DD Form 2345 and JCP Certification: How to Get Approved With a NIST SP 800-171 Score in SPRS

By The Defense Compliance Report Editorial Team · Last verified: November 11, 2026

General information for the defense industrial base, not legal, export control or compliance advice. Not affiliated with DoD, the Department of War, DLA, The Cyber AB, NIST or any government agency. DLA's Joint Certification Program Office decides every application.

Short answer: DD Form 2345 is the certification that lets a U.S. or Canadian company receive export-controlled military technical data, such as restricted drawings in DLA solicitations. You apply through the Defense Logistics Agency's Joint Certification Program (JCP) portal. As of November 11, 2026, DLA will not accept a U.S. application until your company has an active SAM registration, a CAGE code and a NIST SP 800-171 assessment posted in SPRS. That SPRS assessment is valid for three years, while the JCP certification runs for five. DLA says to start at least 120 days before you need the certification, and it currently warns that processing times are extended. The CMMC Phase 2 suspension does not remove the SPRS step.

Get help posting a NIST SP 800-171 score before you apply

Who this page is for

Machine shops and parts manufacturers bidding DLA solicitations whose technical data packages are restricted to JCP-certified firms.
Subcontractors whose prime has asked for a JCP certification before it will release drawings.
Repair, overhaul and R&D firms that need access to unclassified military technical data for a legitimate business purpose.
Companies renewing a five-year JCP certification that now need a current NIST SP 800-171 score in SPRS to do it.

If you repair aircraft or components, CMMC for MRO and aircraft maintenance explains how JCP and CMMC overlap in that trade. If you are checking whether a specific solicitation requires CMMC at all, start with CMMC required to bid on a contract.

What DD Form 2345 and the JCP are

The legal basis is DoD Directive 5230.25, Withholding of Unclassified Technical Data From Public Disclosure. It lets DoD withhold unclassified technical data with military or space application that cannot be exported without a license, and release it only to "qualified U.S. contractors." The directive establishes DD Form 2345, which it names the Military Critical Technical Data Agreement, as the way a company certifies that it qualifies.

Item — What it is — Source
Item	What it is	Source
DD Form 2345	Your company's signed certification that it may receive export-controlled technical data and will protect it	DoDD 5230.25, section 6.1.9
Joint Certification Program	The U.S. and Canadian program, run by DLA, that reviews and approves DD Form 2345 applications through an online portal	DLA JCP page
Technical data covered	Blueprints, drawings, plans, instructions, software and documentation that can be used to design, engineer, produce, manufacture, operate, repair, overhaul or reproduce military or space equipment	DoDD 5230.25, enclosure 2
Standard JCP certification	Access to unclassified military technical export-controlled data, valid for five years	DLA JCP page
DLA Enhanced Validation (DEV)	An added HQ DLA approval, only for cFolder data in DIBBS (formerly called EJCP)	DLA JCP page

The JCP Office no longer accepts emailed DD Form 2345s. Every application, renewal and revision goes through the JCP portal.

JCP, NIST SP 800-171 and CMMC: three separate gates

These are three different checks, run by different offices, and each has its own record and renewal date.

Gate — What it proves — Who checks it — How long it lasts
Gate	What it proves	Who checks it	How long it lasts
JCP certification (DD Form 2345)	You are an eligible U.S. or Canadian entity with a legitimate business need for export-controlled technical data	DLA JCP Office (plus HQ DLA for DEV)	Five years, with revisions required when certified details change
NIST SP 800-171 assessment in SPRS	Your self-scored implementation of the 110 NIST SP 800-171 requirements, posted with your CAGE codes	You score it; SPRS stores it; DoD may assess it at Medium or High confidence	Current for three years under DFARS 252.204-7019
CMMC status	Level 1 (Self) or Level 2 (Self) status and affirmation in SPRS when a solicitation requires it	You assess and affirm; the contracting officer checks SPRS before award	Level 2 (Self) every three years, with annual affirmation

The NIST assessment sits in the middle. DLA requires it before a JCP application. Where a solicitation includes DFARS 252.204-7019, an offeror that must implement NIST SP 800-171 needs a current assessment in SPRS to be considered for award, and DFARS 252.204-7020 bars primes from awarding covered subcontracts to firms without one. A missing SPRS score can block both your drawings and your award.

