Contractors preparing their first bid on a DoD contract often run into a requirement that has nothing to do with the item itself: JCP certification. If a drawing, specification, or technical data package is marked export-controlled, you can’t legally receive it without one. Here’s what the Joint Certification Program actually is and how to tell if it applies to you.
What JCP Is
The Joint Certification Program is a joint U.S. and Canadian effort, administered by the Defense Logistics Agency, that certifies private-sector contractors to receive unclassified, export-controlled technical data from the Department of Defense and the Canadian Department of National Defence. This isn’t a security clearance — it’s a certification specific to handling Militarily Critical Technical Data, the drawings, specifications, and engineering data DoD restricts from open release.
Without an active JCP certification, a contracting officer or prime contractor can’t legally hand over that data, even if you’ve already won the contract.
Who Actually Needs It
JCP applies specifically to companies that need technical data — not every DoD contractor needs it. You likely need JCP certification if:
- A solicitation or contract references a technical data package, drawing, or specification marked with export-control distribution statements (commonly Distribution Statement B through F)
- You’re manufacturing to a government-furnished drawing rather than your own design
- A prime contractor has told you they can’t share technical data until you’re JCP-certified
- You’re bidding on items where traceability and source verification already point to controlled technical requirements
If your item is built entirely to your own commercial design with no government-furnished technical data involved, JCP usually isn’t a factor. The trigger is the data, not the contract itself.
Eligibility and What’s Required
To qualify, your organization needs to be a legitimate U.S. or Canadian private-sector entity with an active SAM registration and CAGE (or NCAGE) code — the same foundational registrations that underpin most other government contracting requirements. Program updates have also added a documentation requirement: applicants now need to have completed a NIST 800-171 self-assessment and calculated a Supplier Performance Risk System (SPRS) score before certification is granted, reflecting DoD’s broader push on cybersecurity readiness alongside export control.
As of 2026, applications go through DLA’s public web portal only — email, fax, and mailed applications are no longer processed, so getting the online application right the first time matters more than it used to.
Where This Trips Contractors Up
- Assuming JCP is automatic once you have SAM and CAGE registration — it’s a separate application with its own approval timeline
- Waiting until a prime contractor asks for the technical data to start the JCP application, instead of applying proactively before bidding on data-dependent work
- Not having the NIST 800-171 assessment and SPRS score ready, which stalls the application at the documentation stage
- Confusing JCP with a personnel security clearance — it’s an organizational certification tied to your CAGE code, not an individual credential
The Short Version
JCP certification is what lets a contractor legally receive export-controlled technical data from DoD — required specifically for contracts built to government-furnished drawings or specifications, not for every DoD contract. Getting the SAM/CAGE registration, NIST 800-171 assessment, and SPRS score in place before you apply keeps the certification from becoming the bottleneck between winning a bid and actually starting the work.