Defence supply chain
If a defence contract asks you to attest to CPCSC Level 1, these are the 13 things you are attesting to. Here is what each one asks, the evidence to keep, and a five-minute check you can run before you sign.
Who this applies to
Level 1 protects Specified Information: sensitive but unclassified Government of Canada information that a contract says you must safeguard on your own systems. That can include contract details not meant for public release, controlled goods information and Protected information.
Not every defence contract will require it. Commercial off-the-shelf purchases, for example, may not. The contract tells you. If you sell to National Defence, to a defence prime, or bid through CanadaBuys on defence work, assume it is coming.
The 13 controls at a glance
| # | Control | ITSP.10.171 ID | Family |
|---|---|---|---|
| 1 | Account management | 03.01.01 | Access control |
| 2 | Access enforcement | 03.01.02 | |
| 3 | Use of external systems | 03.01.20 | |
| 4 | Publicly accessible content | 03.01.22 | |
| 5 | User identification and authentication | 03.05.01 | Identification and authentication |
| 6 | Device identification and authentication | 03.05.02 | |
| 7 | Multi-factor authentication | 03.05.03 | |
| 8 | Media sanitization | 03.08.03 | Media protection |
| 9 | Physical access authorizations | 03.10.01 | Physical protection |
| 10 | Physical access control | 03.10.07 | |
| 11 | Boundary protection | 03.13.01 | System and communications protection |
| 12 | Flaw remediation | 03.14.01 | System and information integrity |
| 13 | Malicious code protection | 03.14.02 |
What each control asks, and the evidence to keep
Level 1 does not need a formal security programme. It needs short written rules, applied consistently, and records that show they are applied. The government's guidance asks you to keep evidence for your attestation cycle, or at least one year.
1. Account management 03.01.01
What it asks: know every user account and what it can reach. Create accounts when people join, change them when roles change, disable them promptly when people leave. Avoid shared and generic logins.
Evidence: an account register (name, role, systems, created, changed, disabled) and a dated record of at least quarterly reviews.
2. Access enforcement 03.01.02
What it asks: people get only the access their job needs. Administrator rights are rare and deliberate. Access is granted by group, not one person at a time.
Evidence: a list of access groups and who is in each, the list of admin accounts, and notes from access reviews.
3. Use of external systems 03.01.20
What it asks: government information is handled only on systems you have approved. No personal email, personal cloud storage or personal devices for contract work. You know where your cloud providers keep the data.
Evidence: a one-page approved systems list, onboarding material that tells staff what they may use, and what your cloud vendors told you about data location.
4. Publicly accessible content 03.01.22
What it asks: nothing sensitive goes on your website, social media, press releases or sales material. Someone checks before it is published.
Evidence: a named reviewer, a short pre-publication checklist, and occasional checks of what is already public.
5. User identification and authentication 03.05.01
What it asks: everyone has their own login, passwords are strong, and screens lock when left idle.
Evidence: your password rule, screen-lock settings (the guidance suggests 15 minutes on laptops, 5 on phones), and password manager use where relevant.
6. Device identification and authentication 03.05.02
What it asks: only devices you have approved can connect to your network and systems.
Evidence: a device inventory (owner, type, model, asset number, approval date) and the setting that blocks unknown devices on Wi-Fi or USB.
7. Multi-factor authentication 03.05.03
What it asks: at Level 1, MFA on privileged accounts and on any system that stores Specified Information. An authenticator app is preferred over SMS.
Evidence: screenshots of the MFA configuration and a written recovery process for a lost device.
8. Media sanitization 03.08.03
What it asks: drives, laptops, phones, USB keys and printers are securely wiped, or destroyed, before they leave your hands.
Evidence: a disposal log: what went, how it was wiped or destroyed, where it went and when.
9. Physical access authorizations 03.10.01
What it asks: you know who holds keys, badges or codes to areas where Specified Information is kept, and you take them back when people leave.
Evidence: a key and badge register with expiry dates for contractors and visitors.
