If you make parts, provide engineering or supply services anywhere in Canada's defence supply chain, you'll start hearing about the Canadian Program for Cyber Security Certification, or CPCSC. Since summer 2026, select federal defence contracts can require Level 1 certification.
The good news is that Level 1 is designed for businesses of every size, including small ones. Here's what it involves.
When it applies
- Select defence contracts, not all of them. Public Services and Procurement Canada (PSPC) says commercial off-the-shelf contracts, for example, may not be subject to it.
- At contract award, not at bidding. You don't need it to submit a bid, but you will need it to win one that requires it.
- It's spreading. PSPC says defence contracts, and other sensitive contracts outside defence, will need certification based on their risk level, and encourages suppliers to get ahead of it.
What Level 1 asks for
Level 1 is an annual self-assessment confirming you've put 13 security controls in place. They come from the Canadian Centre for Cyber Security's standard, ITSP.10.171, and fall into six groups:
- Access control: a list of user accounts, access limited to what each person needs, only approved systems and devices, and care not to publish sensitive information.
- Identification and authentication: individual accounts, strong passwords, approved devices only, and multi-factor authentication for administrator accounts and for systems that store the government's information.
- Media protection: wiping or destroying old drives, phones and USB keys.
- Physical protection: knowing who has keys and badges, and controlling entry.
- Network protection: a firewall that blocks unnecessary inbound connections, with public-facing systems separated from internal ones.
- System integrity: security updates applied promptly, and antivirus such as Microsoft Defender running with real-time scanning.
None of this requires a formal security program. PSPC's own guidance suggests a spreadsheet for accounts and devices, and a written policy only a few pages long.
How certification works
You complete the self-assessment through the government's online tool. PSPC says that if you've already reviewed the standard and your own policies, it takes less than an hour. You'll get a results page with an expiry date. You then confirm the result in your CanadaBuys supplier profile and include proof when you bid.
Keep evidence for the length of your attestation, or at least a year: account and device lists, access reviews, policies, patch logs, firewall settings and MFA configuration screens.
If you already hold a valid U.S. CMMC certification, Canada may accept it, case by case.
Where to start
Most of the work is knowing where the government's information lives in your business. PSPC suggests listing:
- where Government of Canada information is stored
- which systems, devices and people access it
- which cloud services and tools handle it
Then turn on MFA for every administrator account, write down a handful of short rules (passwords, approved tools, how access is granted and removed, how old devices are destroyed), and make sure updates and antivirus are running everywhere.
How we help
Managed EDR covers the antivirus control with 24/7 monitoring on top of Microsoft Defender, and gives you records you can point to. A security assessment gives you a plain-language view of where your business stands and what to fix first.
Want to know where you stand? Book a security call.