What is the CPCSC?
The Canadian Program for Cyber Security Certification (CPCSC, in French PCCC) is the federal framework that requires defence suppliers to demonstrate a level of cybersecurity to protect unclassified contractual information. It builds on the ITSP.10.171 standard of the Canadian Centre for Cyber Security: 97 controls across 17 families.
The three levels
- Level 1, annual self-assessment: 13 requirements drawn from 6 ITSP.10.171 families, self-attested, with no third-party assessor. It is the baseline expected of most suppliers, launched in April 2026.
- Level 2, external assessment: the full ITSP.10.171 control set, verified every three years by an accredited certification body, with an annual affirmation.
- Level 3, government assessment: the highest requirements, with an assessment conducted by the Government of Canada, for the most sensitive information.
Why it matters for your organization
The required level appears in defence solicitations. The attestation is renewed every year: controls have to stay in place and documented, not only on the day it is signed.
For the detail of the levels, the timeline and how to prepare, see the CPCSC certification page.