10. Physical access control 03.10.07
What it asks: locks or keycards on the right doors, visitors signed in and escorted, printed material locked away rather than left on desks or printers.
Evidence: visitor logs and a description of where printed Specified Information is stored.
11. Boundary protection 03.13.01
What it asks: a firewall or router controls traffic in and out, unnecessary inbound connections are blocked, and public-facing systems are kept apart from internal ones.
Evidence: firewall settings or screenshots and a simple log of network changes.
12. Flaw remediation 03.14.01
What it asks: operating systems, browsers and software are kept up to date, and critical patches go on quickly once you know about them.
Evidence: automatic updates switched on, a log of major updates on key systems, and the vendor advisories you subscribe to. This is the control most often answered with "we think so". Our Emergency Desk gives you a dated record of each critical alert and what you did about it.
13. Malicious code protection 03.14.02
What it asks: reputable anti-malware on every device, updating itself and scanning in real time, with threats dealt with when they appear.
Evidence: the product in use (Microsoft Defender counts), scan settings, and a record of incidents and how they were resolved.
Free self-check: could you sign it honestly today?
Thirteen questions, one per control. Answer for the systems that would hold the contract's information. Nothing you select is stored or sent anywhere; it stays in your browser and disappears when you close the page.
This is not the government's self-assessment tool and it does not produce an attestation. It tells you whether you are ready to complete the real one.
After the self-assessment: what the government expects
- Complete the annual self-assessment, ideally with the government's online tool. You may attest without it, but the tool's guidance is useful, and with your evidence ready it takes under an hour.
- Save or print the results page. It shows an expiry date.
- Record the result and expiry date in your CanadaBuys supplier profile. You need an active CanadaBuys account if you bid on or hold contracts that require Level 1.
- Keep the results and your evidence. Nobody checks them on the way in; they matter if anyone asks later.
Already certified under CMMC?
Canada and the US use the same technical controls. The Government of Canada may accept a valid CMMC certification case by case, once it has confirmed the assessment covers the required scope, and may still verify specific controls. If you have done CMMC work for US customers, much of your Level 1 evidence should already exist.
Level 1 is the floor, not the destination
Level 2 covers 98 controls, assessed externally every three years by a body accredited through the Standards Council of Canada, and is expected in select contracts handling controlled defence information from spring 2027. Level 3 is assessed by National Defence and has no published start date. A Level 1 attestation that is generous with the truth becomes a gap list at Level 2.
Where we fit, and where we do not
We are not a certification body and cannot certify you at any level. Level 1 is your own attestation. What we offer is an independent CPCSC readiness assessment: a dated report, control by control, showing what is in place, the evidence behind it and what is missing, plus a one-page board summary. If we assess you, we do not sell you the fix.
Questions we are asked
What are the 13 CPCSC Level 1 controls?
Account management, access enforcement, use of external systems, publicly accessible content, user identification and authentication, device identification and authentication, multi-factor authentication, media sanitization, physical access authorizations, physical access control, boundary protection, flaw remediation and malicious code protection. All 13 come from ITSP.10.171.
Is CPCSC Level 1 a certification?
It is the first level of the certification programme, but you achieve it by self-assessment and attestation. No auditor visits. That is why you should be able to show the evidence for every answer.
When do I need it?
Only when a contract requires it. Level 1 is appearing in select defence contracts from summer 2026 and, in this first phase, is required at contract award rather than at bidding. It is renewed annually.
How long should I keep evidence?
The government's guidance says for the duration of your attestation cycle, or at least one year. Account lists, device lists, access review notes, policies, training records, patch and disposal logs, visitor logs, firewall settings and MFA screenshots are all examples.
Can Canada Cyber-Safe certify us?
No. Nobody can certify you at Level 1, because it is your own attestation, and Level 2 must come from an accredited certification body. We give you an independent view of readiness before you sign.
Checked on 30 October 2026 against Public Services and Procurement Canada's programme overview and Level 1 guidance, both last modified 29 September 2026. Canada Cyber-Safe is not a Government of Canada agency or programme. This page is guidance, not legal advice.