Additional information and support for suppliers about cyber security

The requirement for Canadian Program for Cyber Security Certification (CPCSC) will be implemented in phases, starting with the inclusion of Level 1 requirements in select National Defence contracts. This phased approach is designed to give the Canadian defence industry the necessary time to adapt to evolving cyber security standards. Information in this section applies to Levels 1, 2 and 3 and includes guidance, resources and support to help suppliers prepare for certification.

How to meet Level 1 cyber security certification requirements

On this page

• Resources to support certification readiness
• Supplemental guidance for suppliers
• Implementation milestones for Levels 2 and 3
• Cyber security risk assessments
• Contractual clauses
• Accredited third-party assessors
• Compliance and oversight
• Roles and expectations for contractors and subcontractors
• Help for suppliers
• Related links

Resources to support certification readiness

These resources are available to help prepare for all CPCSC certification requirements.

Technical guidance material is not intended to replace contractual obligations, security clauses, or official program direction. Suppliers seeking CPCSC certification must always refer to the requirements outlined in their specific contracts or solicitation documents.

Recommended order

It is recommended to use the following CPCSC guidance documents in the following order:

1. Procedural guidance – to better understand how to begin implementing CPCSC
2. Scoping guide - relevant to the certification level
3. System Security Plan (SSP) - Guidance to create your own plan

Available soon! Contractors' Supply Chain Implementation Guidance that explains how cyber requirements apply to your own supply chain and sub-contractors.

Available resources

1. Procedural guidance

Protecting specified information in non-federal systems and organizations provides a comprehensive overview of the CPCSC lifecycle across Levels 1, 2, and 3.

Who it's for:

• suppliers and vendors to the Government of Canada
• independent cybersecurity assessors
• procurement authorities
• client departments

How it can help:

When a supplier or vendor is in possession of what is considered Specified information, this document helps them in understanding:

• CPCSC readiness activities
• evidence documentation and expectations
• the scope decision process
• other ongoing monitoring requirements

Where to find it: Contact the CPCSC Client Service Team.

2. Scoping guide

The Level 1 cyber certification scoping guide helps organizations to determine what to include in their CPCSC Level 1 self-assessment.

Who it's for: Suppliers preparing or maintaining system-level documentation in preparation for certification or as evidence meeting the cybersecurity requirements.

How it can help: It identifies the assets, systems, devices, personnel and facilities that should be within scope when assessing cyber security requirements.

Where to find it: Access the Level 1 cyber certification scoping guide. Scoping material supporting readiness activities for achieving higher level certification will be made available later.

3. System Security Plan (SSP) guidance

SSP guidance supports the development of a system security plan associated with access to Specified Information and CPCSC requirements.

Who it's for: Suppliers preparing or maintaining system-level documentation in preparation for certification or as evidence meeting the cybersecurity requirements.

How it can help: This document helps bridge the cybersecurity requirements with the controls that help protect the Specified Information in accordance with the in-scope systems environment.

Where to find it: Contact the CPCSC Client Service Team.

4. (Coming soon) Supply Chain Implementation Guidance for industry

This document explains how CPCSC requirements apply across your own supply chain.

Who it is for:

Suppliers and vendors, including:

• prime contractors
• subcontract managers
• compliance personnel

How it can help: Explains how CPCSC requirements apply across the supply chain, including when working with subcontractors, third parties (also referred to as external service providers), and when the Specified Information is shared across multiple supplier tiers.

Where to find it: Available soon.

Supplemental guidance for suppliers

The following resources provide guidance, support, and information to help organizations enhance their cyber security practices and protect their operations, while also supporting those interested in pursuing Government of Canada procurement opportunities.

• Procurement Assistance Canada: provides procurement support for businesses and helps them learn how to identify their responsibilities as a supplier in meeting security requirements
• Canadian Centre for Cyber Security: advises and guides small and medium-sized enterprises on cyber security
• Canadian industrial security standard (ITSP.10.171): outlines baseline security controls and best practices for protecting sensitive information for small and medium-sized suppliers

Implementation milestones for Levels 2 and 3

Levels 2 and 3 are currently under development. Once they are established, a standardized cyber security risk assessment will evaluate each National Defence contract and determine which certification level is required. The required level of certification for defence suppliers will be set on a contract-by-contract basis and will be clearly communicated in Requests for Proposals (RFPs) and contract clauses.

This process will help procurement teams to apply the appropriate CPCSC level to ensure consistent, transparent security expectations for suppliers.

Cyber security requirements may be applied to many contracts outside the defence domain. As such, all Government of Canada suppliers are encouraged to continue to proactively assess and evaluate their current cyber security readiness. Defence suppliers should review the CPCSC ITSP.10.171 standard and contact the CPCSC if they are certified under the U.S. Cybersecurity Maturity Model Certification.

Once Level 2 and 3 certifications become available:

• Level 2 will consist of 98 controls, and require triannual external cyber security assessments led by an accredited certification body, plus an annual affirmation
• Level 3 will require 130+ controls, and will require triannual cyber security assessments conducted by the Government of Canada, plus an annual affirmation

Levels 1, 2 and 3 will be introduced in a phased approach.

