CPCSC Level 2: What Canadian Defense Suppliers Need to Know

Your Level 1 self-assessment is done, or close to it, and the next question arrives on a bid call: what about CPCSC Level 2? Most suppliers hear about it this way, secondhand, from a prime or a procurement officer, with no date attached. The honest answer starts with what the federal program actually says today, which is less than most people assume and more specific than most people have read.

This post covers what CPCSC Level 2 is, when it is expected to reach contracts, how you will find out whether it applies to you, and what you can build now so the work you did for Level 1 carries forward. For the program as a whole, our CPCSC compliance page is the place to start.

What CPCSC Level 2 is

The Canadian Program for Cyber Security Certification has three levels. According to the program overview from Public Services and Procurement Canada, Level 2 requires external cyber security assessments led by an accredited certification body, plus an annual affirmation, and covers 98 controls. Level 3 is assessed by National Defence and covers 130+ controls, also with an annual affirmation.

The additional information page for suppliers adds two details. The external assessment at Level 2 is triannual, in the program's own word, and the assessors must be accredited by the Standards Council of Canada, which the program has chosen as its accreditation body.

Level 1 works differently. The Level 1 requirements page describes an annual self-assessment against 13 controls, required at contract award and not during the bidding process. You attest for yourself. Nobody outside your company checks your work before the declaration is recorded.

Here is the part people get wrong about CPCSC Level 2

Most people picture Level 2 as Level 1 with a longer list. The longer list is the smaller change. The bigger one is who checks.

At Level 1, the person deciding whether a control is in place works for you. At Level 2, that person works for an accredited certification body and has never seen your network before. They will not take a policy document as proof that something happens. They will ask to see it happening: the access review with a date on it, the log that shows who signed in, the record that a patch went out.

Two more facts change how you should plan. First, no Level 2 assessment exists to book today. Both program pages say Levels 2 and 3 are currently under development. Second, the Level 2 guidance has not been published yet. Anyone who tells you exactly what a Level 2 assessor will ask for is reading ahead of the government.

When CPCSC Level 2 reaches contracts

The additional information page sets out the milestones in two windows.

From spring 2026 to spring 2027, Level 1 to 3 requirements may be identified in select defense contracts as early as summer 2026, with compliance required at a later date. The page also says guidance for Levels 2 and 3 will be provided in advance.

From spring 2027 to spring 2028, the page says the requirement to have Level 2 or 3 certification will be gradually incorporated into select defense contracts, and that Level 3 compliance activities will be conducted by Government of Canada authorities.

Read those two windows together and the planning picture is clear. A Level 2 clause can appear in a contract before the assessment is required. The guidance comes before the requirement. And the phase-in is gradual and selective, so it reaches some contracts before others. None of that tells you when your company will face it. Your contracts will.

How you will know which level applies to you

You will not have to guess. The program says each National Defence contract will be evaluated with a standardized cyber security risk assessment that decides whether mandatory requirements apply and which level is needed. That assessment serves as an addendum to the Security Requirements Checklist, the document that already sets security terms on federal contracts.

The required level then shows up in the procurement documents. According to the same PSPC page, National Defence procurement documents will specify the CPCSC level, the obligations for protecting sensitive information, and the compliance expectations.

So the practical step is simple. When a request for proposal or a contract arrives, read the security clauses and the checklist before anything else. They will name the level. If they do not, ask the contracting authority before you assume.

What Level 2 is built on

The program is built on the Canadian Centre for Cyber Security publication ITSP.10.171, Protecting specified information in non-Government of Canada systems and organizations. The Level 1 page says suppliers will need to be certified under that standard based on their risk level.

ITSP.10.171 describes itself as a Canadian version of NIST SP 800-171. Its second release is dated October 28, 2025, and it organizes its requirements into 17 families, from access control and audit and accountability through to supply chain risk management, according to the publication itself. It also uses the term specified information where the American standard says controlled unclassified information.

One more detail matters for Level 2 in particular. The same publication says the Canadian Centre for Cyber Security will produce a companion publication based on NIST SP 800-171A, the document that describes how each requirement is assessed. Until that companion is released, the page says NIST SP 800-171A can be used as a reference. If you want a preview of how an outside assessor thinks, that is the closest public document available today.

