CPCSC certification support for Canadian defence suppliers, from the Level 1 self-assessment through to ITSP.10.171 gap closure.
One Canadian team does the Canadian defence supply chain cyber work: closing the control gaps, standing behind the self-assessment, and getting you ready for Level 2.
The annual self-assessment done properly, with a configuration and a ticket behind every answer you sign, not a policy document nobody operates.
Canada's adaptation of NIST SP 800-171, closed by engineers rather than written up in a findings report. Identity, logging, segmentation and media handling get built.
The CPCSC levels get harder fast. Level 1 you sign yourself, Level 2 an accredited third party assesses every three years, and nobody crams that. We build for it early.
Level 1 became a contract-award requirement on select defence contracts in summer 2026, and Level 2 reaches select contracts in spring 2027. The runway is about two quarters.
IN PRODUCTION
We answered the self-assessment honestly and failed our own review. Half the controls were policies with nothing running behind them. SMEnode closed the technical gaps, and now every answer we sign has a configuration and a ticket behind it.
I run this practice, so this is the engineer's read of the programme, written by the person who'd scope your environment.
The Canadian Program for Cyber Security Certification is real, its dates have already started, and most suppliers we meet still treat it as a 2027 problem. Start with the standard, because the internet gets this wrong. CPCSC is built on ITSP.10.171, the Canadian Centre for Cyber Security's adaptation of NIST SP 800-171 (source: Canadian Centre for Cyber Security; PSPC). It's a different document from the general Canadian small-business baseline, and different again from the risk-management framework Canadian assessments have cited for over a decade. Getting that wrong costs months, because the control sets don't map cleanly onto each other and a gap review against the wrong catalogue has to be redone.
Level 1 sounds easier than it is. You sign it, which makes it an attestation about your own systems, renewed annually. The failure we see most often is a control answered yes on the strength of a policy document with nothing running behind it. Risk sits in three places: answers given by somebody who doesn't operate the systems, scope drawn around the whole company instead of the environment that touches Government of Canada controlled information, and evidence that exists only in one person's memory.
The defence procurement cyber timetable has already started. Level 1 became available to suppliers in April 2026 and a contract-award requirement on select defence contracts through summer 2026, and in this phase it applies at award rather than during bidding. Level 2 reaches select contracts in spring 2027 and needs an external assessment every three years by a body the Standards Council of Canada accredits, the only Canadian accreditation body offering that accreditation. Level 3 is assessed by National Defence itself, which is why some suppliers go looking for this as DND cyber certification.
Four steps, and step 01 decides how much of this you have to do at all. Scope is the whole negotiation. A supplier who draws the boundary around the one segment that handles controlled information does a fraction of the work of one who scopes the entire company, and both answers can be defensible. We argue that line before anybody touches a control.
Which systems, people and sites actually touch Government of Canada controlled information, drawn tightly and written down so a reviewer can follow the reasoning rather than guess at it.
Every control assessed against what's running, not what's written, with each gap ranked by whether it blocks an award or simply needs closing before the next annual cycle.
Our engineers do the configuration work. Identity, logging, segmentation and media handling get built, and the policy gets written to match what now exists.
The self-assessment submitted with evidence behind every answer, a renewal calendar, and the delta between where you are and what an accredited assessor will want in 2027.
Answers first, including which standard this actually uses. An architect takes the call, not a salesperson.
Ces disciplines partagent la même équipe chevronnée et arrivent souvent ensemble. Suivez le fil jusqu'à la prochaine.
PARLONS-EN
Un spécialiste chevronné répond en moins d'une heure, 24/7.