The CPCSC Level 1 requirements ask Canadian defence suppliers to complete an annual self-assessment against 13 baseline controls from ITSP.10.171. They must then post proof of the attestation and its expiry date in their CanadaBuys supplier profile. That proof also goes into any bid for a defence contract that requires Level 1.
The clock is already running. Public Services and Procurement Canada opened Level 1 to suppliers on April 1, 2026. The department said the requirement would appear in select defence contracts starting in summer 2026, so it may already be in the bids you’re reading.
Thirteen controls sounds like a light lift. But you’re signing your name to every one of them. This guide focuses on the two jobs that make that signature safe, which are shrinking your scope and building evidence you could defend if a contracting officer ever asked.
CPCSC Level 1 Comes Down to 13 Controls and One Signature
At Level 1, the accuracy of your claim rests entirely on you. There’s no outside assessor checking your work. You review your own environment against the 13 controls, decide whether each one is met, and sign an attestation.
Less outside scrutiny isn’t less responsibility. Your signature says every control is in place, every year you renew.
CPCSC Exists to Protect Defence Information Held by Suppliers
Sensitive defence information doesn’t stay inside government networks. It flows to the suppliers who build, maintain and support defence work, and the Canadian Program for Cyber Security Certification exists to protect it there. Canada’s federal cyber agency calls this specified information. Its standard, ITSP.10.171, sets out how to protect it in non-Government of Canada systems and organizations.
The threat picture explains the timing. The national threat assessment finds that Canada’s state adversaries are “becoming more aggressive in cyberspace.” It also names ransomware as the top cybercrime threat to Canada’s critical infrastructure.
The design offers some reassurance. Ottawa says it built CPCSC to reduce the burden on suppliers through a phased rollout, a domestic accreditation system and alignment with US NIST-based controls. That last point matters most for SMBs and nonprofits. Security work you’ve done for US customers may carry over.
Who Needs Level 1, and When It Reaches Your Contracts
Any supplier bidding on a Government of Canada defence contract that specifies CPCSC Level 1 needs a current attestation on file. The trigger is the contract. A five-person machine shop and a large integrator face the same requirement once a bid calls for it.
The rollout has moved in phases. The Government of Canada announced Phase 1 in March 2025. At the same time, the Standards Council of Canada began taking applications from organizations that wanted to become certification bodies.
Prepare before the requirement shows up in a bid you want. Fixing a gap under a submission deadline is how shortcuts end up in signed attestations.
Level 1 vs Level 2 vs Level 3: Each Level Adds Controls
Each CPCSC level asks for more. Public Services and Procurement Canada sets the control counts at 13, 98 and 130+, with Levels 2 and 3 adding an annual affirmation.
| Level | Controls | Ongoing obligation |
|---|---|---|
| Level 1 | 13 | Annual self-assessment and attestation |
| Level 2 | 98 | Annual affirmation |
| Level 3 | 130+ | Annual affirmation |
Outside assessment runs through accredited bodies. The Standards Council of Canada is the only Canadian body offering Third-Party Assessment Organization accreditation for CPCSC, and each certification body must first be accredited to ISO/IEC 17020. If your contracts move beyond Level 1, expect something closer to an independent security audit, where an outsider tests your claims.
ITSP.10.171 Is Canada’s Version of NIST SP 800-171
The rulebook behind every CPCSC level is ITSP.10.171, published by Canada’s federal cyber agency in 2025 as the Canadian version of NIST SP 800-171. Canada didn’t write its controls from scratch. It adapted the US standard.
For the self-assessment itself, you need the companion guide. ITSP.10.171-01, published in April 2026, mirrors NIST SP 800-171A Rev. 3. Its publisher says it makes “no substantial technical changes” beyond legal and policy differences. The official Level 1 criteria build on that Canadian guide and apply to the requirements in ITSP.10.171.
So US NIST templates, tools and training are largely usable. Work from Rev. 3 material, and stick to the 13 controls Level 1 covers.
Shrink Your Scope Before You Assess Anything
Scope decides how much work Level 1 takes, because every system that touches specified information falls inside your assessment. A sprawling footprint means more accounts to lock down, more devices to protect and more evidence to collect. A tight one means less of all three.
Bids issued from summer 2026 onward can carry the requirement, so suppliers preparing now avoid fixing gaps under a deadline.
Answer these questions before you open the assessment criteria.
- Systems. Which servers, file shares and applications store or process specified information?
- Users. Who can open it, including contractors and former staff whose accounts were never closed?
- Devices. Which laptops, phones and tablets have ever held a copy?
- Cloud services. Which email, file-sharing and backup services store it, even temporarily?
- Providers. Which IT firms, managed service providers or subcontractors can reach it?
- Reduction. Which of these could you move, consolidate or cut off before you assess?
Every system left in scope adds accounts, devices and evidence to manage, which is why consolidation usually pays off before the assessment starts.
The providers question is the easiest one to skip. If an outside IT firm can log in to systems holding specified information, it’s part of your scope. A structured vendor risk assessment process shows you exactly what each provider can reach. Moving specified information into one well-controlled location is often the fastest way to cut the work.
