Defence supply chain
CPCSC: know where you stand before the contract asks
The Canadian Program for Cyber Security Certification is now appearing in defence contracts. We give you an independent, dated view of how ready you are. We do not certify, and we do not sell the fix.
What the programme requires
- Level 1: self-assessment. You assess yourself against 13 security requirements, using the government’s online tool, and attest that you meet them. It is an annual requirement. Suppliers have been able to use it since 1 April 2026, and it is appearing in select defence contracts from summer 2026 for lower-risk work, such as administrative support or basic IT services with no sensitive data. In this first phase, certification is needed at contract award rather than throughout bidding.
- Level 2: third-party assessment. An external assessment every three years by an accredited body. It is due in select defence contracts from spring 2027, for work involving controlled defence information.
- Level 3: assessment by National Defence. Reserved for the highest-risk work. No start date has been announced.
All three levels rest on ITSP.10.171, the Canadian Centre for Cyber Security’s industrial standard. The government describes it as technically identical to the NIST SP 800-171 and 800-172 controls behind the US CMMC programme.
Where we fit, and where we do not
We are not a certification body, and we cannot certify you at any level. Level 1 is your own attestation. Level 2 must come from an accredited body.
What we offer is an independent readiness assessment: a dated report against the Level 1 requirements, and for Level 2 candidates against ITSP.10.171, showing what is in place, what evidence supports it, and what is missing. If we assess you, we do not implement the fixes. If we have advised you, we will not be the ones assessing.
Who should look at this now
- You supply National Defence or a defence prime, or you bid on defence work through Public Services and Procurement Canada.
- Your work involves, or soon will involve, controlled defence information, which brings Level 2 into view from spring 2027.
- You already sell into the US defence supply chain and have done CMMC work. Much of it should carry across, and a readiness assessment will show how much.
If you have no defence work in view, you do not need this yet, and we will tell you so.
What you get
- A dated readiness report, requirement by requirement: in place, partly in place or not in place, with the evidence behind each answer.
- A prioritised list of gaps that your team or your IT provider can act on.
- A one-page summary for the board: could you sign a Level 1 attestation honestly today?
The fee is fixed and quoted after a short call, based on your size and scope.
The question your board should ask
“If a defence customer asked us to attest to CPCSC Level 1 at contract award next month, could we sign it honestly, and what evidence would we show?”
If you want an independent answer, the first conversation is free.
Checked on 19 October 2026 against Public Services and Procurement Canada’s announcement and backgrounder of 14 April 2026.