CPCSC: Canadian Program for Cyber Security Certification

The Canadian Program for Cyber Security Certification, or CPCSC, is the Government of Canada program that sets cyber security requirements for suppliers on defence contracts. Public Services and Procurement Canada leads it, and National Defence and the Standards Council of Canada have defined roles in the higher levels.

The government says the controls are adapted from NIST SP 800-171 and 800-172 and published as the Canadian standard ITSP.10.171. That shared basis is why organizations that have worked on NIST 800-171 or CMMC are not starting from zero. Requirements and dates change, so treat the official pages as the source of truth.

How to get ready

1. Find out whether it appliesNot every defence contract requires certification, and the level depends on the contract.
   • Read the security requirements in each solicitation and contract.
   • The government states that requirements begin appearing in defence contracts from summer 2026, starting with Level 1.
   • Ask your prime contractor how requirements will flow down to you. The official Level 1 page does not set out subcontractor flow-down, so rely on your contract.
2. Understand the three levelsThe levels step up in rigor and in who does the assessing.
   • Level 1 is an annual self-assessment against 13 foundational controls.
   • Level 2 is described as an external assessment by an accredited body, with annual affirmations and 98 controls. The government lists it as under development.
   • Level 3 is described as an assessment by National Defence, with annual affirmations and more than 130 controls. The government lists it as under development.
   • The Standards Council of Canada accredits the bodies that will perform Level 2 assessments.
3. Know the 13 Level 1 controlsAs summarized from the government’s Level 1 requirements page. Read the original for the exact wording.
   • Manage user accounts, and update them when people join, leave, or change roles.
   • Give people only the access they need.
   • Use only approved systems and devices.
   • Prevent sensitive information from being shared publicly.
   • Use individual accounts and strong passwords.
   • Approve devices before they connect to your network.
   • Enable multi-factor authentication for privileged accounts and for systems holding specified information.
   • Wipe or destroy old devices and media.
   • Keep a list of who can access secure areas.
   • Control physical entry with locks and visitor procedures.
   • Use basic network protections such as firewalls.
   • Apply security updates promptly and track completion.
   • Use antivirus and anti-malware software.
4. Scope your environmentCompliance cost follows scope, so be exact about where specified information lives.
   • List the systems, people, and locations that store, process, or transmit information the contract protects.
   • Keep that information in a small, well-defined boundary instead of spreading it across the whole company.
   • Document the boundary, because assessors and primes ask for it.
5. Run the gap assessmentDo it early. Collecting evidence takes longer than fixing most gaps.
   • Start with the 13 Level 1 controls and score each one honestly.
   • Compare your program to ITSP.10.171 if you expect to need Level 2 or if your contracts reference it.
   • Fix the cheap, high-value gaps first, such as multi-factor authentication, patching, and device approval.
6. Keep evidenceA control you cannot demonstrate does not count.
   • Write short policies and procedures for each control, and keep screenshots, exports, and tickets that show the control working.
   • Assign an owner to every control and record the review date.
   • Store the evidence where it can be retrieved quickly when an assessor or prime asks.
7. Complete the self-assessmentLevel 1 uses the official online tool.
   • Complete the government self-assessment tool each year.
   • The government states that results are provided to your CanadaBuys profile, and that the self-assessment is required at contract award.
   • Use the program contact page if something in the process is unclear.

General information, not legal or professional advice. Official documents change, so confirm details with the linked sources before you act.