TEKAP Team
admin
CPCSC is now a current requirement. Level 1 opened to suppliers on April 1, 2026, and has appeared in several National Defence solicitations since the summer. The next step is close: Level 2, which adds a third-party assessment, will be required for certain contracts starting in spring 2027.
This guide explains what Level 1 means in practice: the 13 controls, the attestation process, how Canada handles existing CMMC certifications, and a 90-day plan that also prepares you for Level 2. All information comes from Public Services and Procurement Canada (PSPC) guidance, last updated September 29, 2026, and the Canadian Centre for Cyber Security.
Level 1 is now active. National Defence is including it in certain contracts. Requirements follow each contract's risk level, so not every defence contract is affected. Commercial off-the-shelf purchases, for example, may be exempt.
Level 2 is next. It will apply to certain contracts starting in spring 2027 and will require an assessment every three years by a certification body accredited by the Standards Council of Canada (SCC). An annual affirmation between assessments is expected. Details will be confirmed when PSPC releases its Level 2 guidance.
The scope is growing. PSPC has said sensitive non-defence contracts will also use this standard, depending on each contract's risk.
When Level 1 applies, PSPC makes it a legal requirement at contract award, not at bid. Suppliers must still record their attestation and its expiry date in their CanadaBuys profile and provide it when bidding on contracts that require Level 1. If you wait until award to start, you will be implementing controls while the contract decision is pending. The safest approach is to complete your attestation before the solicitation.
CPCSC protects Specified Information (SI): sensitive, unclassified government information that a contract identifies as requiring protection when it sits in a supplier's systems. Three categories come up most often:
If your systems store, process or transmit this kind of information under a defence contract, you are in scope. Subcontractors handling SI under a defence contract are included too, because the requirement follows the information, not the contract tier. That is why prime contractors will want to check your readiness.
The levels build on each other: the 13 Level 1 controls are part of Level 2. Work you do now still counts if a future contract requires Level 2.
The program is based on ITSP.10.171, the technical standard published by the Canadian Centre for Cyber Security. It uses the same baseline as NIST SP 800-171, which is also the foundation of the US CMMC program. That matters for suppliers working on both sides of the border.
PSPC groups the 13 requirements into six cyber hygiene practices. Use this list as a self-audit: any control you cannot document today is a gap to close before your next bid.
You do not need a formal security program or major purchases to meet these controls. PSPC is clear that a few pages of short written rules, shared with staff and backed by evidence, are enough for Level 1.
Keep your evidence. The attestation is made in good faith and it binds your organization. PSPC asks suppliers to keep evidence for the attestation cycle, or at least one year: account and device lists, access review notes, policies, training records, patch and disposal logs, visitor logs, firewall settings and MFA configuration screenshots. The contract technical authority or your prime contractor may ask to see them.
CPCSC and CMMC use the same technical controls, and PSPC says suppliers should not have to meet two separate standards. A valid CMMC certification is one way to meet Level 1. Canada accepts it case by case after confirming the assessment covers the required scope, and may still check specific controls through the contract technical authority. Proof is sent to PSPC's Cyber Security Program by email.
Three common situations:
Days 1–30 (to mid-November): map. Trace where SI enters, moves through and rests in your systems, including at cloud vendors. Inventory accounts, devices and physical access. Rate each of the 13 controls as met, partial or missing. A poorly defined scope puts controls in the wrong place.
Days 31–60 (to mid-December): close the gaps. Work in order of impact. MFA on privileged accounts, disabling orphaned accounts and blocking unapproved devices take days, not months. Write the short policies Level 1 expects: passwords, approved systems, granting access, device approval and media destruction.
Days 61–90 (to mid-January): prove and attest. Assemble the evidence file, complete the self-assessment, save the results page and record the attestation in CanadaBuys. Schedule the quarterly account review and the annual renewal.
Looking ahead: if your contracts involve a lot of SI, use the time before spring 2027 to measure your gap against the full Level 2 requirements. Organizing your Level 1 evidence so it also serves Level 2 saves you from doing the work twice.
Quebec suppliers: you don't need to start from scratch. Companies registered in Quebec can join the Communauté de pratique Défense, a Cybereco initiative partly funded by Quebec's Ministère de l'Économie, de l'Innovation et de l'Énergie. Its diagnostic helps you determine whether you are in scope (days 1–30). Its templates align with NIST SP 800-171 and ITSP.10.171, so you can adapt your policies in days 31–60 instead of writing them from scratch. Forums and workshops connect you with other companies working on the same requirements. The community provides tools and support but does not assess or certify: the attestation remains yours.
A small business with a simple setup can complete this 90-day plan in-house. Outside help is most useful in complex environments: multiple sites, hybrid cloud, layered subcontracting, or preparation for Level 2.
What's the difference between CPCSC and CMMC? CPCSC is Canada's program for Government of Canada contracts; CMMC is the US program for Department of Defense contracts. Both protect sensitive unclassified information and are based on NIST SP 800-171, which Canada adapted as ITSP.10.171.
Does every DND contract require Level 1? No. Requirements depend on each contract's risk level. Some contracts, such as commercial off-the-shelf purchases, may not require certification at all.
We're a subcontractor. Are we in scope? Yes, if you handle Specified Information under a defence contract. The obligation follows the information, not the contract tier.
How much does Level 1 cost? The self-assessment and online tool are free. The real cost is closing gaps, which for most small and mid-sized suppliers means internal hours and configuration changes rather than purchases.
Do we need the attestation to bid? It is formally required at contract award, but PSPC also asks for it in your CanadaBuys profile and when you bid on a contract that requires Level 1. Have it in hand before the solicitation comes out.
How long do we keep the evidence? For your attestation cycle, or at least one year.
What's in Level 2? The full ITSP.10.171 standard, about 98 requirements across 17 families, assessed every three years by an SCC-accredited body, with an annual affirmation expected. It applies to select contracts from spring 2027. The 13 Level 1 controls are part of it.
Level 1 solicitations are already out. Suppliers that cannot demonstrate the 13 controls may not be ready when a contract requiring CPCSC attestation comes up.
TEKAP supports defence suppliers in Quebec and across Canada with CPCSC and CMMC advisory, in French and English: scoping Specified Information, gap analysis against the 13 controls, implementation, evidence files, attestation and Level 2 gap assessment. The gap analysis gives you a clear picture of where you stand and a prioritized list of actions.
Book your CPCSC gap analysis →
Our team of experts can help you implement the best practices discussed in this article. Contact us for a personalized consultation.
Contact Our Experts