DD Form 2345 and the Joint Certification Program, explained

The Joint Certification Program (JCP) is the process by which a U.S. or Canadian contractor becomes eligible to receive unclassified military technical data that the Department of Defense (DoD) withholds from the public. The Defense Logistics Agency (DLA) runs it, according to the DLA program page as captured in August 2026. The application is DD Form 2345, the Militarily Critical Technical Data Agreement. The edition is dated October 2022, updated August 10, 2026.

Where the requirement comes from

The policy is DoD Directive (DoDD) 5230.25, dated November 6, 1984 and incorporating Change 2 of October 15, 2018. The directive covers unclassified technical data with military or space application that may not be exported lawfully without an approval, authorization, or license. The directive limits its reach to data that disclose "critical technology." The rules are also codified in the Code of Federal Regulations (CFR) at 32 CFR Part 250, which carries a source date of December 10, 1984.

Paragraph 4.3 makes it DoD policy to provide such data to currently qualified U.S. contractors when the data relate to a legitimate business purpose for which the contractor is certified. Paragraph 6.1.9 establishes the form under a slightly different title, "Military Critical Technical Data Agreement." Paragraph 6.1.5 calls for periodic renewal of certifications without setting a period.

The tie to markings is in DoD Instruction 5230.24, dated January 10, 2023. Paragraph 4.3.e.(1) says export-controlled technical information marked with Distribution Statement C or D is not distributed outside the Government, or to contractors, without first verifying a current, valid DD Form 2345.

What a qualified contractor certifies

Paragraph 3.2 of the directive defines a qualified U.S. contractor by six certifications:

• The person who receives the data for the contractor is a U.S. citizen or lawful permanent resident and is located in the United States.
• The data are needed to bid or perform on a Government contract, or for another legitimate business purpose. A footnote says no Government contract or grant is required.
• The contractor acknowledges its export control duties, including the possible need for a license before release within the United States.
• The contractor will not give access to anyone other than its employees or persons acting on its behalf without permission of the DoD Component that provided the data, unless the directive allows it.
• The contractor knows of no employee with access who is debarred, suspended, or otherwise ineligible, or who has violated export control laws.
• The contractor itself is not debarred, suspended, convicted of export control violations, or disqualified.

A footnote extends qualification to Canadian contractors, for data that need no license for export to Canada, through an equivalent certification. Block 5 of the form restates the six items and adds Canadian law and Canada's Technical Data Control Regulations (TDCR).

What the form asks

Block 1 marks the submission as initial, revision, or renewal. Block 2 gives the entity name, which must match the CAGE (Commercial and Government Entity) registry, plus a physical address and a mandatory CAGE code. Block 3 names a primary data custodian and optional alternate. Block 4 describes the business activity, with no attachments allowed. The instructions list ten points for block 4, including whether the work relates to the U.S. Munitions List or the Commerce Control List, and whether the firm is registered with the Directorate of Defense Trade Controls. A person with authority to obligate the entity signs block 6, and for U.S. contractors the form cites 18 U.S.C. 1001 on false statements.

Block 7 is for the JCP office. Approval assigns a certification number and expiration date. The number, with a statement of intended use, must accompany each request for data.

Two 2025 Federal Register notices on the form disagree on burden. The July 25 notice estimates 8,000 respondents at 20 minutes each, or 2,667 hours. The September 26 notice estimates 9,000 respondents at 1 hour each, or 9,000 hours, matching the form's own 1-hour estimate.

Who runs it and how long it lasts

Applicants apply through DLA's portal. They need an active System for Award Management (SAM) registration and a CAGE code (U.S.) or North Atlantic Treaty Organization CAGE (NCAGE) code (Canada). U.S. applicants also need a cybersecurity assessment under National Institute of Standards and Technology (NIST) Special Publication 800-171, posted in the Supplier Performance Risk System. The page says the assessment is valid for 3 years and is not required of all Canadians.

The page refers to a 5-year certification. Renewal should start at least 120 days before expiration. Certified entities must file a revision within 5 business days of a change, and a form with inaccurate information is considered invalid, subjecting the entity to suspension.

The page and the form disagree on submission. The form's instructions, updated August 10, 2026, say to email it to the JCP office as a PDF. The page, captured August 29, 2026, says the office no longer accepts emailed forms and that all documents go through the portal.

On the Canadian side, the TDCR describe a Joint Certification Office jointly staffed by the United States and Canada, addressed in Battle Creek, Michigan. Section 7(4) sets a Canadian certification at five years from acceptance unless revoked.

What to check

• Does the entity's DD Form 2345 show an approval, a certification number, and an expiration date in block 7?
• Is the certification inside its 5-year period, with renewal started 120 days ahead?
• Does each data request carry the certification number and a statement of intended use?
• Is the requested data reasonably related to the block 4 business activity?
• Was any change to name, location, custodian, or signer filed as a revision within 5 business days?
• Before Statement C or D export-controlled data left the Government, was a current, valid DD Form 2345 verified?

Azcuna's TRACE is one offline viewer for S1000D, MIL-STD-3001 XML, and PDF technical manuals. It keeps the source location and the markings of everything it shows and never modifies the source. It was proposed to NAVAIR under Navy SBIR Phase I topic DON26BZ05-NV078, and the proposal was submitted on September 23, 2026.

Sources

1. 1Joint Certification Program (JCP) · Defense Logistics Agency (dla.mil page captured August 29, 2026, Internet Archive)
2. 2DD Form 2345, Militarily Critical Technical Data Agreement (OCT 2022, updated 20260810) · DoD Forms Management Program (esd.whs.mil copy captured August 16, 2026, Internet Archive)
3. 3DoD Directive 5230.25, Withholding of Unclassified Technical Data From Public Disclosure (November 6, 1984, incorporating Change 2, October 15, 2018) · Office of the Under Secretary of Defense for Research and Engineering (esd.whs.mil copy captured October 8, 2026, Internet Archive)
4. 432 CFR Part 250 - Withholding of Unclassified Technical Data From Public Disclosure · Electronic Code of Federal Regulations
5. 5DoD Instruction 5230.24, Distribution Statements on DoD Technical Information (January 10, 2023) · Office of the Under Secretary of Defense for Research and Engineering (esd.whs.mil copy captured October 8, 2026, Internet Archive)
6. 6Proposed Collection; Comment Request (DD Form 2345, OMB Control Number 0704-0207) · Department of Defense, Federal Register (July 25, 2025)
7. 7Submission for OMB Review; Comment Request (DD Form 2345, OMB Control Number 0704-0207) · Department of Defense, Federal Register (September 26, 2025)
8. 8Technical Data Control Regulations (SOR/86-345) · Government of Canada, Justice Laws Website (current to September 30, 2026)

Where this shows up in our work

• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.