A 40-person machine shop in Dorval makes brackets and structural parts for a tier-one supplier in Saint-Laurent. That supplier just landed work tied to a National Defence contract. The note it sent to every subcontractor was short: "Are you ready for CPCSC?"
The Canadian Program for Cyber Security Certification (CPCSC) is Canada's counterpart to the U.S. CMMC. Level 1 has been available since April 1, 2026, and it started appearing in select defence contracts in summer 2026.
For the Greater Montréal aerospace cluster, with its dense network of machining, surface treatment, composites and engineering firms, this is no longer a theoretical issue. Here is how to make sense of it.
TL;DR
- CPCSC has three levels: annual self-assessment (Level 1), external assessment every three years (Level 2) and assessment by National Defence (Level 3).
- It is built on the Canadian Centre for Cyber Security's ITSP.10.171 standard, the Canadian version of NIST SP 800-171, and uses the same controls as CMMC.
- Level 1 is 13 cyber hygiene controls: realistic for a small business, but you need evidence.
- Level 2 reaches select contracts starting in spring 2027, so now is the time to define your scope and close gaps.
CPCSC at a glance: one program, three levels
The program was officially introduced on March 12, 2025, and is led by Public Services and Procurement Canada (PSPC) and National Defence. Its goal is to protect "specified information": sensitive but unclassified government information entrusted to suppliers. Think non-public contract details, controlled goods information or protected information.
The reference standard is ITSP.10.171 from the Canadian Centre for Cyber Security. It mirrors NIST SP 800-171 Revision 3 with no substantial technical changes and organizes its requirements into 17 families. CPCSC uses the same underlying technical controls as the U.S. CMMC.
| Level | Who assesses | Frequency | Announced timeline |
|---|---|---|---|
| 1 | The supplier itself (13 controls) | Annual self-assessment | Available since April 1, 2026; in select contracts from summer 2026 |
| 2 | A certification body accredited by the Standards Council of Canada | Every three years, plus annual affirmation | In select contracts from spring 2027 |
| 3 | National Defence | Every three years, plus annual affirmation | Highest-risk scenarios only; no date announced |
Why Montréal's aerospace supply chain is in the front row
In aerospace, information flows downstream: from the prime to tier-one suppliers, then to tier-two and tier-three shops. Technical drawings, specifications and controlled goods data travel all the way to the shop that machines the part.
How requirements flow down to subcontractors will depend on each contract's clauses. But a prime that must protect specified information will reasonably want assurance that anyone receiving its drawings protects them too.
Many Québec aerospace suppliers also face a second source of pressure: they sell to U.S. primes subject to CMMC. Because the two programs share the same controls, one well-structured effort can serve both sides of the border.
The weak spots we tend to see in these businesses are very concrete:
- a shared "shop floor" account on production workstations;
- CNC programming computers still running an old version of Windows;
- drawings exchanged over personal email or USB keys;
- an ERP system reachable from home without multi-factor authentication.
A practical first move: ask your customer, in writing, which CPCSC level its contract requires, what information it will share with you and through which channel. The answers define your scope, your timeline and whether a self-assessment will be enough. They also show your customer that you are taking the requirement seriously, which matters when it is choosing which subcontractors to keep.
The 13 Level 1 controls, in plain terms
PSPC groups the 13 Level 1 controls into six cyber hygiene practices. Translated for a 40-person shop, they become this checklist:
- Manage user accounts: create, change and close accounts, especially on an employee's last day.
- Give people only the access they need: machinists do not need the quoting folder.
- Use only approved systems and devices.
- Prevent sensitive information from being shared publicly (website, social media, open cloud links).
- Use individual accounts and strong passwords.
- Approve devices before they connect to the network.
- Turn on multi-factor authentication.
- Wipe or destroy old devices securely.
- Keep a list of who can access secure areas.
- Control physical entry to the premises.
- Use basic network protections, such as a properly configured firewall.
- Apply security updates, ideally under a written patch management policy.
- Use up-to-date antivirus and anti-malware software.
The self-assessment is completed through a government online tool. Proof and its expiry date then go into your CanadaBuys supplier profile. Keep your evidence for the full attestation cycle, or at least one year.
Scoping: where does specified information actually live?
PSPC asks suppliers to know where government information is stored, which systems and people can access it, and which cloud services process it. This is the most underestimated step.
Back to the Dorval shop. Drawings arrive by email to three people, get saved on a file server, are copied to the CNC programming station, then sometimes moved to the machine on a USB key. Every one of those steps is in scope.
For a small business, the winning strategy is often an enclave: a limited set of accounts, workstations and folders where specified information is allowed to live. The smaller the enclave, the simpler compliance becomes, especially when it comes to keeping the production floor out of scope. The specifics of industrial systems are covered in our article on manufacturing and OT cybersecurity.
An attestation is not just another form
The Level 1 self-assessment is a formal statement to the Government of Canada. Answering "yes" to a half-implemented control can have contractual consequences. Have your legal counsel confirm the scope of your commitments before you sign.
For each control, keep simple, dated evidence:
- a screenshot of the admin console showing MFA enforced for all accounts;
- the account list, reviewed and signed off each quarter;
- a patch compliance report from your management tool;
- the visitor log and the list of active badges.
An independent review before you attest avoids unpleasant surprises. It is one of the deliverables of our cybersecurity audit: every control is verified, and every gap comes with a prioritized fix.
Start preparing for Level 2 now
Level 2 covers a much broader set of ITSP.10.171 requirements: logging and audit, configuration management, incident response, training, encryption and supply chain risk management. The assessment will be performed by an accredited body, based on evidence.
A few steps worth starting this fall:
- Run a full gap analysis against ITSP.10.171, not just the 13 Level 1 controls.
- Write a description of the in-scope system: network, workstations, cloud services and information flows.
- Prioritize the gaps that take time: centralized logging, network segmentation, replacing end-of-life systems.
- Line up an assessment body early, since calendars are likely to fill once demand picks up.
Suppliers that treat Level 1 as a starting line rather than a finish line will be the ones that keep their place in the defence supply chain.
Frequently asked questions
Does a U.S. CMMC certification count for CPCSC?+
It can. The Government of Canada may accept a valid CMMC certification on a case-by-case basis, once it confirms the assessment covers the required scope. Both programs rely on the same underlying technical controls, which makes life easier for suppliers that also sell to U.S. primes.
Is CPCSC Level 1 required when I submit a bid?+
According to Public Services and Procurement Canada, the Level 1 self-assessment is required at contract award, not during the bidding process. You must still record proof of your self-assessment and its expiry date in your CanadaBuys supplier profile. Read each solicitation's instructions carefully.
Do all defence contracts require CPCSC certification?+
No. The government is adding it to select contracts based on risk, and commercial off-the-shelf contracts may be exempt. The program could later extend to other sensitive contracts outside defence.
Can I attest to Level 1 without using the government's online tool?+
Yes, attesting without the tool is allowed, but the government strongly encourages using it. The tool walks you through each control and shows an expiry date at the end, which you should print or save.