If you are a subcontractor

Level 2 does not stop at the prime. The additional information page says contractors must identify the CPCSC requirements for subcontractors that have access to specified information, and confirm their status before access is granted and periodically afterward. It states plainly that the contractor is responsible for flowing the applicable CPCSC requirements into the subcontract.

The page also lists supply chain implementation guidance for industry as coming soon. Until it lands, our post on CPCSC for subcontractors and prime contractors covers what the Level 1 scoping guide already says about that relationship.

What to do before the guidance lands

You do not need the Level 2 guidance to start the work that Level 2 will test. Four things carry forward no matter what the guidance says.

• Finish Level 1 properly. The 13 Level 1 controls come from the same standard. A Level 1 program with real evidence behind it is the floor Level 2 builds on. Our CPCSC Level 1 checklist walks through each one.
• Get your scope right now. An outside assessor will start by testing your boundary. If your Level 1 scope was drawn small to make the self-assessment easy, it will not hold up when someone else draws it.
• Read ITSP.10.171 family by family. Note which requirements you already meet, which you meet without proof, and which you do not meet at all. That middle group is usually the largest, and it is the cheapest to fix.
• Start your evidence history today. An assessor looks for controls that run over time. A record that shows the access review happening every quarter for a year tells a different story than a screenshot taken the week before.

If you already hold a United States CMMC certification, the Level 1 page says the Government of Canada may accept it on a case-by-case basis, after confirming the assessment covers the required scope. Do not treat it as automatic. Contact the program.

The evidence problem underneath all of this

Here is the pattern our team sees with defense suppliers. The controls are rarely the hard part. Most shops already use multifactor authentication, lock the server room, and patch their machines. What they cannot do is show it, dated, in one place, when someone asks.

At Level 1 that gap is uncomfortable. At Level 2 it is the whole assessment, because the assessor's job is to check proof, not intentions. The suppliers who will find Level 2 manageable are the ones who treat their Level 1 records as the first year of a history, not as a one time form.

Where we fit, and where we do not

We build software. We are not a certification body, we are not accredited by the Standards Council of Canada, and we do not assess, certify or attest for anyone. When Level 2 arrives, an accredited certification body does that work, and it should stay that way.

What SecuritComply does is tie each Level 1 requirement to the evidence behind it, with an owner and a date, and carry the Level 2 controls alongside, so the history you build now is there when an assessor asks for it. Your compliance data stays in Canada.

Built to save your team time and money: every control is tied to its evidence, so your Level 1 self assessment takes less of your time, and at Level 2 you go into the assessment with your evidence already in order.

To see where you stand against the 13 Level 1 controls first, book the free CPCSC Level 1 Gap Review on our CPCSC compliance page. If you would rather work through it on your own, the free CPCSC Level 1 Readiness Checklist is on our resources page.

Frequently asked questions

What is CPCSC Level 2?

It is the middle of the three CPCSC levels. According to Public Services and Procurement Canada, Level 2 covers 98 controls and requires external assessments led by a certification body accredited by the Standards Council of Canada, plus an annual affirmation. The program describes the assessment as triannual.

Can I get CPCSC Level 2 certified today?

No. The program pages say Levels 2 and 3 are currently under development, and guidance for them will be provided before the requirement appears in contracts.

When will CPCSC Level 2 be required?

The program says Level 2 or 3 certification will be gradually incorporated into select defense contracts in the spring 2027 to spring 2028 window. Requirements may be identified in some contracts earlier, with compliance due at a later date. Your contract clauses decide when it applies to you.

Who will assess my company at Level 2?

A third party accredited by the Standards Council of Canada. Level 3 is different: National Defence conducts those assessments.

Does my Level 1 work count toward Level 2?

The 13 Level 1 controls come from the same standard, ITSP.10.171, so the controls and the evidence you keep for Level 1 are a starting point. The program has not published how Level 2 assessors will treat Level 1 records, so plan to show a history, not a single snapshot.

References

• Public Services and Procurement Canada, Program overview, Canadian Program for Cyber Security Certification
• Public Services and Procurement Canada, Additional information and support for suppliers about cyber security
• Public Services and Procurement Canada, How to meet Level 1 cyber security certification requirements
• Canadian Centre for Cyber Security, Protecting specified information in non-Government of Canada systems and organizations (ITSP.10.171)
• National Institute of Standards and Technology, SP 800-171A Rev. 3, Assessing Security Requirements for Controlled Unclassified Information