Who can apply and who DLA turns away

DLA's JCP page lists the eligibility rules for U.S. applicants. Canadian firms follow a separate track covered later on this page.

Requirement (U.S. applicants) — Detail DLA states — What to check before you apply
Requirement (U.S. applicants)	Detail DLA states	What to check before you apply
Location	Registered and physically located in the U.S. or Canada	The applying site is a physical U.S. or Canadian location
SAM registration	Active and accurate; must not expire within 90 days of submitting the application; entity type must match (for example, Manufacturer or Distributor)	SAM expiration date and entity type
CAGE code	Active, with accurate information on record	CAGE address matches the site applying
NIST SP 800-171 assessment	Documented in SPRS before applying; renewed every three years	A score is posted and is less than three years old
DFARS 252.204-7012	Follow the rules for protecting covered defense information	A system security plan backs the score you posted
Proof of business	From the Secretary of State for the state of incorporation listed in SAM, showing good standing, dated within 12 months	Right state, good standing, issued in the last 12 months
Data custodian training	Each data custodian completes DLA's export-controlled data handling training and signs the page 15 certification	Page 15 signed for each custodian
Two-factor authentication	Google Authenticator installed for the portal	Authenticator set up on a device the applicant controls

DLA bars applicants that have violated U.S. or Canadian export control laws, had a JCP certification revoked, or are debarred or suspended from government contracting. Depending on your answers in the portal, DLA may also ask for a DDTC registration letter, an export license, a Technical Assistance Agreement or a DS-2032.

The NIST SP 800-171 score DLA wants in SPRS

This step requires security work on your systems before any paperwork, so start it first.

What counts as the assessment

DFARS 252.204-7020 defines a Basic Assessment as your own review of your system security plan, scored under the NIST SP 800-171 DoD Assessment Methodology, with a "Low" confidence level because you generated it. Medium and High Assessments are performed by the government. DLA's page asks for a NIST SP 800-171 assessment documented in SPRS and does not require a government-led one.

SPRS stores the result; it cannot perform the assessment for you. Each record holds the assessment date, score, scope, plan of action completion date, included CAGE codes, system security plan name, version and date, and confidence level. To enter it, someone at your company needs a PIEE account with the SPRS Cyber Vendor User role.

How the score works

Element — Rule — Source
Element	Rule	Source
Requirements scored	All 110 requirements in NIST SP 800-171 Rev 2	32 CFR 170.24; DoD CIO
Starting point	110, the total number of requirements	32 CFR 170.24
Point values	Each requirement not met subtracts 5, 3 or 1 points depending on its weight	32 CFR 170.24
Partial credit	Only multifactor authentication (3.5.3) and FIPS-validated encryption (3.13.11)	32 CFR 170.24
Negative scores	Possible when many high-value requirements are not met	32 CFR 170.24
Plan of action date	You report the date you expect to reach 110	DFARS 252.204-7020

Use Revision 2. The July 13, 2026 suspension memo says DoD will enforce NIST SP 800-171 Rev 2 during the CMMC review, and DoD CIO's CMMC page says the same. NIST has published Revision 3, but DoD scoring and CMMC Level 2 still run on Rev 2.

What a low score does to your application

DLA's JCP page does not set a minimum score. It requires the assessment to be documented. A low score is still a score you have to stand behind. DFARS 252.204-7020 lets the government run a Medium or High Assessment, and a posted score that your system security plan can't support can create False Claims Act exposure. Read what happens if you lie on your SPRS score before you post. If your number is low, how to improve your SPRS score covers the fastest point gains, and our SPRS score guide explains the entry screens.

The three-year and five-year mismatch

DLA says the NIST assessment is valid for three years and must be renewed before it expires. A JCP certification runs for five years. If you post your score the month you apply, it lapses about two years before your JCP certification does. Put the SPRS renewal date on the same calendar as your SAM renewal and your JCP expiration.

