For Canadian defense suppliers, CPCSC requirements can affect procurement readiness well before a contract is signed. Understanding where the requirement appears in an RFP, which certification level applies, and when evidence must be available can help teams avoid last-minute security work that puts an award at risk.
This guide explains how to identify CPCSC clauses early and prepare the technical scope, evidence, and attestation needed to stay ready through contract award.
Identifying CPCSC Solicitation Clauses and Cyber Security Risk Ratings
Defense solicitations issued by Public Services and Procurement Canada (PSPC) incorporate mandatory CPCSC requirements based on the cyber security needs associated with the contract. Suppliers should review the RFP, security requirements, and resulting contract clauses early to determine whether CPCSC certification is required and which level applies.
For Level 1, the requirement is currently an annual self-assessment covering 13 security controls. PSPC states that Level 1 certification is required at contract award rather than during the bidding process, while higher certification levels are being developed.
Early review gives technical teams time to define the Specified Information (SI) environment and address requirements before the procurement reaches its final stage. This is a critical part of the CPCSC certification process because the scope of the assessment depends on where SI is stored, processed, or accessed.
Fast-Tracking Boundary Scoping and Technical Remediation Under Bid Deadlines
Active solicitation deadlines can leave suppliers with limited time to determine which systems, devices, cloud services, and users fall within scope. Defining that boundary early helps prevent teams from taking on remediation work for assets outside the contract’s scope.
Once the environment is understood, teams can prioritize gaps against the Level 1 requirements:
- User accounts and access permissions
- Authentication and password practices
- Device and system management
- Security policies and employee training
- Physical and media safeguards
- Updates, logging, and security monitoring
Carbide’s CPCSC compliance platform collects technical evidence from system configurations, while our advisory team works alongside internal teams to address identified gaps. This combination supports the CPCSC certification process without leaving suppliers to interpret requirements or remediation priorities alone.
Navigating Attestation Timing Between Proposal Submission and Final Contract Award
Because Level 1 certification is required at contract award, suppliers should not treat proposal submission as the finish line. PSPC guidance requires suppliers to submit proof of Level 1 self-attestation and its expiry date through CanadaBuys at bid submission, while maintaining valid attestation status through contract award.
For procurements that take months to evaluate, tracking the attestation period matters. Suppliers should retain evidence supporting their assessment and ensure their certification remains valid when the contract is awarded. Level 1 guidance recommends retaining evidence for the duration of the attestation cycle, or a minimum of one year.
Prepare Your CPCSC Procurement Readiness with Carbide
A CPCSC requirement should be treated as part of procurement planning, not as a task to address after an award decision. Reviewing clauses early, defining the SI boundary, and preparing evidence can help suppliers reach contract award with their certification requirements in order.
Carbide combines automated evidence collection with dedicated advisory guidance to help defense suppliers interpret CPCSC requirements, address control gaps, and maintain readiness throughout the procurement process. Schedule a CPCSC demo to see how this approach can prepare your environment and evidence for the requirements attached to your next Canadian defense opportunity.
FAQs
When should a supplier start the CPCSC certification process?
Suppliers should begin as soon as a solicitation indicates that CPCSC requirements will apply. Starting early provides time to identify the SI boundary, address control gaps, and prepare the evidence needed for certification.
Is CPCSC Level 1 certification required when submitting a bid?
Currently, Level 1 certification is required at contract award rather than during the initial bidding process. Suppliers should still prepare early because the self-assessment must be complete and valid when the contract is awarded.
Share
