A certified DD Form 2345 records Joint Certification Program certification. A solicitation may require it before releasing unclassified export-controlled technical data. The form alone does not establish that you can open every restricted drawing package: read the buyer’s access instructions for the requester, delivery system, additional approvals and required evidence.
The worked access case follows a retained Navy RFQ through six source conditions, a limited review decision, open questions and the next owner’s handoff. Its company facts and decisions are fictional.
What the form establishes
DD Form 2345 is the Militarily Critical Technical Data Agreement, administered through the U.S./Canada Joint Certification Program (JCP). The certification supports access to unclassified military technical data that is unavailable to the public. It does not establish your engineering qualifications, capacity to deliver, or entitlement to a contract.
32 CFR Part 250 defines a qualified U.S. contractor and describes the policy for providing governed data for a legitimate business purpose. The regulation names neither DD Form 2345 nor a data custodian. Those operational details come from the form and JCP’s implementation guidance. Canadian applicants have separate instructions.
Find the route in your package
| Route stated by the package | Requester and destination | Conditions to check |
|---|---|---|
| Solicitation-specific delivery | Contracting office releases through the stated system, such as DoD SAFE, to the designated custodian | Current certified form, requester identity, safeguarding capability and any assessment status expressly required by the package |
| DLA DIBBS/cFolders | Supplier follows DLA’s published access process | JCP certification, DIBBS/cFolders accounts, business need and DLA Enhanced Validation approval |
| Restricted SAM.gov attachment | Requester asks for access through the document entry | The solicitation’s requester rules, JCP status and any conditional export-control or DEV requirement |
These are observed routes, not a complete catalog. A portal account and authorization to receive particular data are separate checks. The JCP and DLA Enhanced Validation comparison explains the DLA sequence.
Three packages show why the instructions matter
Hellfire adapter RFQ. Navy RFQ N6833526Q1186, issued August 25, 2026, places its drawing-access instructions on pages 2–3. It names a certified DD Form 2345, delivery to the designated custodian through DoD SAFE, and CMMC Level 2 (Self) verified in SPRS before release. Separate paragraphs use different assessment terminology at award, and the DFARS 252.204-7025 level insertion is blank. Record those inconsistencies and request clarification. Retained notice action.
Lifting cap synopsis. Navy synopsis N6339426Q4070 names an active CAGE, JCP-verified DD Form 2345 and capability to receive and store CUI securely. Its access paragraph does not name a CMMC status. This is a useful contrast with Hellfire: reproduce the condition the paragraph actually states. The source dossier contains conflicting deadlines, so no current deadline is asserted here. Retained notice action.
Engine assembly solicitation. DLA Land Warren package SPRDL1-26-R-0121, posted August 21, 2026, places the technical-package instructions on pages 11–12. The JCP-registered data custodian requests the restricted attachment through SAM.gov. DD Form 2345 and DEV language is conditional on an export-control warning. The retained solicitation does not establish whether the particular TDP carries that warning. Ask the contracting office rather than converting conditional text into a confirmed requirement. Retained notice action.
These are dated teaching examples. Each link identifies one notice action. Check SAM.gov’s notice history for later actions and amendments before acting on a requirement or deadline.
Check the form and custodian
Record the certified entity, CAGE location, certification expiration and named custodian. DLA’s guidance calls for an employee at the certified location who has authority to oversee access. A custodian change requires a certification revision. The person preparing the estimate may need to coordinate with someone else to request the package.
DLA describes a five-year certification term and advises initiating renewal at least 120 days before expiration. Treat that as application planning guidance, not a promised processing time. The page currently warns of extended processing.
Use the JCP portal guidance for the application itself. Do not email an old paper form in place of the current portal process.
Assessment evidence and the suspension notice
As read September 7, 2026, DLA’s JCP page requires U.S. applicants to post a NIST SP 800-171 self-assessment in SPRS. Its broad banner says this applies even where a CMMC assessment is complete or underway. The same page contains exceptions for some Canadian applicants. Use the applicable country instructions and ask JCP to resolve a conflict.
The page also carries the July 13 CMMC Phase II suspension notice while stating that Phase I self-assessment requirements remain in place. Its older CMMC tab contains future certification language. The pause explainer addresses that policy context. Read the actual solicitation’s release conditions separately.
Prepare for the download
Before requesting the files, identify where they will land, who may open them, and which safeguarding and export restrictions govern their use. Access approval does not settle authorization for every subsequent disclosure or system. Capture any destruction instruction that applies if you decline the pursuit or lose the award.
The receiving controlled technical data guide provides the readiness record. Use the bid eligibility checklist to decide whether the unresolved work changes the pursuit.
When the open item is compliance evidence
Deep Fathom supports evidence management and CMMC/NIST SP 800-171 workflows. If your access request depends on assessment evidence, tell our team which public requirement and deadline you are working through. We will show the relevant platform workflow. JCP and the contracting authority decide certification and access. Review bid requirements.