CPCSC certification support, before Level 1 gates your next contract award
Trusted by
CPCSC certification support, three pillars, one operator.
One Canadian team does the Canadian defence supply chain cyber work: closing the control gaps, standing behind the self-assessment, and getting you ready for Level 2.
Level 1 self-assessment
The annual self-assessment done properly, with a configuration and a ticket behind every answer you sign, not a policy document nobody operates.
ITSP.10.171 controls
Canada's adaptation of NIST SP 800-171, closed by engineers rather than written up in a findings report. Identity, logging, segmentation and media handling get built.
Level 2 readiness
The CPCSC levels get harder fast. Level 1 you sign yourself, Level 2 an accredited third party assesses every three years, and nobody crams that. We build for it early.
Does CPCSC Certification Support work the same way in every industry?
No. The CPCSC Certification Support work is the same craft in every sector, but the conditions around it are not. In government that means Protected A, B and C data handling; in defence and aerospace, controlled goods rules, CMMC and the flow-down from your prime. We keep the service and change the part that bends.
The certification federal supply-chain contracts increasingly require.
Protected A, B and C. Each level changes where the data can physically live, who can reach it, and what you have to prove about both. Most files turn on Protected B, and most disagreements turn on what counts as reaching it.
For the Canadian side of the same supply chain.
ITAR and the Controlled Goods Program. Registration under the Defence Production Act is mandatory before anyone examines, possesses or transfers controlled goods in Canada. Technical data counts, so a drawing sitting on a laptop is in scope.
What do you need from CPCSC Certification Support?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Service
- CPCSC Certification Support
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584CPCSC certification in Canada, made real.
I run this practice, so this is the engineer's read of the programme, written by the person who'd scope your environment.
Which standard CPCSC actually runs on.
The Canadian Program for Cyber Security Certification is real, its dates have already started, and most suppliers we meet still treat it as a 2027 problem. Start with the standard, because the internet gets this wrong. CPCSC is built on ITSP.10.171, the Canadian Centre for Cyber Security's adaptation of NIST SP 800-171 (source: Canadian Centre for Cyber Security; PSPC). It's a different document from the general Canadian small-business baseline, and different again from the risk-management framework Canadian assessments have cited for over a decade. Getting that wrong costs months, because the control sets don't map cleanly onto each other and a gap review against the wrong catalogue has to be redone.
Level 1 is a self-assessment, and you sign it.
Level 1 sounds easier than it is. You sign it, which makes it an attestation about your own systems, renewed annually. The failure we see most often is a control answered yes on the strength of a policy document with nothing running behind it. Risk sits in three places: answers given by somebody who doesn't operate the systems, scope drawn around the whole company instead of the environment that touches Government of Canada controlled information, and evidence that exists only in one person's memory.
The calendar is the reason to move.
The defence procurement cyber timetable has already started. Level 1 became available to suppliers in April 2026 and a contract-award requirement on select defence contracts through summer 2026, and in this phase it applies at award rather than during bidding. Level 2 reaches select contracts in spring 2027 and needs an external assessment every three years by a body the Standards Council of Canada accredits, the only Canadian accreditation body offering that accreditation. Level 3 is assessed by National Defence itself, which is why some suppliers go looking for this as DND cyber certification.
Want a Senior IT Consultant's Read on Your Setup?
Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.
Request a consultHow our CPCSC and Canadian defence supply chain work runs.
Four steps, and step 01 decides how much of this you have to do at all. Scope is the whole negotiation. A supplier who draws the boundary around the one segment that handles controlled information does a fraction of the work of one who scopes the entire company, and both answers can be defensible. We argue that line before anybody touches a control.
Engagement phases
Phases 01 to 04
Scope the environment
Which systems, people and sites actually touch Government of Canada controlled information, drawn tightly and written down so a reviewer can follow the reasoning rather than guess at it.
Gap it against ITSP.10.171
Every control assessed against what's running, not what's written, with each gap ranked by whether it blocks an award or simply needs closing before the next annual cycle.
Close the gaps
Our engineers do the configuration work. Identity, logging, segmentation and media handling get built, and the policy gets written to match what now exists.
File it, then aim at Level 2
The self-assessment submitted with evidence behind every answer, a renewal calendar, and the delta between where you are and what an accredited assessor will want in 2027.
CPCSC questions, answered straight.
Answers first, including which standard this actually uses. An architect takes the call, not a salesperson.
Where this work connects.
These disciplines share the same senior team and tend to land together. Follow the thread to the next one.
- RegulatedSOC 2 Compliance ServicesSOC 2 compliance for Canadian companies, scoped down to what your customers actually asked for, then evidenced.
- RegulatedPIPEDA CompliancePIPEDA compliance for Canadian organisations, built to still hold when Bill C-36 replaces the Act.
- RegulatedPrivacy Impact Assessment (PIA)Privacy impact assessment for Canadian institutions and their vendors, written to the rule that actually binds them.
