JCP certification is how U.S. and Canadian contractors get authorized access to unclassified but export-controlled military technical data. The Joint Certification Program is a bilateral arrangement between the U.S. Department of Defense and the Canadian Department of National Defence, administered on the U.S. side by the Defense Logistics Agency. You apply by submitting DD Form 2345, and from a clean submission to an approval letter, the process usually runs several weeks to three months.
What Certification Actually Gets You
Certain unclassified technical data with military or space applications cannot be released publicly under U.S. export control law. DoD Directive 5230.25 treats public disclosure of that data as equivalent to uncontrolled foreign access, so it is withheld unless the requester has been vetted.1Department of Defense. DoDD 5230.25 – Withholding of Unclassified Technical Data From Public Disclosure JCP is the standardized path to prove a legitimate defense-related need and the security infrastructure to protect what you receive.
Once certified, you can request controlled technical data from DoD offices and access government systems that gate content behind a valid JCP number, including DLA’s DIBBS and SAM.gov.2Department of Defense. DD Form 2345 Instructions Certification is not a blank check, though. The controlling DoD office can still deny a specific data request if it decides the data is unrelated to the business activity your certification is based on.
Who Qualifies
Your organization has to meet four baseline requirements before applying:
- Registered and physically located in the United States or Canada.
- Active SAM.gov registration with a CAGE code (U.S. entities, assigned automatically during SAM registration) or an NCAGE code (Canadian entities, obtained through the appropriate codification bureau before SAM registration).3Acquisition.GOV. 48 CFR 52.204-16 – Commercial and Government Entity Code Reporting
- A completed NIST SP 800-171 self-assessment with results uploaded to the Supplier Performance Risk System (SPRS).
- Compliance with the safeguarding and cyber incident reporting requirements in DFARS 252.204-7012.4Defense Logistics Agency. Joint Certification Program
The program is built for business entities, not individuals. Without a CAGE code and SAM registration, you cannot qualify. Universities and research institutions apply under the same general rules; DLA does not publish separate eligibility criteria for academic applicants.
Completing DD Form 2345
DD Form 2345, the Militarily Critical Technical Data Agreement, is the only application vehicle. Pull the current version from the DLA website. Outdated form versions delay applications.
Match SAM Exactly
Your legal business name, physical address, and CAGE or NCAGE code on the form have to match SAM.gov exactly. Mismatches are one of the most common reasons applications stall. If your SAM record is lapsed or out of date, fix that first.
Business Activity Description
Block 4 asks you to describe your relevant business activity in enough detail that the controlling DoD agency can decide whether future data requests fit your work. You need to address several specific points inside the space provided: whether you are a prime or subcontractor, what you manufacture or provide, and whether your products relate to the U.S. Munitions List or the Commerce Control List.5Department of Defense. DD Form 2345 – Militarily Critical Technical Data Agreement Attachments to Block 4 are not allowed. You also indicate which government systems you need access to, or state that you need none.2Department of Defense. DD Form 2345 Instructions
Naming a Data Custodian
Every application must name a primary Data Custodian, the person who will receive export-controlled technical data and control its further distribution inside your organization. Block 3 requires their full name, direct phone number, official title, and business email address.5Department of Defense. DD Form 2345 – Militarily Critical Technical Data Agreement You can also designate an alternate.4Defense Logistics Agency. Joint Certification Program
The role carries weight. The Data Custodian makes sure only authorized personnel see the data, that storage and transmission follow proper security protocols, and that employees understand handling requirements. Assigning someone without the authority or bandwidth to actually oversee this creates compliance exposure later.
Cybersecurity Requirements
Cybersecurity compliance is now a required part of the application, not an afterthought. DLA requires a completed NIST SP 800-171 self-assessment and an uploaded SPRS score to certify.4Defense Logistics Agency. Joint Certification Program This is the same framework that governs DoD contractors handling Controlled Unclassified Information under DFARS 252.204-7012.6eCFR. 48 CFR 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting
NIST SP 800-171 contains 110 security controls across 14 categories, covering access control, multi-factor authentication, incident response, media protection, and more. You assess your environment against those controls and calculate a score out of 110 following the DoD methodology.7Department of Defense. NIST SP 800-171 DoD Assessment Methodology The summary score, the date of assessment, and a projected date for reaching 110 get uploaded to SPRS. If any controls are not fully implemented, you need a Plan of Action and Milestones documenting the gaps and target dates, plus a System Security Plan mapping your environment and how each control is implemented or planned.