Spring 2026 to Spring 2027

• The Government of Canada introduces a Level 1 self-assessment tool and support materials to help suppliers to prepare for Level 1 certification
• National Defence contracts will be assessed using a new contract “Cyber Security Risk Assessment”
• Level 1 to 3 certification requirements may be identified in select defence contracts as early as summer 2026; we will require compliance at a later date
• Guidance for levels 2 and 3 will be provided in advance to give suppliers sufficient time to:
  • understand the requirements
  • prepare for implementation
  • work toward certification

Spring 2027 to Spring 2028

• The requirement to have Level 2 or 3 certification will be gradually incorporated into select defence contracts 
• Level 3 requirements and certification compliance activities will be conducted by Government of Canada authorities

Cyber security risk assessments

The process will identify defence contracts with mandatory requirements and will determine the level of certification needed by:

• enabling procurement teams to consistently assess CPCSC requirements for each contract
• serving as an addendum to the Security Requirements Checklist to document CPCSC requirements in the contract
• providing clear definitions of different types of sensitive information
• supporting transparency and consistency in applying cyber security standards across procurement activities

Contractual clauses

These mandatory sections or provisions included within National Defence procurement documents, such as RFPs, will implement the following CPCSC requirements:

• specify the required CPCSC certification level for suppliers
• outline obligations for protecting sensitive information throughout the contract lifecycle
• provide clear definitions and expectations for compliance, helping suppliers understand and meet security standards

Accredited third-party assessors

To obtain Level 2 certification when it becomes available, suppliers will need to undergo a tri-annual assessment by an accredited third party.

Third-party assessors will:

• be accredited by the Standards Council of Canada, as the chosen accreditation body for the CPCSC
• assess and certify level 2 (moderate) cyber security certification requirements for suppliers

If you are interested in becoming a third-party assessor for the CPCSC, please contact accreditation@scc.ca.

Compliance and oversight

CPCSC Level 1 is based on supplier self-assessment. A supplier must define the systems, assets, facilities, personnel and activities included within the scope of its assessment and confirm that it has implemented the 13 Level 1 cyber security requirements.

Suppliers are responsible for retaining records and evidence supporting their self-assessment. They must maintain the applicable requirements throughout the period covered by their declaration. They must continue to meet these requirements whenever they access, process, transmit or store specified information under an identified defence contract.

Level 1 self-assessment and declaration

Before awarding a contract that requires CPCSC Level 1, PSPC will confirm that the supplier has recorded a current Level 1 self-assessment declaration in its CanadaBuys Supplier Profile.

This is an administrative confirmation of the supplier's CPCSC status and does not represent an independent technical assessment or certification of the supplier's systems, security controls or supporting evidence.

Suppliers are responsible for ensuring that their declaration remains accurate and current. It must be renewed in accordance with CPCSC program requirements and reviewed whenever a material change affects:

• the systems
• assets
• personnel
• facilities
• activities within scope

Program oversight reviews

PSPC may conduct risk-based program oversight reviews to support the consistent and credible administration of Level 1 certification.

A CPCSC officer may request information or records demonstrating that:

• the supplier has clearly defined the scope of its Level 1 self-assessment
• the supplier has completed a current Level 1 declaration
• the supplier retains records supporting its declaration
• the supplier has processes to implement and maintain the 13 Level 1 requirements
• material changes affecting the declared scope have been identified and addressed
• the information provided through the Level 1 process is complete and internally consistent

Level 1 oversight is intended to confirm the integrity of the self-assessment and declaration process. It does not replace a supplier's responsibility for assessing, implementing and maintaining its own cyber security requirements.

Where an oversight review identifies missing, outdated or inconsistent information, PSPC may require the supplier to:

• clarify or update its declaration
• provide relevant supporting records
• undertake corrective action in accordance with the applicable contract and CPCSC program requirements

Roles and expectations for contractors and subcontractors

Before permitting a subcontractor to access, process, transmit or store specified information, the contractor must:

• determine whether the subcontract requires access to specified information
• identify the applicable CPCSC requirements

The contractor is responsible for flowing the applicable CPCSC requirements into the subcontract and confirming that the subcontractor holds a current and appropriately scoped CPCSC declaration or certification before access to specified information is granted.

The subcontractor is responsible for:

• defining the systems, assets, personnel, facilities and activities within its assessment scope
• implementing and maintaining the applicable CPCSC requirements
• completing the required self-assessment or third-party assessment
• retaining records and evidence supporting its CPCSC status
• renewing its declaration or certification before it expires

Contractors must document the basis for their subcontractor applicability decisions. In cases where a subcontractor will not access specified information, contractors must retain a record supporting that determination.

Contractors must retain evidence that each applicable subcontractor holds a current CPCSC status and make that information available to Canada when required by the contract or requested through an authorized program oversight activity.

Contractors must confirm a subcontractor's CPCSC status:

• before the subcontractor first receives access to specified information
• before the subcontractor's declaration or certification expires
• when a material change affects the subcontractor's scope or security responsibilities
• periodically for as long as the subcontractor continues to access specified information

If a subcontractor's declaration or certification expires, is suspended or no longer applies to the work being performed, the contractor must take the actions required by the contract. These actions may include:

• suspending the subcontractor's access to specified information
• notifying the appropriate contracting or program authority
• implementing corrective action

A lapse in CPCSC status or a failure to maintain an applicable requirement is distinct from a suspected or confirmed cyber security incident involving specified information.

Suspected or confirmed cyber security incidents must be reported in accordance with the authorities, procedures and timelines established in the contract and applicable Contract Security Program guidance.

Help for suppliers

• Procurement Assistance Canada: provides procurement support for businesses and helps them learn how to identify their responsibilities as a supplier in meeting security requirements
• Canadian Centre for Cyber Security: advises and guides small and medium-sized enterprises on cyber security
• Information for small and medium businesses: provides cyber security advice and guidance tailored to small and medium businesses
• Canadian industrial security standard (ITSP.10.171): outlines baseline security controls and best practices for protecting sensitive information for small and medium-sized suppliers

Related links

• Government of Canada helping defence industry protect itself from cyber security threats (May 31, 2023)
• National Cyber Security Action Plan
• National Cyber Security Strategy
• Digital Governance Council
• Business Benefits Finder