Air Force ITAR D2P2 compliance execution signals
Higher score = stronger ITAR D2P2 compliance posture before proposal day.
What ITAR control means in a program
When a BAA solicitation carries an ITAR (International Traffic in Arms Regulations) marking, the program technical content is export-controlled. Only U.S. persons and U.S.-controlled entities certified through the Joint Certification Program (JCP) — using DD Form 2345 — may receive the controlled material. The publicly available 2026 DoD SBIR BAA states the requirement in this form: "a complete and fully certified DD Form 2345... or evidence of application submission" must be included with timely proposal submission for any program involving export-controlled data, with that evidence carried in Volume 5 of the proposal.
Compliance-mechanics work: DD Form 2345, JCP enrollment, Volume 5 evidence, U.S.-person definition under 22 CFR 120.62. The public BAA states the requirement; the offeror must execute against it on time.
The DD-2345 path in 2026
DD-2345 enrollment runs through the Joint Certification Program (JCP) administered by the Defense Logistics Agency. The 2026 path is portal-only: applications are submitted through public.dacs.dla.mil/jcp/ext, and email or fax submissions are no longer accepted per DLA guidance issued in 2026. The published JCP enrollment requirements include a current SAM.gov registration, a current CAGE code, an authorized representative with signature authority, and a statement of why the certification is needed (typically the unclassified BAA citation).
Processing time is published in DLA guidance and is variable. Public DLA documentation describes a target processing window measured in weeks, not days, and the actual time depends on the completeness of the submission and the JCP office's queue. Common rejection reasons in the published DLA guidance include: incomplete signature authority documentation, expired SAM.gov registration, mismatched legal entity name across SAM and the application, and unclear statement of need.
Offerors who wait until the proposal deadline to begin DD-2345 enrollment are routinely surprised by the timeline; those who enroll well in advance avoid the surprise. The honest planning rule from the published case studies is to begin DD-2345 enrollment as soon as the offeror has any plausible reason to expect ITAR-controlled work in the pipeline, not when the specific solicitation drops.
Volume 5 evidence
The Volume 5 evidence requirement, per the published 2026 BAA, can be satisfied either by a copy of the certificate (if approval has been received) or by evidence of the application's submission (if approval is pending). The BAA text — quoted verbatim, "a copy or evidence of application submission" — is permissive on form, but reviewers read evidence as more credible the more specific it is.
Offerors who treat Volume 5 as a checkbox often produce evidence that is technically compliant but unhelpful to reviewers. Evidence that includes the application date, the application reference number assigned by JCP, and a clear statement of expected processing time supports faster review. A screenshot of the JCP portal confirmation, with the timestamp visible, is a stronger artifact than a self-written attestation.
The published practitioner advice converges on three Volume 5 patterns that work: (1) the certified DD-2345 itself, scanned in full; (2) the JCP portal submission confirmation with reference number; (3) a clearly dated cover letter from the offeror's authorized representative attesting that the application has been submitted and naming the reference number. Volume 5 that lacks any of these and substitutes a generic compliance letter is read as inexperience.
Foreign nationals and key personnel
ITAR-controlled programs constrain who on the offeror's team can access the program-controlled material. The proposer is responsible for documenting that all key personnel and team members with access are U.S. persons as defined by 22 CFR 120.62 — U.S. citizens, lawful permanent residents, or specified protected individuals. The published guidance is specific, and the State Department's Directorate of Defense Trade Controls (DDTC) has issued multiple advisories on the documentation expected.
The deemed-export rule means that allowing a non-U.S. person on the team to access controlled technical data is itself an export, regardless of whether anything physically leaves the country. Offerors who are not careful about subcontractor and consultant access — including academic collaborators, foreign-national graduate students at university partners, and contract engineers — create avoidable compliance issues. A documented technology control plan (TCP) that names the access list and the procedures for adding to it is the published best practice.
For software-first firms specifically, source-code access is technical data; cloud-development environments need to enforce U.S.-person-only access; and any AI/ML pipeline that includes ITAR-controlled training data needs the same treatment. Offerors who can describe their TCP in a few sentences during a debrief — what's controlled, who can see it, how access is logged — are read as compliant; offerors who treat the TCP as a future deliverable are not.
Direct-to-Phase-II specifics
Direct-to-Phase-II programs, including the ITAR-controlled subset, are larger awards with more compressed timelines than Phase I-then-Phase-II paths. The published evaluation criteria emphasize prior work that demonstrates the offeror has already done the equivalent of Phase I — published guidance describes the D2P2 prior-work demonstration as roughly equivalent in scope and rigor to a completed Phase I.
