Not every defence supplier needs the same certification. Here’s how the levels work, what each one requires, and how to figure out where your business fits.
On April 14, 2026, the Government of Canada officially introduced Level 1 of the Canadian Program for Cyber Security Certification, known as CPCSC. Mandatory requirements begin appearing in select defence contracts this summer, with more to follow in 2027. If you hold defence contracts or plan to bid on them, this program applies to you.
CPCSC exists because Canada’s defence supply chain has become a consistent target for cyberattacks. Contractors and subcontractors handle sensitive, unclassified government information every day, and the era of self-declaration as a sufficient security standard is over. The government now requires suppliers to demonstrate that their cybersecurity controls meet a defined standard and to certify that status formally before contracts are awarded.
