CPCSC Level 1 has 13 controls, all self-assessed, and they map to the basic safeguarding requirements in ITSP.10.171 (Canada's adaptation of NIST SP 800-171 R3). Each one is a plain, practical security practice, not a paperwork exercise, and most small and mid-sized defence contractors already have several of them in place without calling them by name.
Level 1 self-assessments went live in April 2026, and DND is expected to start requiring them on select solicitations this summer. If you sell to the Department of National Defence or sit anywhere in that supply chain, from Ottawa procurement offices to manufacturing floors in Waterloo, this is the floor you need to clear before Level 2's 97 controls arrive in April 2027. Our CPCSC Level 1 guide walks through the full self-assessment process; this piece breaks down what each of the 13 controls actually asks a contractor to do.
Access Control: Who Gets In, and What They Can Touch
1. Limit System Access to Authorized Users
This is the foundation control. Every account on a system that touches federal contract information has to belong to a known, approved person. No shared logins, no orphaned accounts from a contractor who left last year, no generic "admin" account three people use. In practice, this means a current user list that matches your active employee and contractor roster.
2. Limit Access to Authorized Transactions and Functions
Being allowed into a system is not the same as being allowed to do everything in it. This control asks you to restrict what each authorized user can actually perform, so a finance clerk cannot push software updates and a junior technician cannot export the entire client database. Role-based permissions, even a simple tiered structure, satisfy this.
Verifying What Connects to Your Network
3. Verify and Control Connections to External Systems
Vendors, cloud services, and remote partners all create doorways into your environment. This control requires you to know every external connection your systems make and to have a deliberate decision behind each one, not a connection that got set up once and was never reviewed again.
4. Control Information Posted on Publicly Accessible Systems
Company websites, public GitHub repos, and social media accounts are systems too. Someone needs to review what goes on them before it is published, so a well-meaning marketing post or an engineer's public code sample does not leak information tied to a federal contract.
Knowing Who and What Is on the Network
5. Identify Users, Processes, and Devices
You cannot secure what you cannot name. This control asks for unique identifiers, individual user accounts rather than shared ones, tagged devices, and named service accounts, so every action on the system can eventually be traced to a specific person or process.
6. Authenticate Identities Before Granting Access
Identification tells you who someone claims to be; authentication proves it. A password requirement is the minimum here, but contractors moving toward Level 2 readiness typically add multi-factor authentication now rather than retrofitting it later, since it becomes mandatory at higher levels anyway.
Protecting Media and Physical Spaces
7. Sanitize or Destroy Media Before Disposal or Reuse
Old laptops, decommissioned servers, and retired USB drives cannot simply go in the recycling bin. Storage media has to be wiped or physically destroyed before it leaves your control, closing off a surprisingly common data leak point for small firms that donate or resell old hardware.
8. Limit Physical Access to Organizational Systems
Server rooms, network closets, and any physical location housing systems in scope need a controlled point of entry, whether that is a locked door with key-card access or something as simple as a locked office and a sign-in sheet at a smaller shop.
9. Escort Visitors and Monitor Physical Access Activity
Anyone without standing authorization, contractors, delivery staff, clients touring the office, needs an escort while near systems in scope, and physical access activity needs some form of log. For a small consultancy in Calgary or Montreal running out of a single office, this can be a paper logbook next to the door.
Guarding the Network Perimeter
10. Monitor and Control Communications at External Boundaries
This is your firewall doing its job with intent behind it. Traffic entering and leaving your network at its external boundary, and at key internal boundaries, needs to be monitored and controlled, not left on factory default rules nobody has looked at since installation.
11. Use Subnetworks for Publicly Accessible System Components
Anything the public internet can reach, a web server, a customer portal, should sit on a separate subnetwork from your internal systems. This is basic network segmentation, sometimes called a DMZ, and it means a compromise of your public-facing web page does not hand an attacker a direct path to internal file servers.
Keeping Systems Patched and Clean
12. Identify, Report, and Correct System Flaws in a Timely Manner
Patch management, in plain terms. When a vulnerability is disclosed in software you run, you need a process to find out about it, assess whether it affects you, and apply the fix within a reasonable window rather than an ad hoc "we'll get to it eventually" approach.
13. Provide Protection from Malicious Code
Endpoint protection or antivirus software, kept current, running on the systems that touch federal contract information. This is the least exotic control on the list and the one most contractors already have covered, though CPCSC will want to see that it is actually active and updating, not installed once and forgotten.
Why These 13 Controls Matter Beyond DND Contracts
Every one of these practices also strengthens your posture against the privacy obligations already sitting on Canadian businesses, PIPEDA federally and Quebec's Law 25 provincially. Access control, media sanitization, and boundary protection are the same controls that keep personal information out of a breach disclosure filing. Contractors we work with across Toronto, Vancouver, and the Waterloo tech corridor generally find that clearing CPCSC Level 1 tightens up privacy compliance as a side effect, not a separate project.
The self-assessment itself is not the hard part. The hard part is having evidence, current user lists, patch logs, a network diagram showing your segmentation, ready before an assessor or a contracting officer asks for it. That is where most first-time self-assessments run into trouble, and it is exactly the gap our compliance readiness work is built to close before Level 2's 97 controls make the bar considerably higher in April 2027.
If you are bidding on DND work, or expect to soon, get your Level 1 self-assessment mapped out now rather than after a solicitation names it as a requirement. Contact traztech to talk through where your organization stands against these 13 controls.