Canada now has its own cyber security certification for defence suppliers. The Canadian Program for Cyber Security Certification (CPCSC) started with Level 1 in April 2026, and its requirements are being written into select defence contracts beginning in summer 2026 (PSPC). Firms such as BDO Canada have launched readiness programs around it (BDO Canada). With defence spending rising, more Canadian businesses, including many SMEs in the supply chain, will meet it for the first time.
Who it applies to
The program targets defence contractors and subcontractors that handle controlled defence information or perform cyber-sensitive work on federal defence contracts (PSPC). Requirements flow through contracts, so a prime contractor will pass them down to its suppliers.
The standard behind it
CPCSC is built on the Canadian Centre for Cyber Security’s Canadian industrial cyber security standard, ITSP.10.171, which is aligned with the US NIST SP 800-171 and 800-172 controls (PSPC). Canada may accept a contractor’s valid US CMMC status case by case, after confirming the assessment covers the required scope.
Three levels
- Level 1: an annual self-assessment in which suppliers identify the implementation status of 13 security requirements and controls (PSPC).
- Level 2: 98 controls, assessed by an accredited third-party certification body every three years, plus an annual affirmation (PSPC).
- Level 3: 200 controls, assessed by the Government of Canada, for the highest-risk work.
Timeline
- April 2026 to March 2027: Level 1 self-assessment tool introduced; requirements begin appearing in select contracts.
- April 2027 to March 2028: Level 2 or Level 3 certification gradually required in select defence contracts (PSPC).
The Standards Council of Canada is the accreditation body for the certification bodies that will assess Level 2. Check the program page for current guidance.
How to get ready
- Find your contracts. Identify current and upcoming defence work, and whether you handle controlled information.
- Define your scope. Isolate the systems and people that handle controlled information. A smaller, well-segmented scope is cheaper to secure and assess.
- Complete Level 1 honestly. Self-assessment is a statement your clients rely on. Keep evidence for each control.
- Gap-assess against Level 2 now. 98 controls take time to implement, and accredited assessors will be in demand when the 2027 phase-in begins.
- Reuse what you have. ISO 27001, SOC 2 and PCI DSS programs cover many of the same controls: access control, logging, incident response, configuration and vulnerability management.
Accel GRC maps one set of controls to several frameworks, and KW Consulting supports gap assessments and remediation. See also answering security questionnaires without starting from zero. Contact us.
Sources
Does this apply to you? A free 30-minute consult maps the requirement to your systems and tells you what to do next.
Book a free consult