RESOURCE
Level 1 of the CPCSC is thirteen hygiene controls and a self assessment. Level 2, in select defence contracts from spring 2027, is 98 controls assessed by an accredited body, and ITSP.10.171 asks the cryptography question nine ways. A white paper on what to have on paper, and why the inventory also answers ITSM.40.001.
Fabric Networks
Canada now has a cyber security certification programme for defence suppliers, and it is no longer a proposal. Level 1 of the Canadian Program for Cyber Security Certification (CPCSC) became available on April 1, 2026, and Level 1 requirements are being written into select defence contracts from summer 2026. Level 2 follows in select contracts from spring 2027, and Level 2 is not a self assessment: an accredited certification body examines your organization against 98 controls drawn from the Cyber Centre's ITSP.10.171, the Canadian version of NIST SP 800-171.
Level 1 is hygiene. Thirteen controls, a self assessment, an annual affirmation. Most well run companies can do it in a few weeks.
Level 2 is different in kind, and the difference is largely about cryptography. ITSP.10.171 requires you to encrypt specified information in transit and at rest, to manage the keys that do it, to protect remote and wireless access with encryption, to protect the authenticity of communications sessions, and to say, in writing, what cryptography you have chosen to rely on. An assessor will ask you to show it. You cannot show what you have not inventoried.
That inventory is the first artefact to build, because it takes the longest, because it feeds a dozen other controls, and because it is the same artefact the Cyber Centre's post-quantum migration roadmap (ITSM.40.001) asks every supplier to government to produce anyway. A supplier who builds it once in 2026 answers two obligations with one piece of work.
If you supply a defence prime and have not yet built this inventory, the Discovery Program produces it in three months on the equipment you already own, labelled by how each finding was established, with a roadmap phased to your fiscal year. Request a scoping call, or start with the two minute risk check.
The Canadian Program for Cyber Security Certification is led by Public Services and Procurement Canada and the Department of National Defence. It was funded with $25 million over three years in Budget 2023, publicly introduced on March 12, 2025, and formally launched at Level 1 on April 14, 2026. Its purpose, in PSPC's words, is to protect "federal contractual sensitive information below the classified level" held on contractors' systems.
The programme has three levels.
Level 1 requires an annual self assessment against 13 controls, completed in the Cyber Centre's online self assessment tool and confirmed in the supplier's CanadaBuys profile, with evidence retained for at least one year. It became available on April 1, 2026, and PSPC states that Level 1 requirements "will be introduced in select defence contracts beginning in summer 2026."
Level 2 requires an external assessment led by a certification body accredited by the Standards Council of Canada, plus an annual affirmation, against 98 controls. PSPC states that Level 2 "will be added to select defence contracts beginning in spring 2027." Level 2 applies to contracts involving controlled defence information or complex cyber sensitive work.
Level 3 requires an assessment conducted by National Defence itself, plus an annual affirmation, against more than 130 controls, for the highest risk programmes. Its timeline follows Level 2.
The controls are "closely adapted from" NIST Special Publications 800-171 and 800-172. PSPC describes the Canadian standard as technically identical to the 172 controls in those two publications. The programme is designed to align with the United States Cybersecurity Maturity Model Certification, which matters to any Canadian supplier that also sells into the US defence industrial base: the same evidence should serve both.
Prime contractors are responsible for flowing the requirements down to their supply chains. If you supply a prime, the prime's Level 2 obligation becomes your problem on the prime's timetable, not the government's.
The Cyber Centre published "Protecting specified information in non-Government of Canada systems and organizations (ITSP.10.171)" on April 2, 2025, with a second release on October 28, 2025. It is, in the Cyber Centre's words, a Canadian version of NIST SP 800-171 Revision 3 with "no substantial technical changes"; the modifications reflect Canadian law and policy. Controls withdrawn by NIST in Revision 3 are kept as "not allocated" so the numbering stays interoperable with the US document.
"Specified information" is the Canadian term for what the US calls controlled unclassified information: any information other than classified that a Government of Canada authority identifies in a contract as requiring safeguarding.
The standard has seventeen families. Three of them were added in Revision 3 and are new to anyone who learned the US framework under Revision 2: planning, system and services acquisition, and supply chain risk management. The supply chain family (03.17) requires a supply chain risk management plan covering the research, development, design, manufacturing, acquisition, delivery, integration, operations, maintenance and disposal of the system. That is the clause through which your own suppliers become part of your assessment.
Level 1's thirteen controls do not test cryptography in any meaningful way. The only indirect reference is in the multifactor authentication guidance. A company can pass Level 1 without knowing what ciphers run on its network.
Level 2 cannot be passed that way. The following requirements are quoted from ITSP.10.171, second release.
