Accessing Defense Technical Data: A Tiered Roadmap from Public Release to Classified

Four controls, one drawing

Who may receive a document, whether it may go to a foreign person, how it must be protected, and what the government may do with it are four different questions under four different authorities. A JCP certificate answers part of the first. It says nothing about the rights legend, and nothing about a contract's safeguarding clause.

The rules also changed in 2026. DLA retired cFolders for TDMT in June, the Department suspended the CMMC Phase II transition in July, and a September class deviation replaced the clause carrying the NIST SP 800-171 assessment requirement with one that does not reproduce its pre-award condition.

What the paper answers

• Which accounts does a firm need to reach publicly releasable DLA technical data?
• What has to be in place, and in what order, before a JCP application and DLA Enhanced Validation will clear?
• At what point does a solicitation or contract turn restricted data into a safeguarding obligation under DFARS 252.204-7012?
• What did clause 252.240-7997 keep from 252.204-7019 and -7020, and what did it drop?
• Why can a firm not start a facility clearance on its own?
• When a package will not release, how do you tell a rights problem from a sourcing or source-control problem?

What's inside

• Four questions to answer about any document before deciding which tier applies.
• Checkbox action lists for each tier, from AMPS and TDMT setup through the DD Form 2345, DEV, NIST SP 800-171 posting and facility clearance sponsorship.
• Two worked examples: a bid team handling a restricted DLA drawing before award, and a small subcontractor receiving a prime's covered defense information.
• A calendar table of standing obligations, from annual SAM renewal to the 35-day JCP Portal login rule.
• Four notes from the author on why capable small firms give up and whether certification repays its cost, with 29 references to public sources.

Current through the 2026 changes

The roadmap reflects:

• TDMT phase one, which replaced cFolders on 22 June 2026
• The 13 July 2026 suspension of the CMMC Phase II transition
• Class Deviation 2026-O0025, Revision 3, of 3 September 2026, and clause 252.240-7997

Who it's for

• Manufacturers, machine shops and repair firms bidding DLA parts and repair work.
• Small businesses deciding whether JCP, DEV or CMMC investment is worth making.
• Subcontractors receiving technical data or covered defense information from a prime.
• Capture and contracts staff who must read a solicitation for safeguarding and assessment clauses.

About the author

Chris A. Grable is founder and CEO of Up Doppler Consulting LLC, a Veteran-Owned Small Business in Leonardtown, Maryland. A Navy veteran with more than 45 years in DOW operations and acquisition, he retired from federal service as Senior Experiment Designer at the Naval Air Warfare Center Aircraft Division. UDC helps technology companies find, shape and win DOW work.