Compare readiness help for your SPRS assessment

How to apply for JCP certification, step by step

Fix SAM and CAGE first. Confirm your SAM registration won't expire within 90 days, your entity type matches your work, and your CAGE record shows the address of the site applying.
Write or update your system security plan. Requirement 3.12.4 needs a plan, and the SPRS record asks for its name, version and date. Our SSP template guide shows the structure.
Score your systems against NIST SP 800-171 Rev 2. Use the DoD weighting. Record open items in a plan of action with real dates; our POA&M template covers the format.
Post the score in SPRS. Get PIEE access and the SPRS Cyber Vendor User role, then enter the score, scope, CAGE codes and SSP details.
Pick your data custodian. Choose an employee at the certified CAGE location (details below) and have them complete DLA's handling training and sign page 15.
Gather proof of business. Get a Secretary of State record for your state of incorporation, dated within the last 12 months, showing good standing.
Register in the JCP portal. Set up Google Authenticator, register with a username and password or a CAC, and confirm your CAGE and SAM details are accurate.
Answer the business-need questions. DLA's quick reference guide covers the 11 questions that justify your need for the data. Upload any documents your answers trigger, such as a DDTC letter or export license.
Have an authorized signer sign. The person signing must be able to obligate the company to a government contract.
Watch for analyst requests. Once processing starts, you have 90 days to answer each request for corrections or documents. Miss it and the portal cancels the application.

Download the CMMC Readiness Checklist

Choosing a data custodian

The data custodian is the person who oversees who inside your company can see the export-controlled data. DLA requires a primary custodian and allows an alternate. Under DoDD 5230.25, the person receiving the data for the company must be a U.S. citizen or lawful permanent resident located in the United States.

DLA says choose someone who is — DLA says avoid
DLA says choose someone who is	DLA says avoid
Employed by your company	Outside third parties, including consultants
Familiar with company operations	Temporary staff without authority
Able to coordinate with management, IT, contracts or security	Someone chosen only because they are available
Tied to the certified physical location of the CAGE code	A shared mailbox instead of a named person

A custodian can't be attached to more than one CAGE code. Adding an alternate after certification requires a portal revision approved by the JCP Office before that person can act. If the custodian leaves or changes roles, you must file a revision.

DLA Enhanced Validation (DEV) for DIBBS technical data

A standard JCP certification is not enough for every DLA download. Restricted technical data in DIBBS cFolders requires DLA Enhanced Validation, which DLA used to call EJCP.

Question — Standard JCP — DEV
Question	Standard JCP	DEV
What it gives access to	Unclassified military technical export-controlled data from DoD sources	cFolder data from DLA through DIBBS and TDMT
What you need first	SAM, CAGE, SPRS assessment, training, proof of business	An approved DD Form 2345, plus a DIBBS account with TDMT enabled
Business need	A legitimate business purpose for the data	Tied to a specific DLA solicitation, contract or approved R&D project
Who reviews	JCP Office	JCP Office, HQ DLA Legal, and a trade security control assessment
Final approval	JCP Office certifies the DD Form 2345	HQ DLA grants DEV access, not the JCP Office
Sharing	With other qualified contractors within your certified purpose	Only with another JCP-certified firm that also holds DEV approval and a need to know

If you don't hold a JCP certification yet, DLA lets you include the DEV information in the same portal application.

Timelines and deadlines to plan around

Event — Rule as stated by DLA on November 11, 2026
Event	Rule as stated by DLA on November 11, 2026
Initial JCP application	Start at least 120 days before you need the certification
Current processing	Timelines are extended; applications are handled in the order received
Analyst requests	Respond within 90 days or the application is rejected or cancelled
Five-year renewal	Start at least 120 days before your current certification expires
Changes to certified details	File a revision within 5 business days of a change in name, site, primary work type, signer or data custodian
NIST assessment in SPRS	Renew every three years, before it expires
SAM registration	Renew every year; keep it active the whole time you are certified
DDTC registration (if you listed it)	Must stay active for the full five years, or you must file a revision

DLA treats a DD Form 2345 with inaccurate information as invalid and subject to suspension. A missed revision after a move or a staff change can cost you access mid-contract.

How the CMMC suspension affects JCP applicants

On July 13, 2026, the Under Secretary of War for Acquisition and Sustainment signed memo 26-P-1023, carrying out the DoD CIO's suspension of CMMC Phase 2. Here is what changed and what did not.

