Defence and Aerospace IT
Your prime pushes its obligations down the contract, and a US-controlled data boundary changes your architecture, not just your paperwork. A cloud region in the wrong country can put you offside on a file you've already won. We name the regime that binds you, then point you at the service that answers it.
By the numbers
Years of experience
Enterprise deployments
Senior engineers
Support
Which rules apply to you?
A photo means it applies to you now. A white tile depends on you.
- Applies now
ITAR and the Controlled Goods Program
Registration under the Defence Production Act is mandatory before anyone examines, possesses or transfers controlled goods in Canada. Technical data counts, so a drawing sitting on a laptop is in scope.
- Applies now
Flow-down from your prime
Your prime's obligation becomes yours by contract. Your subcontractors' obligations become yours again, and nobody sends you a reminder.
- Applies conditionally
CMMC
The level your contract names, not the level you'd prefer. It's assessed against the control set underneath it, and a self-declaration stops being enough at Level 2.
If you supply the US Department of Defense, directly or through a prime.
- Applies conditionally
NIST SP 800-171
The control set CMMC is built on. Map it once and it carries into most other frameworks you'll be asked about.
If you hold US controlled unclassified information.
- Applies conditionally
CPCSC
The Canadian Programme for Cyber Security Certification, which federal defence supply-chain contracts increasingly name.
When a Canadian defence contract names it.
Which services answer them?
- CMMC Compliance The level your contract names, assessed against the real control set.
- NIST Cybersecurity Framework The control mapping underneath CMMC, done once and reused.
- CPCSC Certification Support For the Canadian side of the same supply chain.
- On-Premise and Sovereign AI Controlled data that can't cross a border, including into a model.
- Third-Party Risk Management Your subcontractors inherit your obligations. Prove they meet them.
- Identity and Access Management Controlled-goods access has to be provable per person, per document.
- Network Security Segmentation between controlled and general environments.
- Data Centre Services Infrastructure inside the boundary you're allowed to use.
Whose kit does this run on?
The platforms we design, build and support. Named because a buyer with an estate already standardised on one of them needs to know before the first call, not after it.
Cisco, Palo Alto, Fortinet, F5, VMware, Azure
What do you need from us?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Sector
- Defence and Aerospace
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584