CPCSC Level 1: What Canadian defence suppliers need

The Canadian Program for Cyber Security Certification (CPCSC) is a new mandatory cybersecurity program for suppliers who bid on Government of Canada defence contracts. Public Services and Procurement Canada (PSPC) leads it, with the technical standard set by the Canadian Centre for Cyber Security.

Level 1 became available to suppliers on April 1, 2026. Since summer 2026, select defence contracts have required Level 1 certification, checked at contract award rather than during bidding.

Level 1 requires an annual self-assessment against 13 security requirements. This guide covers what those requirements are, how the self-assessment works, and how it connects to the U.S. CMMC program.

What the Canadian Program for Cyber Security Certification is

CPCSC protects "specified information": any information, other than classified material, that a Government of Canada authority names in a contract as requiring safeguarding. The term replaces the U.S. concept of Controlled Unclassified Information (CUI) for the Canadian context.

Specified information can include contract details not meant for public release, controlled goods information, and protected information. PSPC runs the program, and National Defence will conduct the Level 3 assessments.

The program has 3 levels:

PSPC notes that Levels 2 and 3 are still under development, so their control counts may change. The levels build on each other, so work done for Level 1 carries forward. This article covers Level 1 only.

The standard behind CPCSC: ITSP.10.171

Level 1's technical requirements come from ITSP.10.171, "Protecting specified information in non-Government of Canada systems and organizations," published by the Canadian Centre for Cyber Security. The Cyber Centre describes ITSP.10.171 as a Canadian version of NIST SP 800-171, with no substantial technical changes between the two. PSPC describes the program as closely adapted from NIST SP 800-171 and SP 800-172, the same publications that underpin the U.S. CMMC program.

ITSP.10.171 organizes its full requirement set into 17 families, from access control and incident response to supply chain risk management and personnel security. Level 1 draws 13 specific requirements from 6 of those families.

Who needs Level 1 and when

You need Level 1 if a Government of Canada defence contract or solicitation names it as a requirement. PSPC is phasing in the requirement through select defence contracts, starting in summer 2026, so not every supplier has seen it yet.

PSPC’s Level 1 guidance doesn’t spell out how the requirement applies to subcontractors. If you supply a prime contractor rather than National Defence directly and you handle specified information, ask the prime or the contracting authority whether your subcontract includes a CPCSC requirement.

The 13 Level 1 security requirements

Each requirement uses the numbering from ITSP.10.171, which mirrors NIST SP 800-171.

On MFA, PSPC's Level 1 guidance requires it for privileged accounts and for systems that store specified information. The underlying ITSP.10.171 requirement also covers non-privileged accounts, so extending MFA to every account puts you ahead for higher levels.

Incident response, security awareness training, audit logging, and risk assessment all belong to ITSP.10.171's full 17 families, but none of them are among the 13 Level 1 requirements. Level 2 is expected to bring more of those families into scope.

How the self-assessment works

Level 1 is a self-assessment: you evaluate your own organization against the 13 requirements and attest to the result. The Government of Canada provides a free online tool at cyberpostureassessments.ops.cyber.gc.ca/cpcsc-pccc. Using it is optional, but PSPC encourages it because it includes guidance for each control. PSPC states that a supplier who has already reviewed their policies and read the standard can complete it in under an hour.

A few mechanics to plan around:

• The requirement is checked at contract award. You can submit a bid before completing it.
• Results carry an expiry date, so plan to re-run the assessment each year.
• You provide proof of self-attestation and its expiry date in your CanadaBuys supplier profile, and with your bid.
• You must retain evidence of your implementation for at least 1 year, so keep records on file that show how you met each requirement.

The broader ITSP.10.171 assessment methodology, used more fully for Levels 2 and 3, rates each requirement as "satisfied" or "other than satisfied." It scales assessment depth using Security Assurance Levels from 1 to 5, based on how much confidence the evaluator needs. The Level 1 tool simplifies that idea: you confirm whether each of the 13 requirements is actually in place.

CMMC and CPCSC: is there overlap

If you already hold a valid U.S. Cybersecurity Maturity Model Certification (CMMC), PSPC may accept it instead of the Level 1 self-assessment, on a case-by-case basis, after confirming it covers the required scope. Send your proof to PSPC for verification well before contract award.

The overlap exists because of the shared technical foundation: ITSP.10.171 and the NIST publications behind CMMC cover largely the same ground. If you already sell into the U.S. defence supply chain and hold CMMC certification, Level 1 should add little new work.

How to prepare

1. Confirm whether specified information applies to your contract. Ask your contracting authority, or check the solicitation language directly.
2. Inventory the systems that will handle specified information. Access control and boundary protection only work on systems you have identified.
3. Walk through all 13 requirements and mark your gaps. Pay close attention to controls that depend on written records, like account lists, approved device lists, and lists of who can enter secure areas. They're easy to overlook if your security has been informal.
4. Write down your account management and access control policies. The self-assessment asks what controls are in place today, so document what you currently do in enough detail to back up your answers. The Polaris Security Policy Starter Pack includes account management and access control templates you can adapt. If you run a manufacturing plant, see IAM for manufacturing for how to apply account management and MFA to both office and plant floor systems.
5. Run the online self-assessment tool once your gaps are closed. Do it well before contract award, so a failed first attempt doesn't hold up the contract.
6. Keep your evidence on file. Screenshots of MFA configuration, your physical access list, and patch logs all count. Keep them for at least 1 year and refresh them before each annual re-assessment.

PSPC's guide to meeting Level 1 includes practical, low-cost steps for each of the 13 controls, written for organizations of all sizes. If you're new to federal defence contracting, start there before hiring a consultant.

If your contracts are likely to require Level 2 or Level 3 later, document your Level 1 work thoroughly now. The evidence trail you build for 13 requirements becomes the base for the controls those higher levels add.

Sources

• Program overview, Public Services and Procurement Canada
• How to meet Level 1 cyber security certification requirements, Public Services and Procurement Canada
• Canadian Program for Cyber Security Certification: Level 1 criteria, Public Services and Procurement Canada
• Level 1 cyber certification scoping guide, Public Services and Procurement Canada
• Canadian Program for Cyber Security Certification: Level 1 backgrounder, Public Services and Procurement Canada
• Protecting specified information in non-Government of Canada systems and organizations (ITSP.10.171), Canadian Centre for Cyber Security

Sources checked October 2026.