Item — Status on November 11, 2026
Item	Status on November 11, 2026
CMMC Phase 2 (planned for November 10, 2026)	Suspended
CMMC levels a solicitation may require	Level 1 (Self) or Level 2 (Self) only
DFARS 252.204-7012	Still in effect
NIST SP 800-171 Rev 2 enforcement	Through self-assessments and select government-led assessments
DLA's NIST assessment prerequisite for JCP	Still listed on the JCP page
Restart date for Phase 2	None posted on the DoD CIO CMMC page

The suspension changed who performs CMMC assessments. It did not change DLA's JCP rules. A firm that paused its NIST SP 800-171 work in July still needs a posted score before it can apply.

Clause numbers can also differ between solicitations. Under the 2026 Revolutionary FAR Overhaul class deviation, newer solicitations may cite a renumbered assessment clause instead of DFARS 252.204-7020. Our DFARS 252.204-7019 and 7020 explainer walks through both versions.

Protecting the drawings once you are approved

JCP certification gives you access. It doesn't tell you where the files can live. If a file carries a CUI banner or a distribution statement B through F, treat it as Controlled Unclassified Information. The CUI Registry defines Controlled Technical Information as technical information with military or space application marked with distribution statements B through F, including engineering drawings, specifications, process sheets, manuals and technical orders. Its Export Controlled category covers information on items controlled under ITAR and the EAR.

When that data is covered defense information under a contract, DFARS 252.204-7012 applies: NIST SP 800-171 on the systems that hold it, cyber incident reports to DoD within 72 hours, and FedRAMP Moderate equivalent security for any cloud service that stores it. Read DFARS 252.204-7012 explained for the full duty list.

Practical rules for a small shop:

Keep the downloads in the environment you scored. If your SPRS score covers an enclave, the drawings go in the enclave, not on the shop-floor PC.
Control the paper. NIST SP 800-171 requirement 3.8.1 covers paper media. Printed drawings at a machine need storage and disposal rules.
Limit access to employees with a need to know. DoDD 5230.25 bars passing the data to anyone other than your employees or people acting on your behalf without permission, except to other qualified contractors within your certified purpose.
Know your export obligations. DoDD 5230.25 has you acknowledge that, in some cases, you need an export license before releasing technical data even inside the United States, which matters if foreign nationals work in your shop. Our CMMC compliance for ITAR companies page covers how the two regimes interact.

Keeping export-controlled data in one controlled environment keeps the scope of your SPRS assessment small. See CUI enclave providers for the options.

Compare CUI environments for export-controlled drawings

What getting JCP-ready costs

DLA's JCP page lists no application fee. The cost is in the NIST SP 800-171 work behind the SPRS score. DoD's closest published estimate is in the CMMC final rule, which assumes the security requirements are already in place.

Item (small entity, DoD estimate) — Cost in the rule
Item (small entity, DoD estimate)	Cost in the rule
CMMC Level 2 self-assessment and affirmation	$34,277
Three-year cost, including two annual affirmations	$37,196
Each annual affirmation	$1,459

Those figures cover assessing and affirming, not fixing gaps. If you are starting from a low score, implementation (multifactor authentication, FIPS-validated encryption, logging, an enclave) is usually the larger number. Estimate your range with the CMMC cost calculator, and see CMMC self-assessment cost for typical line items.

Estimate your NIST SP 800-171 and CMMC cost

Why JCP applications stall

SAM expiring inside 90 days. DLA flags this directly; renew SAM before you apply.
Mismatched records. Company name or address differs across SAM, CAGE, the Secretary of State record or a DDTC registration. Attach the DS-2032 if your DDTC details differ.
No SPRS score, or an expired one. The assessment must be documented before you apply and less than three years old.
Wrong data custodian. An outside consultant, a temp or a shared inbox will not pass.
Unanswered analyst requests. Ninety days of silence cancels the application.
Applying for the bid in front of you. With a 120-day lead time and extended processing, the current solicitation may close first. Treat JCP as standing capability for the next one.

