October 3, 2026 8 min read
JCP Certification Requirements in 2026: The Complete DD Form 2345 Checklist
By CJ Bradley, Bradley Defense Solutions Inc. (CAGE 87AW0)
If you clicked on a DLA solicitation and found the drawings locked, you have already met the Joint Certification Program. Until your company holds an approved DD Form 2345, you cannot open export-controlled technical data, and you cannot realistically quote the part.
The form itself is one page. What surrounds it is where most applicants need JCP help: several government systems that must all agree with each other before the JCP Office will approve you. This checklist covers every requirement in the order you should complete it.
What JCP certification is
The Joint Certification Program is a United States and Canada program, administered by the Defense Logistics Agency's JCP Office, that certifies contractors to receive unclassified, export-controlled military technical data. The application is DD Form 2345, the Militarily Critical Technical Data Agreement. Once approved, your certification is tied to a specific facility and CAGE code and is valid for five years.
You need it if you want to:
- View export-controlled drawings and technical data packages on DLA DIBBS and cFolders
- Open controlled attachments on SAM.gov solicitations
- Receive technical data from a prime contractor that requires a certified DD Form 2345 on file
- Attend restricted DoD conferences, industry days, and site visits
The JCP certification checklist
1. Active SAM.gov registration
Your entity must be registered and active in SAM.gov with a Unique Entity ID. An expired or "submitted" registration will stop a JCP application cold. Check your expiration date before you start, because SAM renewals can take weeks.
2. Active CAGE code with matching information
Your CAGE record must be active, and the legal business name and physical address on it must match what you put on the DD Form 2345 exactly. "Suite 4" on one record and "Ste. 4" on another, or an old address still sitting in CAGE, is one of the most common reasons applications get returned.
3. NIST SP 800-171 assessment posted in SPRS
This is the requirement that surprises people. Every company applying for JCP certification, including first-time applicants with no contracts yet, must have a NIST SP 800-171 self-assessment score posted in the Supplier Performance Risk System (SPRS). That means you need to:
- Create a PIEE account and get the SPRS Cyber Vendor User role approved
- Assess your systems against all 110 NIST SP 800-171 security requirements
- Calculate your score using the DoD Assessment Methodology
- Enter the score, your System Security Plan details, and your planned completion date in SPRS
The assessment must be redone every three years. Your score is also a statement to the government, so it has to be honest. An inflated score creates far bigger problems than a low one.
4. Data custodian training
The person you name as data custodian must complete DLA's training on the proper handling of export-controlled technical data before you apply, and the completion documentation goes in with your application.
5. An eligible data custodian
The data custodian is the individual personally responsible for receiving and safeguarding the data. For U.S. companies, this person must be a U.S. citizen or lawful permanent resident, and must actually work at the certified location.
6. A complete, accurate DD Form 2345
Use the current revision of the form (October 2022). Pay particular attention to the business activity description. It needs to explain, in plain terms, what your company does and why that work requires access to military technical data. Vague descriptions such as "government contracting" get questioned. The form must be signed by someone with authority to bind the company to the agreement.
7. Supporting documentation
Be ready to show that your business is real and operating at the address listed, with documentation such as a state business registration or license. If your company is registered with the State Department's DDTC or holds export licenses, that documentation is included as well.
Where JCP applications stall
In our experience, rejected and returned applications almost always trace back to one of these:
- Mismatched records. SAM, CAGE, SPRS, and the DD Form 2345 show different names or addresses.
- No SPRS score. The applicant did not know the NIST assessment was required, or could not get the right PIEE role approved.
- Missing training. The data custodian's training was skipped or not documented.
- A weak business description. The JCP Office could not tell why the company needs the data.
- An outdated form. An old revision pulled from a third-party site.
None of these are hard to fix. They are hard to spot when you have never been through the process, and each one sends you back to the start of the review queue. We cover these in more detail in our guide to common DLA JCP application mistakes.
After you are certified
Approval is not the end of your obligations. You must submit a revised DD Form 2345 whenever your information changes, including a move, a name change, or a new data custodian. You must keep your NIST SP 800-171 assessment current in SPRS. And you must renew before your five-year certification expires, or your drawing access shuts off.
Frequently asked questions
Do I need JCP certification to bid on DIBBS?
Not for every solicitation. But a large share of DLA parts solicitations include export-controlled drawings, and without JCP certification you cannot view them.
Is JCP certification the same as CMMC?
No. JCP controls who is allowed to receive export-controlled technical data. CMMC verifies how you protect controlled information on a contract. They are separate requirements, though both rest on NIST SP 800-171.
Does the government charge a fee for JCP certification?
No. There is no government application fee. The cost is the time and expertise needed to complete the NIST assessment and get every record aligned.
Can a one-person company get JCP certified?
Yes. Sole proprietors and home-based businesses qualify, provided they meet the same requirements as everyone else.
Do I need a contract first?
No. You can apply for JCP certification before you have ever won an award, and most new DLA suppliers should.
Get JCP help from people who do this every day
JCP certification is the only thing we do at jcpcertification.com. We handle the whole package: SAM and CAGE review, PIEE and SPRS setup, your NIST SP 800-171 assessment, and a DD Form 2345 prepared to pass review the first time. If you would rather be quoting parts than chasing down mismatched records, contact us today and we will tell you exactly where your company stands.
Get your JCP certification right the first time
Tell us where your company stands and we'll map the fastest path to an approved DD Form 2345.