CPCSC is Canada defence supply-chain cyber certification program, built on ITSP.10.171 — Canada profile of NIST SP 800-171 — for vendors bidding on federal defence contracts.
Vendors and suppliers who want to bid on or stay eligible for Government of Canada defence contracts that require cyber certification.
The core of what CPCSC asks you to put in place.
A Level 1 self-assessment is achievable in a few months once gaps are remediated. Third-party-assessed higher levels take longer and depend on assessor scheduling.
We scope your environment, determine the required certification level, run the ITSP.10.171 gap assessment, author your SSP and POA&M, and get you to a Level 1 self-assessment you can attest to — with groundwork laid for higher, third-party-assessed levels.
See CPCSC Readiness, or compare estimated CPCSC cost in CAD. Based in Toronto and led by a published CVE researcher, we deliver across Canada and the US with our partner Lorikeet Security.
The Canadian Program for Cyber Security Certification, Canada defence supply-chain cyber certification, built on ITSP.10.171, which is Canada profile of NIST SP 800-171.
Vendors that want to bid on or remain eligible for Government of Canada defence contracts requiring cyber certification.
Both build on NIST SP 800-171. CPCSC is Canada program and CMMC is the US DoD program, so work done for one substantially maps to the other.
Scoping, implementing the ITSP.10.171 requirements, writing a System Security Plan, and attesting to a self-assessment. Higher levels add third-party assessment.
The Canadian Centre for Cyber Security profile of NIST SP 800-171, the control set underpinning CPCSC.
Book a free discovery call. We will tell you whether CPCSC fits, what it would take, and roughly what it would cost.