03.13.08 Transmission and storage confidentiality. "Implement cryptographic mechanisms to prevent the unauthorized disclosure of specified information during transmission and while in storage." The discussion makes the scope explicit: the requirement "applies to internal and external networks and any system components that can transmit specified information, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios." It names TLS and IPsec as the mechanisms for transmission, and it points to the Cyber Centre's ITSP.40.111, Cryptographic Algorithms for UNCLASSIFIED, PROTECTED A, and PROTECTED B Information, as the supporting publication. ITSP.40.111 is the document that says which algorithms and key lengths are acceptable to the Government of Canada.
03.13.10 Cryptographic key establishment and management. "Establish and manage cryptographic keys in the system in accordance with the following key management requirements: [organization-defined requirements for key generation, distribution, storage, access, and destruction]." The supporting publications are ITSP.40.062 (Guidance on Securely Configuring Network Protocols), FIPS 140-3, and the NIST SP 800-56 and 800-57 key establishment and key management series. The requirement is organization defined, which means you must write down your own key management rules and then show that you follow them.
03.13.11 Cryptographic protection. "Implement the following types of cryptography when used to protect the confidentiality of specified information: [organization-defined types of cryptography]." The discussion adds that "Federal information processing standard (FIPS)-validated cryptography is recommended for the protection of specified information," with FIPS 140-3 as the supporting publication. Note the word recommended rather than required; the Canadian text is softer than the US CMMC assessment practice, which treats FIPS validation as a requirement. A supplier that also sells into the US should assume the stricter reading.
03.13.15 Session authenticity. "Protect the authenticity of communications sessions." The discussion names adversary in the middle attacks, session hijacking and the insertion of false information, and cites ITSP.40.062, NIST SP 800-52 (TLS), NIST SP 800-77 (IPsec VPNs) and NIST SP 800-113 (SSL VPNs). This is the control that reaches your VPN concentrators and the TLS configurations on every service that carries specified information.
03.01.12 Remote access requires that remote access be routed "through authorized and managed access control points" and that each type of remote access be authorized before connection. 03.01.16 Wireless access requires you to "protect wireless access to the system using authentication and encryption." 03.01.18 Access control for mobile devices requires full device or container based encryption on mobile devices holding specified information. 03.05.07 requires that passwords be transmitted "only over cryptographically protected channels" and stored "in a cryptographically protected form."
03.13.01 Boundary protection does not mention cryptography directly, but its discussion defines managed interfaces to include "encrypted tunnels implemented within a security architecture," and it points to the Cyber Centre's network zoning guidance, ITSP.80.022 and ITSG-38. Every encrypted tunnel at a boundary is therefore in scope twice: once as a boundary control and once as a cryptographic one.
Read together, these requirements ask one question in nine different ways: what cryptography protects specified information on your network, where, with what keys, and can you prove it?
Level 2 assessment practice in Canada is still being established; the Standards Council of Canada is accrediting the certification bodies and the first assessments have not yet been published. What follows is therefore drawn from the structure of the standard itself and from a decade of assessment practice under the equivalent US requirements, and should be read as a reasoned expectation rather than a published Canadian rule.
For 03.13.08 and 03.13.11, expect to be asked for an inventory of where specified information flows and is stored, and for each flow or store, the protocol, cipher suite, key length and certificate protecting it. For 03.13.10, expect to be asked for your written key management requirements and evidence of generation, distribution, rotation and destruction against them; manual preshared keys that have not changed since installation are the classic finding. For 03.13.15, expect configuration evidence for TLS and IPsec showing which versions and suites are enabled and which are disabled. For 03.01.12 and 03.01.16, expect an inventory of remote and wireless access paths and the encryption on each.
None of this can be produced from memory or from a network diagram drawn two years ago. It is produced by observing the network as it runs and recording what is actually negotiated, then reconciling that against what the policies say should be there. The gap between the two is the assessment finding list.
ITSP.10.171 does not mention post-quantum cryptography. That is worth stating plainly, because a supplier should not be told that CPCSC is a quantum mandate. It is not.
The overlap is in the artefact, not the rule. The Cyber Centre's ITSM.40.001, Roadmap for the migration to post-quantum cryptography for the Government of Canada, sets migration milestones for high priority federal systems by 2031 and for all remaining systems by 2035, and its first step for any organization is a cryptographic inventory. The inventory Level 2 needs for 03.13.08, 03.13.10 and 03.13.11 is the same inventory ITSM.40.001 needs for migration planning, with one additional column: whether each algorithm in use is one the migration will have to replace. ITSP.40.111, which 03.13.08 already points to, is the document the Cyber Centre will update as approved algorithms change.
