CPCSC for Subcontractors and Prime Contractors

A prime contractor just sent you a contract clause that mentions Level 1 of the Canadian Program for Cyber Security Certification, and nobody on your team can say whether it applies to you. Most subcontractors meet CPCSC this way. The clause arrives through a customer, not a regulator, and the first question is what you are responsible for. Our CPCSC compliance page covers the program itself. This post covers one narrow question: what the official scoping guide says about primes, subcontractors and the service providers behind them.

Why this comes up

Level 1 has 13 requirements, and the self-assessment is required at contract award, not during the bidding process, according to the Public Services and Procurement Canada (PSPC) page How to meet Level 1 cyber security certification requirements. Suppliers self-assess and attest. So a subcontractor can hear about Level 1 for the first time when a prime forwards a clause.

Here is the part people get wrong about CPCSC subcontractors

The question is not only whether your own company is in scope. The Level 1 scoping guide also speaks to the relationship between primes and subcontractors, and it does so in "should" language. We write what the guide says. We do not claim it creates a legal duty, because your contract clauses decide what binds you.

What the scoping guide says about prime contractors

Under the heading "Subcontractor's systems," the scoping guide says a prime contractor should make any of its subcontractors hold the appropriate certification. It adds that when subcontractors store, use or send the same specified information as the prime, they should apply the same rigorous scoping exercise, and the prime should document that they have done so.

In plain terms, a prime needs one record per subcontractor. The record shows whether that subcontractor handles specified information and, if it does, that the scoping was done. That reading is ours, not the guide's wording.

What the scoping guide says about subcontractors

The same scoping guide says subcontractors are responsible for their own scoping exercise and are expected to follow the scoping guidelines. A prime's scoping does not replace yours.

The exercise has six steps, listed at the end of this post. The last one checks that your boundary is large enough to test every applicable requirement. If you are the subcontractor, the work starts with you: define the scope, work the requirements, and keep the evidence behind each one. Our CPCSC compliance page shows how our software holds that evidence.

If a subcontractor will not touch specified information

Not every subcontractor needs the information. The scoping guide says that when subcontractors will not have access to specified information, the prime should have evidence of that decision and document the rationale that confirms it.

This is an evidence problem, not a certification problem. A verbal "they do not need it" proves nothing a year later. Our reading is a short record per subcontractor: who it is, what it does on the contract, why it does not need specified information, who decided, and the date. That layout is ours, not the guide's.

Your own service providers

Your cloud email provider or managed service provider may sit inside your scope. In its section "Use of external service providers," the scoping guide says you can use them, and that you are still responsible for verifying three things. First, the provider operates within your agreed security scope and its security measures meet Level 1 requirements. Second, your contract with the provider meets your data location (residency) and privacy requirements. Third, the provider enforces multifactor authentication and secure sign-in rules.

The direction matters. Using a provider does not move the check onto the provider.

What the guide does not say

The Level 1 requirements page mentions subcontractors only in general terms, noting that cyber threats target contractors and subcontractors. We did not find, in that page or the scoping guide, how a prime must pass requirements down in a contract or when a subcontractor's proof is due.

Those answers sit in your contract clauses, so read them first. For questions the clause does not answer, PSPC has a contact form for the program. The page says the form is not secure, so keep contract details and any specified information out of it.

Where to start

The scoping guide lays out six steps:

• Identify the relevant specified information, using the contract and its security clauses.
• Identify where that information lives and moves.
• Identify in-scope assets: the devices, apps, storage and paper files that use, save or send it.
• Identify specialized and out-of-scope assets.
• Identify the surrounding environment: people, external service providers and the systems connected to your scope.
• Validate the boundary against the Level 1 requirements. The guide says that if your boundary is so small that you cannot honestly check a requirement, your scope is likely too narrow.

Our CPCSC Level 1 checklist walks through the 13 requirements once your scope is set.

Where we fit, and where we do not

We build software. SecuritComply ties each Level 1 requirement to the evidence behind it, so your scoping record, your subcontractor decisions and your proof sit in one place when a prime asks for them. We are not an assessor, and we do not certify, audit or attest for anyone. The attestation is yours to make.

Built to save your team time and money: every control is tied to its evidence, so your Level 1 self assessment takes less of your time, and at Level 2 you go into the assessment with your evidence already in order.

If you want to see where your team stands against the 13 requirements, book the free CPCSC Level 1 Gap Review on that page.

Frequently asked questions

Does every subcontractor on a defense contract need CPCSC Level 1?

Not automatically. The scoping guide says a prime should make its subcontractors hold the appropriate certification, and that when a subcontractor will not have access to specified information, the prime should keep evidence of that decision and the rationale. Your contract clauses decide the rest.

Who scopes a subcontractor's systems, the prime or the subcontractor?

The subcontractor. The scoping guide says subcontractors are responsible for their own scoping exercise and are expected to follow the scoping guidelines. Where they handle the same specified information, the prime documents that they did it.

Does using a managed service provider move the responsibility to the provider?

No. The scoping guide says you can use external service providers, but you remain responsible for verifying that they work within your scope and meet Level 1, that your contract with them covers data residency and privacy, and that they enforce multifactor authentication.

What should a prime keep for a subcontractor that never touches specified information?

The scoping guide asks for evidence of the decision and the rationale behind it. A short dated record per subcontractor covers it: what the subcontractor does on the contract, why it does not need the information, and who decided.

Where do I ask a question the scoping guide does not answer?

Start with your contract clauses. For anything they leave open, Public Services and Procurement Canada has a contact form for the program. Keep contract details and specified information out of it, because the page says the form is not secure.

References

• Public Services and Procurement Canada, Level 1 cyber certification scoping guide
• Public Services and Procurement Canada, How to meet Level 1 cyber security certification requirements
• Public Services and Procurement Canada, Contact the Cyber Security Program