CPCSC

CPCSC Compliance Software with Expert Support

Canada’s defence supply chain has mandatory cybersecurity requirements. Carbide’s platform maps your controls to the ITSP.10.171 standard and puts credentialed advisors behind the implementation, so your program is ready before a contract is on the line.

Your Guide to CPCSC Compliance

The Canadian Program for Cyber Security Certification (CPCSC) is a mandatory cybersecurity standard for defence supply chain contractors, managed by Public Services and Procurement Canada (PSPC) and built on the control requirements of NIST 800-171 Rev, 3.

Carbide maps your controls to the CPCSC requirements, tracks your implementation status, and puts credentialed advisors behind the scoping and documentation decisions that determine whether your program holds up under scrutiny. As the standard continues to develop, Carbide keeps your controls current, so regulatory updates don’t require you to rebuild your program from scratch. Not sure where your current security program falls short? Assess your CPCSC Level 1 readiness and get a full gap report.

CPCSC eligibility is tied to your defence contracts, so the cost of falling short is a contract you can’t bid on or hold. Carbide builds your program around the requirements that apply to your scope. Not sure whether CPCSC applies to your contracts? See the questions we hear most from defence suppliers.

STRONGER SECURITY LEADS TO FASTER COMPLIANCE

DRIVE security & privacy by design
Achieve compliance by default

MENU
Design & Review
Design & Review

Establish a foundation to build your CPCSC compliance

Prepare for CPCSC compliance by mapping your organization’s security controls against ITSP.10.171, the Canadian standard built on NIST SP 800-171 Rev 3. Rev 3 requires 32% more verification than the Rev 2 standard used by CMMC, meaning organizations that supply both US and Canadian defence programs cannot rely on a single compliance program to satisfy both. With Carbide, you get a CPCSC command center that gives you a clear picture of where your current program stands against ITSP.10.171 and what needs to change before a contract deadline forces the issue.

Carbide helps organizations implement NIST 800-171, the foundational standard behind CPCSC. Explore our customer stories section to see that experience in action.

Take the free 5-minute CPCSC Level 1 assessment

Design & Review
Design & Review
Implement
Implement

Execute on your CPCSC compliance plan

Stop spending hours interpreting ITSP.10.171 and reconciling its differences from the Rev, 2 standard your US compliance program may already be built on. The Carbide platform auto-generates the practical and technical tasks required for CPCSC compliance from custom-tailored policies mapped to the specific control families your organization needs to satisfy. Carbide identifies the security issues to remediate, surfaces critical action items, tracks policy acceptance, and keeps your team moving without manual project management overhead.

Implement
Implement
Validate
Validate

Prove your compliance with CPCSC

Carbide gives defence contractors an efficient way to securely share their policies, tasks, controls, and supporting files with authorized customers, procurement officers, and assessors. For organizations being assessed against both CMMC and CPCSC, the differences between Rev, 2 and Rev, 3 create real complexity for assessors juggling two versions of the same standard. Carbide keeps your ITSP.10.171 evidence organized and current so your assessor has exactly what they need without your team managing two separate documentation processes manually.

Validate
Validate
Evolve
Evolve

Maintain a defensible CPCSC program between contract cycles

CPCSC is a new standard and its enforcement posture will develop as the Department of National Defence refines its expectations around ITSP.10.171. Carbide tracks your recurring compliance tasks, security awareness training completion, and annual requirement reviews so your program stays current without manual oversight. As both CMMC and CPCSC continue to evolve on different revision tracks, Carbide keeps your controls mapped accurately to each framework so a change in one doesn’t create undetected gaps in the other.

Evolve
Evolve

Everything you need for CPCSC compliance

  • CPCSC Plan

    CPCSC Plan

    Step-by-step implementation plan outlining every ITSP.10.171 control and requirement your organization needs to satisfy

    Build Your CPCSC Compliance Program

  • Customized Policies

    Customized Policies

    Our automated platform ensures your policies are tailored to your environment and meet CPCSC requirements

  • Policy Management

    Policy Management

    Reduce admin time with automated employee reminders and tracking

  • Security Awareness Training

    Security Awareness Training

    In-platform Carbide Academy videos on security and privacy best practices with a template library for common requirements

  • Evidence Collection

    Evidence Collection

    100+ technical integrations connecting to your tech stack to automatically capture compliance evidence mapped to ITSP.10.171 controls

