Certification · Last verified
Canadian Program for Cyber Security Certification
Canada's cyber security certification for defence suppliers, run by Public Services and Procurement Canada and National Defence, with three levels. Level 1 requires an annual self-assessment of 13 security requirements, and it entered select defence contracts from summer 2026, underpinned by the Canadian Centre for Cyber Security's own standard.
- Class
- Certification
- Owner
- Public Services and Procurement Canada; National Defence
- Who asks for it
- Public procurement
- Last verified
What it is
The Canadian Program for Cyber Security Certification (CPCSC) is, in the government's own words, "an official cyber security certification in Canada for defence suppliers". Budget 2023 allocated $25 million over three years to establish it, and it was "officially introduced to the public" on 12 March 2025. The program is "underpinned by the Canadian Centre for Cyber Security's Canadian industrial cyber security standard" and is designed with "alignment with the United States (U.S.) National Institute of Standards and Technology-based controls". Level 1 "requires that suppliers identify the implementation status of 13 security requirements and controls".
Who owns it
The program is "Led by Public Services and Procurement Canada and National Defence".
Levels
- Level 1 —
Available to suppliers on April 1, 2026: requiring an annual cyber security self-assessment.
- Level 2 —
Requiring an external cyber security assessment every three years, led by an accredited certification body.
- Level 3 —
Requiring a cyber security assessment every three years, conducted by National Defence.
Who asks for it
The demand comes through Canadian defence contracting: the program "mandates cyber security standards for defence contractors", and "Level 1 requirements will be introduced in select defence contracts beginning in summer 2026".
Sources
Last verified:
This page is for information only; it does not accredit, certify or endorse any organisation. Requirements and programs change — always confirm against the primary source linked above.