If your company machines parts, fabricates assemblies, or bids on Defense Logistics Agency (DLA) solicitations, you have likely heard of the Joint Certification Program
Historically, many contractors have viewed JCP as paperwork, but this is changing. It is a cybersecurity checkpoint, and it is about to get stricter.
Here is how JCP, eJCP, and NIST SP 800-171 fit together, and how to prepare.
The JCP is a U.S. and Canadian program, run by DLA's Joint Certification Office, that approves companies to receive unclassified, export-controlled military technical data. These include drawings, specifications, and technical information that the public cannot see.
To get certified, you complete the DD Form 2345 information in the JCP Portal. As part of the process, you name a Data Custodian for each CAGE code location, and attest to export-control compliance.
Approval lasts for five years. The DLA recommends contractors start the approval process at least 120 days before it is needed.
Enhanced JCP (eJCP) is now called DLA Enhanced Validation, or DEV. It is a second, stricter validation that unlocks cFolders, where DLA stores technical data tied to active solicitations on DIBBS.
Contractors will need an approved JCP certification first, though both applications can be filed together. DEV lasts three years and adds legal review, location verification, and final approval at DLA headquarters.
Both programs intersect with NIST SP 800-171. Before applying, you must complete a self-assessment of the 110 security requirements and post your score in SPRS (Supplier Performance Risk System).
Scores run from 110 down to -203, and the assessment must be less than three years old. A missing or stale SPRS entry is one of the most common reasons applications stall.
JCP governs access to export-controlled technical data, and much of that data is Controlled Unclassified Information (CUI). The two aren’t interchangeable, though. CUI handling and CMMC requirements come from your contracts, not from JCP access itself. When a contract involves CUI, it typically calls for CMMC Level 2, which is built on the same 110 NIST SP 800-171 requirements.
The difference is rigor. A self-assessment lets you score yourself. A CMMC Level 2 assessment checks all 320 assessment objectives in NIST SP 800-171A, and a requirement only counts as met when every objective behind it is satisfied. Scores that look healthy in SPRS often drop under that scrutiny.
DLA has said renewing JCP applicants will eventually need C3PAO certification. Though the DoW paused CMMC Phase 2 in July 2026, building to Level 2 now keeps you ready either way.
💡 Something to Watch For: Though the program is currently under review, the DLA's stated plan is to require CMMC Level 2 C3PAO certifications in the future.
The same benefits of a CMMC enclave helps with JCP. Instead of bringing your whole network up to Level 2, you keep JCP technical data, and the people who use it, inside one secure, isolated environment.
A smaller scope means fewer systems to assess, faster remediation, and lower cost. We offer a few enclave solutions for Microsoft 365 (GCC / GCC High) and Google Workspace, so you can protect CUI without rebuilding your entire IT setup.
MNS Group supports the full path, from your first SPRS score and certification through ongoing program management:
NIST SP 800-171 gap assessments
SSP and POA&M development
CUI enclaves for Microsoft (MNS Group Enclave, GCC / GCC High) and Google (SecureCMMC℠) environments
Certification: CMMC Level 2 certification assessments as an authorized C3PAO.
Whether you're filing your first DD 2345, applying for DEV access, or planning a JCP renewal, the safest move is to build to the CMMC standard now. Talk to MNS Group about a readiness assessment.