In-house counsels are increasingly asked to rely on cybersecurity evidence that was not written for lawyers. A vendor may provide a SOC 2 report, ISO 27001 certificate, penetration test summary, cyber insurance certificate, or completed security questionnaire. The document may look reassuring. The harder question is whether it actually answers the risk question in front of the business.

The third step is to organize evidence before the next client request arrives. This may include policies, training records, access review logs, backup testing results, insurance documentation, vendor review records, vulnerability assessment results, penetration testing reports, or other assurance evidence.

On April 14, 2026, the Government of Canada formally introduced Level 1 of the Canadian Program for Cyber Security Certification. Level 1 will be required in select defence contracts beginning in Summer 2026. To become certified, suppliers must complete and attest to meeting all Level 1 criteria. That's not a distant deadline. For companies that haven't started preparing, it's closer than it looks

Not every defence supplier needs the same certification. Here’s how the levels work, what each one requires, and how to figure out where your business fits.

In 25 years of working in IT risk and governance, I've never witnessed threats change so quickly or carry so much uncertainty.

Let’s start with the basics. Most client security questionnaires are not trying to turn your firm into a technology company. They are trying to understand whether you have the fundamentals in place.