export-Controlled Technical Data training. You upload its Certification Statement of Export Control Compliance with your application.
- 4
Proof of business
A document from the Secretary of State for the state of incorporation listed in SAM, showing the business in good standing (or equivalent), dated within 12 months. Sole proprietors can use one of the alternatives DLA lists, such as a business license or federal tax ID.
- 5
A data custodian
The person at your company responsible for who gets access to the technical data you receive. DLA lets you add an alternate data custodian.
- 6
Google Authenticator
The JCP portal uses two-factor authentication through Google Authenticator.
Applying in the JCP portal
Paper and emailed forms are no longer accepted. DLA says the online JCP portal includes all the DD Form 2345 fields and is the only way to apply. The portal has separate paths for a JCP certification request and a DLA Enhanced Validation (DEV) request, and once you are certified you can download your DD Form 2345 from it.
- Register in the portal with a username and password or a CAC.
- Fill in your company and data custodian details, then answer the questions about your business activity and why you need the data. DLA publishes a "US Relevant Business Activity" guide to help with those questions.
- Upload your proof of business, your export-control compliance statement, and any other documents your answers call for, such as a DDTC registration letter or an export license.
Timing rules DLA does state
- Start an initial application at least 120 days before you need the certification.
- Once your application is in processing, answer every analyst request within 90 days, or the portal cancels the application and you start again.
- Log in to the portal at least every 35 days, or your account is disabled.
- Submit a revision within 5 business days of a change to certified information, such as your company name, location or data custodian.
The Government of Canada says JCP aims to respond within 5 business days. DLA separately advises starting at least 120 days before you need the certification, and says enhanced-validation processing times vary, so plan for the longer window.
How long it lasts
The Government of Canada says certification is valid for up to five years and can be renewed every five years. DLA says to start a five-year renewal at least 120 days before your current certification expires. Your SAM registration has to stay active the whole time.
DLA has also announced it will phase in CMMC requirements for JCP between 10 November 2025 and 10 November 2028. After that, DLA says, companies seeking new or renewed JCP certification must hold a CMMC Level 2 certification from a C3PAO, uploaded to SPRS.
The extra step for DLA drawings: Enhanced Validation (DEV)
JCP certification on its own does not open export-controlled drawings on DLA solicitations. Those live in cFolders, DLA's technical data system, and DLA says JCP-certified companies without DEV can use DIBBS but cannot access cFolders data. DEV was previously called Enhanced JCP (EJCP).
To request export-controlled technical data for a DLA solicitation, DLA says you must:
- Hold an approved JCP certification (DD Form 2345)
- Have a DIBBS account with a cFolders account enabled (see our DIBBS guide)
- Have a business need, such as quoting a DLA solicitation or fulfilling a DLA contract
- Upload the export-control training certificate with a DEV request in the JCP portal
After the JCP office reviews your documents, DLA itself runs a trade security control assessment. DLA is explicit that approval for its export-controlled data comes from DLA, not the JCP office. DLA says a DEV is valid for three years unless your company's information changes. If your JCP certification expires within three months when you request DEV, you need to file a five-year renewal first.
One more rule worth knowing: DLA says cFolders data can only be shared with other DEV-approved companies. If you plan to send a drawing to a subcontractor, check their status first.
Before you spend time on any of this for a specific part, check its codes. If the suffix is R, P or D, the government does not have usable data for a new source anyway. Our AMC and AMSC guide explains how to tell.
Where to get help
- JCP office: jcp-admin@dla.mil
- DLA export-controlled data questions: DLAJ344DataCustodian@dla.mil
- DLA Customer Interaction Center: 1-877-352-2255, open 24/7. Have your company name and CAGE code ready.
- APEX Accelerators, which DLA describes as a nationwide network of no-cost centers that help with SAM registration and getting into government contracting.
Common questions
What is DD Form 2345?
It is the Military Critical Technical Data Agreement. DLA's JCP office is the only DoD and Canadian DND office that reviews and certifies it. Once certified, your DD Form 2345 is your JCP certificate. The Government of Canada describes the signed form as an agreement that the technical data will not be given to unauthorized people.
Can I still email or mail a DD Form 2345?
No. DLA says the JCP only accepts applications through the online JCP portal, which includes all DD Form 2345 fields, and no longer accepts submissions by email, mail, delivery service or fax.
How long is JCP certification valid?
Up to five years, according to the Government of Canada's JCP page, and DLA refers to five-year renewals. DLA says to start a renewal at least 120 days before your current certification expires.
How long does a JCP application take?
The Government of Canada's JCP page says the program aims to respond within 5 business days. DLA advises starting an initial application at least 120 days before you need the certification, and says that once your application is in processing you must answer any analyst request within 90 days or the application is cancelled.
Is JCP enough to download export-controlled drawings from cFolders?
No. DLA says JCP-certified companies without DLA Enhanced Validation (DEV) can use DIBBS but cannot access cFolders export-controlled data. You also need a DIBBS account with cFolders enabled, a business need such as quoting a DLA solicitation, and DLA's own approval.
Who can apply for JCP certification?
Businesses registered and physically located in the United States or Canada. DLA lists companies outside the two countries, companies without SAM registration or a CAGE/NCAGE code, companies with prior export-control violations or revoked certifications, and debarred or suspended entities as ineligible.
Send us a part number
Give us the NSN or part number you are looking at. We will tell you what the catalog says about who can make it and match it to machine shops in our directory that could quote it.
Want a person to check a solicitation for you? See the DLA bid desk. New to this? Start with our government contracting guide for machine shops, or try the free NSN and part number lookup.
Sources
- DLA: Joint Certification Program (JCP)
- DLA: Joint Certification Program Portal. Published 17 August 2026
- DLA: Joint Certification Program guide. Revised July 2025
- Government of Canada: Apply for certification in the Joint Certification Program
- DLA: Accessing the DLA Internet Bid Board (DIBBS) and the Collaboration Folders (cFolders). 25 March 2025