A Worksheet for the CPCSC Level 1 Requirements
Assess only against the government’s own Level 1 criteria. Blog paraphrases drift, this one included. Pull the 13 control IDs straight from the Level 1 criteria and ITSP.10.171-01, then track each one in a worksheet with these columns.
| Column | What to record |
|---|---|
| Control ID | Exact identifier from the official criteria |
| Requirement | One plain-language sentence |
| Status | Met, partly met or not met |
| Evidence | File name and location of the proof |
| Owner | Person who keeps the control working |
| Date checked | When you last confirmed it |
Expect basics like account management, multifactor authentication and malware protection, but confirm against the official wording. You’re attesting to the government’s text, not your memory of it. A cybersecurity risk assessment template adapts easily to these six columns.
Every Control Needs a Dated Piece of Evidence
A Level 1 attestation is only as defensible as the evidence behind it, so collect a dated artifact for every control before you sign. If a contracting officer ever questions your claim, “we do that” won’t hold up. A screenshot taken the day you assessed will.
Storing artifacts in one shared folder also means a new staff member can pick up next year’s renewal without starting over.
Evidence that holds up usually looks like this.
- Screenshots of security settings, such as multifactor authentication enforced for all users
- Configuration exports from firewalls, endpoint tools or cloud admin consoles
- Written policies with an approval date and a named owner
- Training records showing who completed what, and when
- User account lists that someone reviewed and signed off
- A saved or printed copy of your completed assessment results
Keep it all in one folder alongside the worksheet. Next year’s assessment then starts from that folder instead of from scratch.
Seven Steps From Scoping to a Posted Attestation
The Level 1 self-assessment follows the same pattern as any cybersecurity assessment, and only the last two of its seven steps involve CanadaBuys.
- Map your scope. Find every system, user, device, cloud service and provider that touches specified information, then shrink that footprint.
- Pull the official criteria. Download the Level 1 criteria and ITSP.10.171-01 so you assess against the published text.
- Assess each control. Mark all 13 as met, partly met or not met in your worksheet.
- Fix the gaps. Don’t attest to any control you haven’t fully met.
- Record evidence. Attach a dated artifact to each control and save your results.
- Attest and upload. Sign the attestation, then add the proof and its expiry date to your CanadaBuys organizational supplier profile.
- Renew on schedule. Set a reminder well before the expiry date, and include the proof in every bid that requires Level 1.
CPCSC vs CMMC Level 1: Same Roots, Different Paperwork
CPCSC and the US Cybersecurity Maturity Model Certification (CMMC) share NIST roots, but their Level 1 details differ enough that you can’t reuse one for the other unchanged. Under the US rule, CMMC Level 1 requires all 15 security requirements in FAR 52.204-21, plus an annual self-assessment and affirmation in SPRS. The US Department of Defense’s CMMC acquisition rule took effect on November 10, 2025. The table puts the two Level 1 programs side by side.
| Feature | CPCSC Level 1 | CMMC Level 1 |
|---|---|---|
| Controls | 13 | 15 |
| Source standard | ITSP.10.171 | FAR 52.204-21 |
| Assessment | Annual self-assessment | Annual self-assessment |
| Where it’s recorded | CanadaBuys profile | SPRS |
| In contracts from | Summer 2026 | November 10, 2025 |
The next tier up shows why one-to-one mapping fails. CPCSC Level 2 has 98 controls, while CMMC Level 2 rests on the 110 requirements of NIST SP 800-171. A US checklist won’t line up neatly with a Canadian one.
If you already hold a CMMC result, use it as a head start on your evidence. The two programs record results in different systems, so plan for two separate filings unless a contract tells you otherwise.
Quick Answers on CPCSC Level 1
What Are the Minimum Cybersecurity Requirements for a Canadian Defence Supplier?
A current self-attestation against 13 controls from ITSP.10.171, for contracts that specify Level 1. Higher levels require 98 or 130+ controls.
How Long Does a Level 1 Attestation Last?
One year. Your CanadaBuys profile shows the expiry date, so renew before it passes.
What Happens If You Don’t Have Level 1?
Your bid misses a stated requirement. Contracts that require CPCSC Level 1 expect proof of it in the bid.
Do You Need Special Qualifications or a Consultant?
No. Level 1 involves no outside assessor, so someone on your team who knows your systems can run it. If you’d like a second set of eyes on scope and gaps, we offer discovery calls at RiskAware.
Does a CMMC Level 1 Result Count for CPCSC?
Treat them as separate obligations with separate filings, in SPRS and CanadaBuys respectively.
Start With the Hardest Scoping Question
Can you name every cloud service that stores specified information today, including the file-sharing and backup tools staff set up on their own? That’s the scoping question most worth answering before your next bid.
If you can’t answer it with confidence, our free cybersecurity score shows where your business stands right now. It’s the same starting point trusted by hundreds of SMBs and nonprofits across Canada.
