SOVEREIGN
Post-quantum readiness for federal, provincial, municipal and defence networks: a cryptographic inventory mapped to ITSM.40.001, a phased migration plan, and quantum-safe key delivery that keeps the keys in Canada.
ITSM.40.001 is the Government of Canada's roadmap: departmental migration plans were due by April 2026, high priority systems are to be migrated by the end of 2031 and everything else by 2035, with annual progress reporting in between. Every supplier to government inherits that timeline through procurement. Bill C-8 received Royal Assent in June 2026 and gives the federal government binding direction powers over designated operators in finance, telecommunications, energy and transport, which means departments will soon be asking their own suppliers the same questions they are being asked. The G7 call to action Canada signed in September 2026 starts every organization in the same place: a cryptographic inventory.
On October 1, 2026 the Treasury Board Secretariat's direction on cyber security readiness took effect, with every department's prioritized critical services list due November 30 and attack path diagrams, a complete Internet connection inventory and hardened edge devices to follow; section 7.3 carries the requirements into contracts. It is not a quantum direction, but it starts in the same place, and our requirement by requirement guide shows where the Discovery Program fits and where it does not.
Defence suppliers have a second clock. The Canadian Program for Cyber Security Certification put Level 1 requirements into select defence contracts from summer 2026 and adds Level 2, assessed by an accredited certification body against the 98 controls of ITSP.10.171, from spring 2027. ITSP.10.171 asks for encryption in transit and at rest, managed keys, protected remote and wireless access and session authenticity, which means a cryptographic inventory before the assessor arrives. Our CPCSC white paper sets out what to have on paper and why the same inventory answers ITSM.40.001.
Defence has its own clock. The NSA's CSfC Symmetric Key Annex now recognizes quantum resistant preshared keys as an accepted path for classified solutions, and allied programs are moving to software key agreement across mixed bearers. Canada's first Quantum Defence Innovation Secure Hub is being established in Calgary with $20.3 million from DND. The capability is arriving; the question for a Canadian program is who operates it and where the keys live.
Sovereignty is the first question, not the last. Where keys are generated, where the instance runs and who can be compelled to hand over data decide whether a solution is acceptable before any technical merit is weighed. Procurement cycles are longer than the threat timeline. Networks span jurisdictions, classifications and partners, and a plan that works for a data centre has to work for a field radio and a municipal control room too. Budgets are annual; the migration is a decade.
The Fall 2026 Discovery Program, scoped to the systems in your migration plan:
After the Discovery Program, if you want it: quantum-safe key delivery into the firewalls you already operate, run from a Canadian hosted private instance, and ongoing governance so the inventory stays current and the reporting stays honest.
Detect first. Every finding is labelled customer supplied, discovered or our judgment. Fabric Networks designs, supplies, installs and operates in Canada, from Calgary. The platform we operate is validated to FIPS 140-3 and its developer holds UK NCSC consultancy assurance; that is a UK credential and we say so. Fabric maps the platform's outputs onto the Canadian and NIST frameworks that apply to you. Keys are generated on demand and never stored or transmitted. Public demonstrations of the platform by allied defence integrators are recorded in the Library, marked as demonstrations, not as our deliverables.
Federal departments and agencies working to ITSM.40.001, provincial ministries and Crown corporations, municipalities running their own networks and control systems, defence and public safety programs, and the people who have to sign the migration plan.
Services for this sector
Guidance
Start here
On a private instance that Fabric hosts and operates in Canada. Keys are generated on demand and never stored or transmitted, so there is no key store to compel. The platform's developer is UK based and holds UK NCSC consultancy assurance; the instance, the operation and the data are Canadian.
Yes. Findings are mapped to ITSM.40.001 categories and the roadmap is phased against the 2031 and 2035 milestones, so the report can be lifted into the annual progress reporting departments already owe.
Partly, and we say exactly which parts. The direction asks for attack path diagrams, a complete Internet connection inventory, hardened edge devices and controlled vendor remote access; the Discovery Program produces the observed inventory behind those and covers the cryptographic part of edge hardening. Identity, logging and backup requirements stay with your team. The requirement by requirement mapping is in the Library.
Level 1 is a self assessment against thirteen hygiene controls and does not need it. Level 2, in select contracts from spring 2027, is assessed by an accredited body against ITSP.10.171, which requires encryption in transit and at rest, managed keys, protected remote and wireless access and session authenticity. The Discovery Program produces the observed cryptographic inventory those controls are assessed against, and the same inventory is the first ITSM.40.001 deliverable. The identity, training and incident response controls stay with your team. The white paper in the Library walks through the controls by number.
Yes. The quote is fixed scope and written, and we will structure it to fit the fiscal year, the procurement vehicle and the approval threshold you have to work within. Tell us the constraint on the scoping call.
The Discovery Program is scoped to the networks you name and the access you grant, and the report labels every finding by how it was established. Where classification limits what can be observed, that is recorded as customer supplied rather than discovered. Mixed bearer field communications are a use case the platform has been publicly demonstrated on by an allied integrator; that demonstration is in the Library, labelled as theirs.
Twenty minutes, no slides. We ask about your sites, what is driving the interest now and what a useful outcome looks like, and we tell you plainly whether a Discovery Program fits or whether a smaller first step is right.
Questions first? Read the answers buyers ask for most.