Blog · Technical Data

The 120-Day Problem: Sequencing JCP Certification Before the DLA Solicitation Drops

Chris A. Grable · October 5, 2026

A machine shop sees a DLA solicitation for a part it can make. The technical data package carries a distribution statement other than A, and the notice points offerors to the Joint Certification Program (JCP). For that bid, the shop is usually already too late. DLA advises starting a JCP application at least 120 days before certification is needed, and its enhanced validation adds a headquarters review on top. A firm that wants to bid restricted parts work has to treat certification as standing infrastructure, built before any particular opportunity appears. This post lays out the sequence UDC recommends, using DLA's process as the example.

Before you start: confirm that you need it

Many simple supply bids never require more than publicly releasable data. Distribution Statement A material needs no certification, although DLA still delivers it through a controlled portal. That means SAM registration and a CAGE code, an account in AMPS, a DIBBS account, and access to TDMT, the system that replaced cFolders on 22 June 2026. DLA requires the same email address in AMPS, DIBBS and Okta, so pick one unique, unshared address and use it everywhere. If every drawing you need carries Statement A, stop there.

Restricted data is common for manufactured items and repairs. If that is your market, continue in the order below. Each step feeds the next.

The sequence

Clean up SAM.gov. The registration must be active and must not expire within 90 days of the JCP filing. Reconcile NAICS codes: DLA returns applications from firms that call themselves non-manufacturers while listing manufacturer codes. Make sure the legal name, address and state of organization match across SAM, the CAGE record and state business records, because a later step depends on it.
Build the System Security Plan, then post a NIST SP 800-171 assessment in SPRS. DLA requires a posted assessment from every JCP applicant, including firms that have begun or completed a CMMC assessment. Use Revision 2 and its 110 requirements, the version CMMC Level 2 uses. Track open items in a Plan of Action and Milestones with real dates, and calendar a new assessment every three years.
Name a Data Custodian and complete the training. DLA looks for an employee tied to the certified location of the CAGE code, not an outside party or a temp. Complete the export-control handling training and keep its Certification Statement of Export Control Compliance, which uploads with both applications.
File the DD Form 2345 through the JCP Portal. Upload a Secretary of State record for the state of incorporation listed in SAM, dated within 12 months, showing the entity active or in good standing. Have the signature page executed by someone with authority to obligate the firm to a government contract. If TDMT access is the goal, request the enhanced validation in this same application.
Complete DLA Enhanced Validation (DEV). DEV requires a documented business need tied to a DLA solicitation, contract or approved R&D project, and an enabled TDMT account. It passes through JCP Office review, HQ DLA Legal review and a trade security control assessment before HQ DLA grants access.

Two administrative rules end applications that were otherwise sound. DLA cancels an application automatically if a JCP analyst's request goes unanswered for 90 days. And as of 4 October 2026, DLA reported extended processing times, working applications in the order received.

Keeping it once you have it

Certification runs on several clocks. JCP lasts five years. DEV lasts three, and the JCP term does not extend it. A change in entity name, CAGE site, signatory or Data Custodian requires a JCP revision within five business days. DLA disables JCP Portal accounts not used within 35 days. Firms that declared DDTC registration must keep it active for the whole five-year term. Set reminders for all of them.

What certification does not do

JCP is corporate eligibility. It does not authorize release to any individual, and export-control law still governs foreign persons on your own staff. It does not override the distribution statement, export restrictions or any controlling-office approval on a particular document. It does not make a contract's safeguarding clause go away: once a contract carries DFARS 252.204-7012, its 72-hour incident reporting and flowdown duties apply.

Some barriers no certification cures. A restrictive rights legend limits the government's own license in the data. An Acquisition Method Code or Suffix Code describes a sourcing condition for the item. A source-control drawing restricts approved sources. Each is a separate question, and the remedies differ: a source approval request, an alternate offer, qualification testing or a negotiation for more data rights.

The paper's author has watched capable small fabrication firms decide to pursue DLA parts work and walk away once they met this process. In his view, a firm with suitable opportunities generally recovers the investment in dollar terms, but the time and attention it absorbs are real costs.

Public sources

The paper behind this post cites these public documents, among others.

The full roadmap covers all four access tiers, what the September 2026 DFARS Part 240 deviation changed about assessments, where CMMC stands after the July 2026 suspension, and a calendar of every recurring obligation.

Accessing Defense Technical Data: A Tiered Roadmap from Public Release to Classified

See what is in the paper