CPCSC is Canada's new mandatory cybersecurity certification for defence suppliers and subcontractors, established in Budget 2023. Led by PSPC and DND in collaboration with Canadian Centre for Cyber Security. Modelled on US CMMC, based on ITSP.10.171 which aligns to NIST SP 800-171 Rev 3.
Level 1 (Live since April 2026, mandatory in select defence contracts since Summer 2026):
13 requirements including MFA (03.05.03), annual self-assessment via PSPC online tool, result shown in CanadaBuys profile. Prerequisite for Level 2.
Level 2 (Planned Spring 2027):
Full 98 requirements across 17 families, third-party assessment every 3 years by SCC-accredited bodies + annual affirmation.
Level 3 (In development):
130+ controls, assessed by National Defence for sensitive programs.
Scope includes anyone handling Specified Information (SI) - includes M365, cloud services, and MSPs/integrators with remote access. Key requirement is Canadian data sovereignty due to CLOUD Act concerns.
Why it matters now:
2025 federal budget allocated $81B+ to defence over 5 years. From Summer 2026, you must show CPCSC compliance in CanadaBuys to be eligible to bid, be awarded, and continue performing defence contracts.
Our Service:
CanITSM as your MSP handles scoping, Level 1 gap analysis, remediation roadmap, technical implementation, audit evidence collection, SIEM logging, Canadian data residency architecture, and readiness for both Level 1 self-attestation and Level 2 third-party assessment.