For ITAR-controlled D2P2 programs specifically, the prior work itself often touches export-controlled material; the offeror needs to be ready to document the relevant history in unclassified, ITAR-compliant form. The disciplined pattern is to maintain two parallel write-ups of any technical work: a controlled internal version with the full detail, and an unclassified summary that conveys scope and rigor without controlled content. Offerors who only have the controlled version arrive at the proposal moment without the artifact reviewers need.
The compressed timeline of D2P2 also means that compliance artifacts cannot be generated reactively. DD-2345 enrollment, TCP documentation, key-personnel U.S.-person documentation, and the Volume 5 evidence package all need to be staged before the solicitation drops. Offerors who treat the compliance package as a parallel workstream, with its own owner and its own deadlines, finish the proposal cycle compliant; offerors who treat it as a final-week task often do not.
Compliance posture in public
An offeror's public posture on ITAR compliance is itself a credibility signal. Public statements that demonstrate familiarity with the actual mechanics — DD-2345 portal-only path, Volume 5 evidence text quoted verbatim, JCP processing realities, the 22 CFR 120.62 U.S.-person definition — are read by reviewers as a sign that the offeror has done this work before. Public statements that are vague or factually wrong have the opposite effect.
The published reviewer experience, including comments in Air Force SBIR debriefs and the broader DoD SBIR community of practice, repeatedly emphasizes that compliance posture is one of the cheapest ways to signal experience and one of the cheapest ways to signal inexperience. A small firm with a one-page compliance summary on its website that quotes DDTC and DLA guidance correctly is read very differently from a small firm that handwaves at "ITAR-aware engineering."
Software-first small businesses that treat ITAR compliance as a research engineering problem, not an after-thought, perform better on ITAR-controlled programs. The discipline is the same as the technical discipline — documented procedures, audit-grade records, and a clear statement of what's in scope and what's out — applied to the compliance lane rather than the algorithm lane.
Concept terms in this compliance lane
DD Form 2345. The form used to enroll a U.S. person or entity into the Joint Certification Program; in 2026 the path is portal-only via public.dacs.dla.mil/jcp/ext.
Volume 5. The proposal volume in which DD-2345 evidence — certificate or application-submission evidence — must be carried, per the 2026 DoD SBIR BAA.
U.S. person. The ITAR-defined access category that constrains which key personnel, subcontractors, consultants, and academic collaborators can see program-controlled material.
ITAR-Controlled Direct-to-Phase-II — From Eligibility to Award
Compliance checklist
- Direct-to-Phase-II eligibility confirmed in BAA
- Prior Phase-I-equivalent work documented in unclassified, ITAR-compliant form
- DD Form 2345 certificate or application-submission evidence carried in Volume 5
- Foreign-national exposure on team and subcontractors declared
- Technology Control Plan covers design, build, test, and delivery phases
- Transition sponsor identified inside the relevant program office
Common questions on the public-record framing
What does the 2026 BAA say verbatim about Volume 5?
The 2026 DoD SBIR BAA states the requirement: 'a complete and fully certified DD Form 2345... or evidence of application submission' must be included with timely proposal submission for any program involving export-controlled data, with that evidence carried in Volume 5 of the proposal.
How is the JCP path different in 2026 from prior years?
Portal-only at public.dacs.dla.mil/jcp/ext. Email, fax, and mailed applications are no longer accepted. Processing time is variable and not formally guaranteed.
What constitutes a U.S. person under ITAR?
22 CFR 120.62 defines U.S. persons. Foreign nationals on staff, including consultants and academic collaborators, must be tracked and excluded from controlled material access.
What does this article not cover?
Specific ITAR-controlled program technical content, specific solicitation language under embargo, or any Precision Federal solution to any controlled program.
Frequently asked questions
Per the publicly available 2026 DoD SBIR BAA, either a complete and fully certified DD Form 2345 or evidence of the application's submission must be included with timely proposal submission, carried in Volume 5.
The 2026 path is portal-only through public.dacs.dla.mil/jcp/ext, administered by DLA's Joint Certification Program. Email and fax submissions are no longer accepted.
It is the ITAR-defined access category that determines who on the offeror's team can see program-controlled material. Offerors are responsible for documenting that all key personnel and team members with access meet the definition, including subcontractors, consultants, and academic collaborators.
D2P2 awards are larger and more compressed than Phase I-then-Phase-II paths, and evaluation emphasizes prior work that demonstrates Phase-I-equivalent capability. For ITAR-controlled D2P2 programs, that prior work often touches export-controlled material and must be documentable in unclassified, ITAR-compliant form.
About this article
Precision Federal writes public technical commentary on problem classes adjacent to the programs our firm engages. The point is to demonstrate that the principal investigator has read the literature and respects the line between public technical thinking and proprietary or sensitive program content. We are a software-only SBIR firm, principal-investigator-led, and we ship under Phase I and Direct-to-Phase-II SOWs. If a public article like this one is useful to your work, we welcome the conversation.