Readiness Assessment
CPCSC · Level 1 · Self-Assessment

Are you ready to bid on Canadian Defence contracts?

Starting April 2026, Canadian Defence contracts will require suppliers to self-attest compliance with the Canadian Program for Cyber Security Certification (CPCSC). This 5-minute assessment gives you a clear readiness picture against the 13 Level 1 controls — and flags exactly where the gaps are.

Time required
Approximately 5 minutes
Questions
14 targeted items
Framework basis
CCCS ITSP.10.171 Level 1
Cost
Complimentary

What you'll get

On-screen results delivered the moment you complete the assessment.

Overall Readiness Score
01

A single headline percentage indicating how close you are to Level 1 self-attestation.

Control Family Breakdown
02

Readiness by each of the 6 control families so you can prioritize where to focus.

Prioritized Gap List
03

Specific recommendations for every control where your answer was not "Yes."

1Contact
2Assessment
3Results

Before we begin

A few details so we can send you a copy of your results and follow up if you'd like expert guidance.

Please fill in all required fields and accept the consent notice.

Your information is used solely to deliver your results and to follow up about CPCSC readiness support. You can unsubscribe at any time.

1Contact
2Assessment
3Results

Level 1 Assessment

Answer Yes, Partially, or No / Not sure for each question. All 14 must be answered to generate your results.

Progress 0 of 14 answered
AC

Access Control

1
Account Management
Does your organization have a documented process for managing user accounts throughout their lifecycle, including creating, modifying, disabling, and removing accounts, with defined timelines for handling terminated or transferred employees?
2
Access Enforcement
Are access controls technically enforced in your systems so that users can only access the specific data, applications, and functions they are authorized for (for example, through role-based permissions, group policies, or access control lists)?
3
Use of External Systems
Does your organization have documented policies controlling when and how external systems (personal devices, contractor laptops, cloud services not managed by your organization) can be used to access your systems or handle sensitive information?
4
Publicly Accessible Content
Does your organization review its publicly accessible content (websites, public portals, downloadable documents) to ensure that sensitive or controlled information is not accidentally exposed, and train staff who publish content on what should not be made public?
IA

Identification & Authentication

5
User Identification & Authentication
Does every person who accesses your systems have their own unique user account (no shared or generic logins), and are they required to prove their identity (authenticate) before gaining access?
6
Device Identification & Authentication
Does your network verify the identity of devices (laptops, phones, servers) before allowing them to connect, meaning that unknown or unapproved devices are automatically blocked from joining the network?
7
Multi-factor Authentication
Is multi-factor authentication (MFA), requiring two or more verification methods such as a password plus a phone notification or security key, enforced for all user accounts, including both administrator and standard user accounts?
MP

Media Protection

8
Media Sanitization
Does your organization have a documented process to securely wipe or physically destroy storage media (hard drives, USB drives, old laptops, mobile devices) that contained sensitive information before disposing of them, recycling them, or transferring them outside your organization?
PP

Physical Protection

9
Physical Access Authorizations
Does your organization maintain a current, approved list of who is authorized to physically access the locations where your IT systems are housed (server rooms, offices with workstations, data closets), and is this list reviewed and updated on a regular schedule?
10
Physical Access Control
Are the locations where your IT systems are housed physically secured (through locks, badge/key card systems, or other controls), with access logs maintained and visitors escorted? Note: this applies to any location where systems processing sensitive information reside, whether that is a dedicated server room, a locked office, or a secured area in a home office.
SC

System & Communications Protection

11
Boundary Protection: Monitoring
Does your organization monitor and control network traffic at its network boundaries using firewalls or similar security tools? For cloud or hybrid environments, this includes virtual firewalls, security groups, or cloud-native boundary controls that govern what traffic enters and leaves your environment.
12
Boundary Protection: Segmentation
If your organization has any systems that are publicly accessible (for example, a website, customer portal, or public API), are those systems on a separate network segment from your internal systems, so that a compromise of the public-facing system does not give direct access to your internal network?
SI

System & Information Integrity

13
Flaw Remediation
Does your organization have a defined process to identify security vulnerabilities in your systems and install software and firmware security updates (patches) within established timeframes, for example, critical patches within 14 days?
14
Malicious Code Protection
Does your organization have antivirus or endpoint detection and response (EDR) software installed on all systems, with automatic updates enabled, regular scheduled scans configured, and the software set to automatically block or quarantine detected threats?
Please answer all 14 questions before continuing.
1Contact
2Assessment
3Results

Your CPCSC Level 1 Readiness Results

Prepared for

—
Readiness
—

—

—

Readiness by Control Family

A ≥80% family score indicates readiness for that control area.

Identified Gaps & Recommended Actions

— control area(s) flagged for attention.

Next Steps

  1. This assessment provides a general indication of CPCSC Level 1 readiness. It is not a substitute for a formal self-assessment against the full ITSP.10.171 Level 1 criteria (13 controls, 71 determination statements).
  2. CPCSC Level 1 requires all 13 controls to be satisfied. Any identified gaps should be addressed before self-attesting compliance.
  3. Level 1 self-attestation will be required at contract award for applicable National Defence contracts starting April 2026.
  4. Carbide can help you close gaps, build evidence artefacts, and prepare for self-attestation with confidence.
Schedule an Assessment Review