CPCSC Readiness for Canadian Defence Suppliers

Canada's defence supply chain now has its own cybersecurity certification. If you make parts, provide services or handle information for the Department of National Defence (DND), the Canadian Program for Cyber Security Certification (CPCSC) is coming to your contracts. In many cases it's already there.

​

CyberCare Pro is an Ontario-based compliance consultancy built for small and mid-sized manufacturers and defence suppliers. We help you understand what CPCSC asks for, find your gaps, fix them and stay compliant. We're sized and priced for companies that can't justify an enterprise consulting firm. If you also sell into the U.S. defence market, we cover CMMC in the same engagement.

​

What is CPCSC?

• Who runs it: Public Services and Procurement Canada (PSPC), working with DND, the Standards Council of Canada and the Canadian Centre for Cyber Security.

• What it's based on: the Canadian Centre for Cyber Security's ITSP.10.171 standard for protecting specified information on non-government systems. ITSP.10.171 is closely aligned with the U.S. NIST SP 800-171, which is also the backbone of CMMC.

• Three levels:

  • Level 1: an annual self-assessment of 13 security requirements. It became available in April 2026.

  • Level 2: an independent assessment by a certification body accredited through the Standards Council of Canada.

  • Level 3: assessed by DND for the highest-risk work.

• When it applies: Level 1 is required at contract award, not at bid time. You confirm your self-assessment result and its expiry date in your CanadaBuys supplier profile.

• If you already have CMMC: PSPC may recognize a valid CMMC certification. Proof is sent to PSPC for verification.

 

Who needs CPCSC?

Any organization bidding on or working under a Canadian defence contract that includes a CPCSC requirement. That includes subcontractors further down the supply chain: machine shops, fluid and motion control suppliers, electronics manufacturers, engineering firms and IT providers serving defence primes.

 

"Self-assessment" doesn't mean simple

Level 1 is a self-assessment, but you're still attesting that each control is actually in place in your environment, and you sign your name to it. Common problems we see:

• Policies that exist on paper but aren't followed

• No clear picture of where contract information is stored or who can reach it

• Controls handled by an IT provider with no evidence the company can produce on request

• Confusion about which systems are in scope

​

If you get Level 1 right, Level 2 will be much easier.

​

How we help

We work in three stages, so you only pay for what you need:

1. Find your exposure. Choose one entry point:

   • CPCSC Level 1 Readiness: a review of the 13 Level 1 requirements against your environment, with a prioritized gap list.

   • CMMC/CPCSC Combined Gap Assessment: for suppliers selling into both Canada and the U.S. One assessment covers both frameworks.

   • ITAR Data-Handling Audit: for companies handling controlled technical data.

2. Close the gaps. Hands-on remediation: policies and procedures, technical controls, and the evidence you need to attest with confidence.

3. Stay compliant. Managed monitoring and an annual reassessment, so your next self-assessment isn't a scramble.

 

Teams that need to understand the requirements first can start with Cleared to Compete, our CPCSC readiness training (contact us for more details).

 

Already working on CMMC?

CPCSC and CMMC share the same control backbone: ITSP.10.171 and NIST SP 800-171. Most of the work you've done for one carries over to the other. We map your existing controls across both frameworks so you don't pay twice for the same evidence.

​

​

Why CyberCare Pro

• The translator between ITAR, CMMC and CPCSC. We explain what each one asks for in plain business language and show where they overlap.

• Right-sized. Built for SME manufacturers and suppliers, not large integrators.

• Practical security choices. We help you pick tools that fit your obligations, including end-to-end encrypted options, rather than defaulting every client to the most expensive platform.

• Cross-border. We work with defence suppliers in both Canada and the U.S.

​

Frequently asked questions

Is CPCSC mandatory?

It's mandatory when a Canadian defence contract includes a CPCSC requirement. Level 1 requirements started appearing in select defence contracts in 2026.

 

When do I need to complete my Level 1 self-assessment?

By contract award. You don't need it to bid, but you'll need it before you can win.

​

How often do I need to do it?

Level 1 is an annual self-assessment.

 

Does CyberCare Pro certify us?

No. Level 1 is a self-assessment that you complete. Level 2 may be performed by an accredited certification body (waiting for official annoucement). We prepare you so your attestation is accurate and you're ready for any future assessment.

​

We have CMMC. Do we still need CPCSC?

PSPC may recognize a valid CMMC certification. If you don't have CMMC yet, a combined gap assessment covers both frameworks at once.

 

What does readiness cost?

Costs for Level 1 range from $5000 - $25,000, Costs for Level 2 readiness depend on your environment.  Book a call for a fixed quote.

​

Is funding available?

Eligible Ontario employers may be able to offset some training and implementation costs through Ontario Centre of Innovation (OCI) and Ontario Job Grant programs. New grants are constantly opening up.  Ask us about eligibility.

​

Get started

Book a 30-minute CPCSC readiness call. We'll tell you which level applies to you, roughly where you stand, and what a realistic path looks like.

​

​

​