Your next defence contract has security clauses in it.
Canada's defence expansion is pulling thousands of companies into a supply chain with certification requirements attached. CPCSC Level 1 is already in select contracts. We prepare suppliers to meet it, prove it, and stay ready for what Level 2 will ask.
The buyers are being built right now
The Defence Industrial Strategy, launched February 17, 2026, deliberately pulls new firms into the defence supply chain through its Build, Partner, Buy framework. Most of the companies about to win this work have never been defence contractors, and the security requirements arrive with the contract.
The CPCSC timeline
The Canadian Program for Cyber Security Certification phases in through 2028. Where your contracts sit on this line decides how much work you need, and when.
Level 1 available
Suppliers self assess against baseline requirements drawn from ITSP.10.171 and record their attestation in their CanadaBuys supplier profile, affirmed annually.
Level 1 mandatory in select contracts
Suppliers bidding this season are hitting the requirement for the first time. This is the live obligation today.
Level 2 enters select contracts
98 controls based on ITSP.10.171, external assessment by a certification body accredited by the Standards Council of Canada, recertification every three years with annual affirmation between.
Level 3 introduced; expansion through 2028
Levels 1 and 2 progressively expand across applicable defence contracts.
Five services, one practice
CPCSC is the instrument. The practice is making your organization provably ready for defence work.
CPCSC Level 1 readiness and attestation
A readiness check against the self assessment criteria, gap closure sequenced by your contract dates, and the records to stand behind your CanadaBuys affirmation.
ITSP.10.171 control implementation
The control set behind Levels 1 and 2. We design and verify; your team implements. Work already done for ISO 27001 counts, and we map it.
Level 2 preparation and evidence programs
System security plan, evidence library mapped to all 98 controls, and a mock assessment before a real assessor arrives.
Contract security requirements interpretation
We read the clauses in your RFPs and contracts and turn them into a precise list of what applies, what does not, and what it costs to comply.
Supply chain flow down
The requirements you accept flow down to your subcontractors. We help you pass them on with contractual teeth and without overreach.
Nine steps, contract to sustainment
Time and materials, with checkpoints. Your team implements; we design, support, and verify. Every stage produces an artifact you keep.
- Contract triage
Read the live or target contracts. Identify the security clauses, the CPCSC level required, and what contractual information you will actually hold.
- Scope definition
Which systems, people, and locations touch that information. Small and defensible is the goal; scope is the main cost lever.
- Level 1 readiness check
Assessment against the actual attestation criteria, producing a gap register.
- Remediation plan
Gaps mapped to ITSP.10.171 controls and sequenced by contract deadline.
- Implementation
Your team executes. We design, support, and verify as controls land.
- Evidence assembly
Policies, configurations, and records an assessor would ask for, each mapped to a control.
- Attestation
Level 1 affirmation recorded in your CanadaBuys supplier profile, with the file behind it.
- Level 2 preparation
If your contracts will require it: system security plan, evidence program, mock assessment.
- Ongoing cycle
Annual affirmation, flow down to your own suppliers, recertification readiness.
Artifacts, not advice
- A defined, defensible scope for contract information
- A gap register against the Level 1 criteria, and against ITSP.10.171 where Level 2 applies
- A remediation plan sequenced by your contract dates
- An evidence pack mapped control by control
- A recorded attestation with records that survive scrutiny
- An annual affirmation calendar so readiness holds
Asked often
Is CPCSC Level 1 a certification?
No. Level 1 is a self assessment: you assess against the published criteria and record your affirmation in your CanadaBuys supplier profile, then affirm annually. External certification arrives at Level 2, expected in select contracts from spring 2027.
We already hold ISO 27001. Does that cover CPCSC?
It helps materially. ITSP.10.171 and ISO 27001 overlap heavily, and existing ISMS evidence usually shortens the work. But the CPCSC criteria are their own set, and the attestation is separate. We map what you have before building anything new.
When does Level 2 apply to us?
Level 2 enters select contracts in spring 2027, with 98 controls based on ITSP.10.171 and assessment by an externally accredited certification body. Whether it lands in your contracts depends on what you bid on. Reading those clauses is the first step of the engagement.
How long does Level 1 readiness take?
It depends almost entirely on scope. A supplier with contract information confined to a small set of systems moves quickly; a flat network takes longer. We work time and materials with checkpoints, so you see the register and the plan before committing to the build.