  • Audit Support

    Audit Support

    Save time by giving procurement officers and assessors a read-only view of your CPCSC reporting dashboard

  • Robust Ecosystem

    Robust Ecosystem

    Carbide’s security and privacy services and network of assessment partners help Canadian defence suppliers meet CPCSC requirements faster

     

  • Multi-Compliance by Design

    Multi-Compliance by Design

    Already pursuing CMMC? Carbide maps both frameworks and identifies exactly where ITSP.10.171’s additional requirements go beyond your existing Rev, 2 program

  • Cloud Monitoring

    Cloud Monitoring

    Easily collect data with automated security monitoring, security assessments, and remediation tools to maintain a defensible posture across your cloud environment

Frequently Asked Questions

What is CPCSC?

CPCSC stands for Cyber Protection and Cyber Security Conditions. It is Canada’s official cybersecurity certification program for organizations operating in the defence supply chain, administered by Public Services and Procurement Canada in collaboration with the Department of National Defence, and based on NIST 800-171 Rev. 3. See the CPCSC program overview for official Government of Canada guidance.

How is CPCSC different from CMMC?

Both frameworks draw from NIST 800-171, but CMMC applies to US defence contractors under the Department of Defense while CPCSC applies to Canadian defence suppliers through Canada’s federal defence procurement framework. Organizations working across both supply chains will find significant control overlap but will need to satisfy each framework’s specific documentation and assessment requirements separately.

Who does CPCSC apply to?

CPCSC applies to Canadian organizations that hold or are pursuing contracts with the Department of National Defence or within the broader Canadian defence supply chain. Compliance is a direct contract requirement, not a voluntary standard.

If you are unsure whether your current program meets Level 1 requirements, Carbide’s CPCSC Level 1 Readiness Assessment gives you a clear view of where you stand before your contract window opens.

Is CPCSC based on an existing framework?

Yes. CPCSC is built on NIST 800-171 Rev. 3 through the ITSP.10.171 standard, which contains 97 core security controls. Organizations that have already implemented NIST 800-171 for US federal contracts will have a head start, but CPCSC runs on a different revision and introduces Canadian-specific obligations that require separate attention.

Does CMMC certification satisfy CPCSC requirements?

Not currently. There is no formal mutual recognition between CMMC and CPCSC. CMMC uses NIST 800-171 Rev. 2, while CPCSC is based on ITSP.10.171 and NIST 800-171 Rev. 3. Canada may accept a valid CMMC certification on a case-by-case basis after confirming it covers the required scope, so organizations should not assume an existing CMMC certification automatically satisfies CPCSC requirements.

What are the CPCSC compliance levels?

CPCSC has three compliance levels. Level 1 requires an annual self-assessment against 13 security requirements. Level 2 involves 98 controls and requires an external cybersecurity assessment led by an accredited certification body, conducted every three years, plus an annual affirmation. Level 3 includes 200 controls and requires a cybersecurity assessment conducted by the Department of National Defence, also every three years, plus an annual affirmation.

What happens if my organization doesn't meet CPCSC requirements?

Organizations that cannot demonstrate a conformant security program under CPCSC risk losing eligibility for defence procurement contracts. As enforcement tightens, gaps identified after a contract is awarded carry significantly higher remediation costs than gaps addressed during implementation.

When does CPCSC become mandatory?

CPCSC Level 1 began appearing in select defence contracts in summer 2026, and Level 1 certification is required at contract award for affected solicitations.

How long does CPCSC compliance take?

Preparing for CPCSC Level 1 readiness can take three to six months for small and midsize suppliers, depending on the organization’s existing security program and the gaps that need to be addressed. Starting early gives your team time to implement controls, collect evidence, and complete the required self-assessment before CPCSC requirements apply to your contract.

  • Book a Demo

    Book a Demo

    The Carbide platform gives you a clear roadmap and all the tools you need to get to your CPCSC destination. If you’re ready to get started, chat with us so we can show you how it works.

    Learn More
  • Get Expert Guidance

    Get Expert Guidance

    Need a human guide to keep you on your path? Check out our unique plans, where our information security experts will drive you to your destination.

    Learn More

See How Carbide Can Help You

Book a demo with one of our Security Solutions Advisors to learn how Carbide can fast-track your CPCSC compliance.

This field is for validation purposes and should be left unchanged.
By submitting this request you consent to receive emails from Carbide. You can opt-out from receiving emails at any time.