There is a bigger change coming. Starting in November 2026, DoD solicitations may require CMMC Level 2 certification, which replaces self-assessment with a formal evaluation by a Certified Third-Party Assessment Organization.8Department of Defense CIO. About CMMC For JCP specifically, DLA has said contractors seeking new or renewed certification will need CMMC Level 2 under a post-2028 mandate.4Defense Logistics Agency. Joint Certification Program If your certification comes up for renewal around that window, budget for the cost and lead time of a third-party assessment.
DFARS 252.204-7012 also requires rapid reporting of cyber incidents affecting covered defense information. Reports go through the DIBNet portal, affected media must be preserved for at least 90 days, and submitting a report requires a DoD-approved medium assurance certificate. Getting that certificate before you need it is worth doing.6eCFR. 48 CFR 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting
Submitting and What Happens Next
Email the completed, signed, and dated DD Form 2345 as a PDF to the Joint Certification Office at JCP-Admin@dla.mil. You can also mail it to the U.S./Canada Joint Certification Office at the DLA Logistics Information Service in Battle Creek, Michigan, but email is faster.4Defense Logistics Agency. Joint Certification Program
A clean application typically clears in several weeks. Applications with errors or missing information can take three months or longer. DLA has said processing timelines are currently extended due to increased operational demand, and applications move in the order received. There is no online status portal; if you need an update, contact the JCP office directly. If the office finds problems, they will ask for clarifying information before moving forward. Approval comes with a JCP Certification Number and a Revision Date marking your entry into the program.
Keeping the Certification Active
Certification is valid for five years unless the approval letter says otherwise.2Department of Defense. DD Form 2345 Instructions During that period, you have to notify the JCP office of changes by submitting a revised DD Form 2345. Three common triggers:
- A move to a new physical address.
- A legal name change or restructuring.
- A change in Data Custodian, whether the person leaves or is replaced.
Send revisions to JCP-Admin@dla.mil or to the Battle Creek address.4Defense Logistics Agency. Joint Certification Program Failing to report changes can suspend your certification.
Renewal and Revocation
You can submit a renewal up to 120 days before your certification expires.2Department of Defense. DD Form 2345 Instructions Given the extended processing DLA has acknowledged, filing well before expiration is the safer play. Renewal uses the same DD Form 2345, resubmitted with current information.
Revocation is serious. If your certification is revoked, you are disqualified from the program, and entities that have been debarred or suspended from government contracts are also ineligible.4Defense Logistics Agency. Joint Certification Program DoDD 5230.25 also authorizes temporary revocation of a contractor’s qualified status, which blocks data access even if the certification number technically still exists.1Department of Defense. DoDD 5230.25 – Withholding of Unclassified Technical Data From Public Disclosure Letting the certification lapse or neglecting cybersecurity compliance puts your ability to bid on and perform defense contracts at risk.
Penalties for Mishandling Controlled Data
The technical data JCP unlocks falls under the Arms Export Control Act, and the penalties are steep. Willfully violating export control regulations or making a false statement on a registration or license application can result in a fine of up to $1,000,000 per violation, imprisonment of up to 20 years, or both.9Office of the Law Revision Counsel. 22 U.S. Code 2778 – Control of Arms Exports and Imports The “willfully” threshold means knowing disregard, not honest mistakes, but weak internal controls make it easier to cross that line without noticing.
Your Data Custodian is the front line. If controlled data is shared with unauthorized people or sent outside the country without proper authorization, the consequences reach the organization and can reach individuals. Accurate records of who accesses what, plus cybersecurity infrastructure that actually meets NIST SP 800-171, are the practical guardrails.