A supplier who builds the inventory for Level 2 and adds that column has done the first ITSM.40.001 deliverable at the same time. A supplier who builds two separate inventories eighteen months apart has paid twice for the same work.
Dates in this section are PSPC's published dates. Where PSPC has given only a season, the season is quoted.
April 1, 2026: Level 1 self assessment available. Summer 2026: Level 1 requirements introduced in select defence contracts. Spring 2027: Level 2 added to select defence contracts, assessed by SCC accredited certification bodies. After Level 2: Level 3, assessed by National Defence, for the highest risk programmes.
Working backward from spring 2027, a supplier that expects to bid on Level 2 work needs its cryptographic inventory complete and its gaps remediated or formally planned by roughly the end of 2026, because a certification body will want a scheduling slot, the inventory will take weeks to build, and remediation of weak tunnels, expired certificates and manual keys takes a fiscal quarter when it touches production equipment. That is Fabric's reading of the calendar, not PSPC's statement.
Fabric Networks' view, separated from the public record above.
Level 1 is not where the risk is. Most suppliers will complete it with existing IT staff. The suppliers who will have a hard spring in 2027 are the ones who treated Level 2 as Level 1 with more boxes, and discovered in the assessor's first meeting that "show me the cryptography protecting specified information" is not a question their documentation can answer.
The cryptographic controls are the ones most likely to produce findings, for a structural reason: they are the only controls in the standard that depend on what equipment is doing right now rather than on what a policy says. Access control, training and incident response can be fixed with documents and process. A VPN tunnel negotiating a deprecated cipher to a remote site can only be fixed by finding it first.
A passive discovery is the right first step. Observing traffic at the network boundaries, without agents on endpoints and without touching production configuration, produces the inventory the standard asks for and ranks the findings by the consequence of the flow they protect. It does not decrypt anything and does not need your keys. It is what Fabric's Discovery Program does, and it was designed for operators who cannot take production networks down to look at them. Readers who are not ready for a call can take the two minute risk check first.
The remediation path need not be rip and replace. Most of the gaps a Level 2 inventory exposes are configuration and key management gaps on firewalls and VPN gateways the supplier already owns. Quantum-safe key delivery into those existing devices closes 03.13.10 and 03.13.11 findings and the ITSM.40.001 question at the same time, on the same equipment.
Finally, Calgary. The Quantum Defence Innovation Secure Hub announced for Calgary in August 2026 puts a concentration of Alberta defence suppliers on the Level 2 path within the same eighteen months. The suppliers who arrive at the Hub's first programmes with a dated cryptographic inventory in hand will be easier to contract with than the ones who arrive with a promise to produce one.
Confirm which of your current and planned contracts carry, or will carry, Level 1 or Level 2 requirements, and which primes you supply that will flow Level 2 down to you. Complete the Level 1 self assessment now if you have not; it is a precondition and it is quick. Commission a cryptographic inventory of the environment that handles specified information, scoped to the boundaries where that information enters and leaves. Use it to write the organization defined parts of 03.13.10 and 03.13.11, which an assessor will read first. Add the post-quantum column so the same document serves ITSM.40.001. Then plan the remediation into the 2027 budget with the assessment date, not the bid date, as the deadline.
Fabric Networks scopes this work in a twenty minute call and provides a written, fixed scope quote before any work starts. Request a scoping call, or request the PDF edition of this paper.
Public Services and Procurement Canada, "Canadian Program for Cyber Security Certification (CPCSC): Level 1," news release, April 2026. canada.ca (link)
Public Services and Procurement Canada, "Program overview," CPCSC, page modified September 29, 2026. canada.ca (link)
Public Services and Procurement Canada, "How to meet Level 1 cyber security certification requirements," page modified September 29, 2026. canada.ca (link)
Canadian Centre for Cyber Security, "Protecting specified information in non-Government of Canada systems and organizations (ITSP.10.171)," first release April 2, 2025, second release October 28, 2025. cyber.gc.ca (link)
Canadian Centre for Cyber Security, "Cryptographic Algorithms for UNCLASSIFIED, PROTECTED A, and PROTECTED B Information (ITSP.40.111)"; "Guidance on Securely Configuring Network Protocols (ITSP.40.062)"; "Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001)."
NIST, SP 800-171 Revision 3, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations," May 2024; FIPS 140-3, "Security Requirements for Cryptographic Modules."
Fasken, "Phase 1 launch of the cyber security certification program for Canadian defence contractors," June 2025 (for the SCC accreditation role and Level 3 assessment authority). Mondaq, "Canada just made CPCSC mandatory," April 17, 2026 (for the April 14, 2026 formal introduction).
Start with a conversation about your cryptographic posture.