Canadian applicants

Canadian firms apply through the same portal with different prerequisites. DLA requires a valid NCAGE code and either an active Controlled Goods Program registration or completion of DLA's handling training. Canadian firms that will work with U.S. industry, subcontract on a U.S. government contract, prime to the U.S. government or request DEV also need SAM registration and a NIST SP 800-171 assessment. A Canadian manufacturer that does not need export-controlled data needs only the NCAGE code. Questions go to Public Services and Procurement Canada's JCP contact listed on DLA's page.

Which kind of help fits a JCP applicant

If you need — Provider category — Start here
If you need	Provider category	Start here
A defensible SSP, score and POA&M before you apply	NIST SP 800-171 or CMMC readiness consultant	NIST 800-171 consultant
A controlled place to keep restricted drawings	CUI enclave or GCC High provider	CUI enclave providers
Ongoing IT plus compliance	Managed service provider	CMMC provider categories
Free help with SAM, CAGE and the JCP portal	APEX Accelerator	APEX Accelerator CMMC help

DLA itself points applicants to APEX Accelerators for no-cost help with registration. For the security work behind the score, our CMMC consultant hub compares paid options. Find My CMMC Path is free; we may receive a referral fee from providers, and providers can't pay for placement in a recommendation.

Match my company with help for JCP and SPRS

DD Form 2345 and JCP certification: FAQ

What is DD Form 2345?

DD Form 2345 is the certification a U.S. or Canadian company files to receive unclassified technical data with military or space application that DoD withholds from public release under DoD Directive 5230.25. DLA's Joint Certification Program reviews it, and you apply through DLA's online JCP portal.

Do I need a NIST SP 800-171 score in SPRS to get JCP certified?

Yes, for U.S. applicants. DLA's JCP page says a NIST SP 800-171 assessment must be documented in SPRS before you apply and must be renewed every three years. Some Canadian applicants are exempt depending on why they need the data.

Is there a minimum SPRS score for JCP?

DLA's JCP page doesn't list one. It requires the assessment to be documented in SPRS. Any score you post should match your system security plan, because the government can verify it through a Medium or High Assessment.

How long does JCP certification take?

Plan for at least 120 days. DLA says to start an initial application at least 120 days before you need the certification, and as of November 11, 2026 it warns that processing times are extended and applications are handled in the order received.

How long is a JCP certification valid?

Five years. DLA asks you to start the renewal at least 120 days before it expires. Your NIST SP 800-171 assessment in SPRS lasts only three years, so you will need to update it during the certification period.

Does JCP certification replace CMMC?

No. JCP shows you are eligible to receive export-controlled technical data. CMMC status shows you meet the security requirements a contract requires. A solicitation can require both, and the CMMC status is checked in SPRS separately.

Does the CMMC Phase 2 suspension change the JCP requirements?

No. The July 13, 2026 memo limited solicitations to CMMC Level 1 (Self) or Level 2 (Self) and kept DFARS 252.204-7012 in effect. DLA's JCP page still lists the NIST SP 800-171 assessment in SPRS as a prerequisite.

What is the difference between JCP and DEV?

A standard JCP certification allows access to export-controlled technical data for your certified purpose. DLA Enhanced Validation is an extra HQ DLA approval needed for cFolder data in DIBBS. It requires an approved DD Form 2345, a DIBBS account with TDMT enabled and a business need tied to a DLA solicitation, contract or approved R&D project.

Can a consultant be our data custodian?

No. DLA says to avoid outside third parties, temporary staff and shared mailboxes. The custodian should be an employee tied to the certified CAGE location. A consultant can help you prepare the SPRS assessment and the application.

What happens if our company moves or our data custodian leaves?

You must file a revision in the JCP portal within five business days of the change. DLA treats a DD Form 2345 with inaccurate information as invalid and subject to suspension.

What we verified

On November 11, 2026 we opened each primary source linked on this page: DLA's Joint Certification Program page, DoD Directive 5230.25, the SPRS NIST SP 800-171 page, DFARS 252.204-7012, 252.204-7019 and 252.204-7020, 32 CFR 170.16, 170.21 and 170.24 on eCFR, the July 13, 2026 suspension memo, the DoD CIO CMMC page, two CUI Registry categories, NIST SP 800-171 Rev 2 and Rev 3, and the CMMC final rule cost estimates. DLA updates its JCP page and processing notices without notice; check the live page before you apply.