What CPCSC is
CPCSC sets mandatory cyber security standards for companies in Canada’s defence supply chain. It is run by Public Services and Procurement Canada (PSPC) with National Defence. The Standards Council of Canada accredits the certification bodies, and the Canadian Centre for Cyber Security owns the underlying standard, ITSP.10.171. ITSP.10.171 is closely adapted from the U.S. NIST SP 800-171.
The three levels
| Level | What’s required | Controls | Assessed by |
|---|---|---|---|
| 1 | Annual self-assessment | 13 | The supplier |
| 2 | External assessment plus annual affirmation | 98 | An SCC-accredited certification body |
| 3 | Assessment plus annual affirmation | ~200 | National Defence |
When it applies
- April 1, 2026: the Level 1 self-assessment opened to suppliers.
- Summer 2026: Level 1 became a requirement at contract award in select DND contracts.
- Spring 2027: Level 2 is planned for select contracts.
Once a solicitation carries the clause, there’s no grace period. A supplier that can’t attest can’t be awarded the contract.
What Level 1 covers
The 13 Level 1 controls cover six families of basic cyber hygiene:
- Access control
- Identification and authentication
- Media protection
- Physical protection
- System and communications protection
- System and information integrity
Most of these match things your Microsoft 365 or Azure tenant already records: who has which role, whether MFA is enforced, whether management ports are open to the internet. The others, such as physical access and disposal of storage media, need a person to check and document them.
Your official signs it, not the software. Level 1 is a MET / NOT MET attestation that a responsible official in your organization reviews, backs with evidence and submits through the Government of Canada self-assessment tool. Our tools and services get you to that evidence faster. The decision to sign stays with you.
How we prepare you
A Level 1 readiness engagement starts with a read-only scan using cpcsc-mcp. We go through every finding with you and hand over:
- A gap report naming the exact accounts, rules and resources behind each NOT MET
- A drafted self-assessment with the assessment objectives and the organization-defined parameters you need to fill in
- An evidence checklist for the controls software can’t verify
- A remediation plan in priority order, with quick wins called out
Questions we hear
Do we need Level 1 just to bid?
No. The requirement applies at contract award, not at bid. But the self-assessment takes real work, and you don’t want to be starting it the week you win.
Is CPCSC the same as the U.S. CMMC?
No. They’re related but there’s no full reciprocity. Both build on NIST SP 800-171 (Canada’s version is ITSP.10.171), so most of the technical work (MFA, access control, logging) counts toward both. Firms selling into both markets can keep one harmonized set of evidence and file two attestations.
We’re not on Azure. Can you still help?
Yes. The automated scan covers Azure and Microsoft 365, which is where it saves the most time. AWS and on-premises environments are assessed with the same control mapping, using more manual evidence collection.
Will you certify us?
No, and nobody who helped you prepare should. Level 1 is a self-assessment that your own responsible official signs. For Level 2, certification bodies accredited by the Standards Council of Canada must stay independent of whoever prepared you. We stay on the readiness side.
What does the software actually check?
It checks configuration you can read through Azure’s APIs: role assignments, MFA and Conditional Access, network security group rules, Defender for Cloud assessments, policy compliance and resource locks. It checks that a control is in place, not whether it’s effective end to end. Physical and media controls always need human evidence.
Official sources
- PSPC: Canadian Program for Cyber Security Certification, Level 1 (backgrounder)
- PSPC: How to meet Level 1 cyber security certification requirements
- Canadian Centre for Cyber Security: ITSP.10.171
This guide summarizes public information as of September 2026. It is not legal or regulatory advice. Check your contract and PSPC’s current guidance before you rely on it.