What is CPCSC and Does My Canadian Company Need It?

What is CPCSC?

CPCSC stands for the Canadian Program for Cyber Security Certification. It is a Government of Canada program for suppliers that handle certain types of sensitive, unclassified information on the government's behalf.

It is built on a Canadian standard, ITSP.10.171, published by the Canadian Centre for Cyber Security as Protecting specified information in non-Government of Canada systems and organizations. It aligns with the United States CMMC program but does not duplicate it. The government may accept a valid CMMC certification case by case, after confirming that the assessment covers the required scope.

Who Needs CPCSC?

Defense suppliers first. In the government's own words, "Beginning in summer 2026, suppliers bidding on defence contracts may need to obtain Level 1 certification." The government also says that defense contracts, and other sensitive contracts outside defense, will need to be certified under the ITSP.10.171 standard based on their risk level.

If you are unsure, read the security requirements in the specific contract or solicitation you are pursuing. That is where the required level appears.

The Three Levels

CPCSC has three levels, tied to how sensitive the information is.

Level 1

• A self-assessment of 13 security requirements from ITSP.10.171.
• Done every year. A valid CMMC certification may be accepted instead, case by case.
• Required at contract award, and not during the bidding process.
• The government offers an online self-assessment tool. Suppliers can attest without it, but its use is encouraged.

Level 2

• 98 controls.
• An external assessment every three years, led by a certification body accredited by the Standards Council of Canada, plus a yearly affirmation.
• Still under development.

Level 3

• 130+ controls.
• An assessment every three years conducted by the Government of Canada, plus a yearly affirmation.
• Still under development.

The government plans to share guidance for Levels 2 and 3 between April 2026 and March 2027, and to add Level 2 or 3 requirements gradually to select defense contracts between April 2027 and March 2028. A standardized cyber security risk assessment will decide which level each National Defence contract requires.

How to Prepare for Level 1

• Read the 13 requirements and decide what is in scope: the systems, sites and people that handle the contract's information.
• Put in place any requirement you are missing.
• Keep the evidence for each one, because the self-assessment is only as good as what backs it.
• Complete the annual self-assessment. If you hold a valid CMMC certification, send proof to the program to ask whether it is accepted for your contract.
• Have it ready at contract award, not when you bid.

Our CPCSC Level 1 checklist walks through each requirement, the evidence it needs, and where the attestation is recorded.

How Long Does It Take?

There is no honest single number, and you should be careful with anyone who gives you one before they have seen your environment.

Three things decide your timeline: how much you have to protect, how many people touch it, and where you start. A team with written policies and working controls moves faster than a team starting from a blank page. A readiness review of your current state is how you find your real timeline.

What Happens If You Are Not Ready?

A contract that requires CPCSC Level 1 needs it at award. If you cannot show it then, you risk the contract. Starting before a solicitation arrives is the safer path.

How SecuritComply Helps

Being straight about our role here. We are not an auditor and we do not certify anyone. What we build is the software that gets your evidence in order before anyone asks for it.

• CPCSC Level 1: all 13 requirements, ready for the self-assessment.
• CPCSC Level 2: the 98 controls, loaded and ready for when Level 2 arrives.
• Evidence in one place: your policies, screenshots and records against each requirement.
• A readiness view that shows what is in place and what is missing.
• Read-only access for your assessor when Level 2 assessments begin.
• Your compliance data hosted in Canada.

See our CPCSC compliance page for how it works.

Built to save your team time and money: every control is tied to its evidence, so your Level 1 self assessment takes less of your time, and at Level 2 you go into the assessment with your evidence already in order.

References

• Government of Canada, How to meet Level 1 cyber security certification requirements
• Government of Canada, Additional information and support for suppliers