CPCSC readiness for Quebec founders and operators. CPCSC is Canada’s defence supply-chain cyber certification program, built on ITSP.10.171, the Canadian profile of NIST SP 800-171. If you want to bid on or stay on federal defence contracts, certification is becoming table stakes. We get you from “we have no idea where we stand” to a Level 1 self-assessment you can attest to, and lay the groundwork for the third-party-assessed higher levels.
Quebec runs on the Montreal AI cluster, a deep SaaS bench, and a gaming industry with real scale, with Quebec City adding insurtech and govtech on top. It is also the strictest privacy jurisdiction in Canada by penalty exposure. Quebec Law 25 reaches up to $25 million CAD or 4 percent of worldwide turnover, whichever is greater, which is a different order of magnitude from PIPEDA. Section 12.1 requires meaningful disclosure when a decision is based exclusively on automated processing, and that lands squarely on AI products.
Most firms selling compliance in Canada know SOC 2 and hand-wave Law 25. We deliver both, bilingually where required, and we know the detail that matters: privacy impact assessments, data-portability windows, and the CAI’s breach-reporting expectations. If you sell in Quebec and into the US, you are running two regimes at once, and they are cheaper to scope together than to discover one at a time.
CPCSC is Canada’s defence supply-chain cyber certification program, built on ITSP.10.171, the Canadian profile of NIST SP 800-171. If you want to bid on or stay on federal defence contracts, certification is becoming table stakes. We get you from “we have no idea where we stand” to a Level 1 self-assessment you can attest to, and lay the groundwork for the third-party-assessed higher levels.
For the full service detail, see the CPCSC Readiness page. For fixed-price productized engagements, see pricing.
Book a free 30-minute discovery call. We’ll tell you whether this engagement fits, what it would cost, and when we could start.
Book a call