CPCSC – Accessing the Canadian defence supply chain
Canadian Program for Cyber Security Certification for defence
The Canadian Program for Cyber Security Certification (CPCSC) establishes the cybersecurity requirements applicable to Canadian defence suppliers that must protect certain sensitive contractual information. The program comprises three levels: level 1 includes 13 controls and an annual self-assessment; level 2 includes 98 controls with a third-party assessment; level 3 includes 200 controls with an assessment conducted by National Defence.
It is becoming strategic for manufacturers, technology companies, engineering firms, software vendors, integrators, and subcontractors that wish to participate directly or indirectly in Canadian defence supply chains. Its phased rollout began in 2026.
Indicative effort: level 1, approximately 1 to 3 months; level 2, often 6 to 12 months depending on maturity. For level 1, plan for approximately 30 to 80 internal person-hours and 40 to 100 Quantum Beyond hours. For full level 2 preparation, approximately 180 to 450 internal hours and 250 to 600 Quantum Beyond hours may be required. Level 3 requires a specific estimate.
Quantum Beyond can carry out the gap assessment, structure the controls, prepare the evidence, strengthen IAM, configurations, data protection, and monitoring, then prepare the organization for the applicable assessment.
Beyond compliance, the CPCSC can become a genuine commercial passport into the Canadian defence ecosystem, while durably strengthening the company’s cyber posture.
The strategic nature of our engagements demands impeccable confidentiality.
All information about your organization, along with the documents, exchanges, and projects entrusted to Quantum Beyond, is handled with the strictest confidentiality. It is never published or used as a reference without your explicit authorization.