CPCSC questions, answered

Contract by contract, yes. There's no blanket deadline; when a defense solicitation names a CPCSC level, meeting it is a condition of eligibility for that award.

Any supplier whose systems store, process, or transmit Specified Information under a Department of National Defence contract, at any tier of the supply chain. Company size and the share of revenue from defense work don't matter.

Level 1 is an annual self-assessment against 13 ITSP.10.171 requirements with a signed attestation. Level 2 is a third-party assessment of all 98 requirements every 3 years, with an annual affirmation. Level 3 is assessed by National Defence against 130-plus controls.

No firm date. PSPC's April 2026 announcement planned Level 2 for select contracts from spring 2027, and its timeline page says April 2027 to March 2028; its September 29, 2026 program overview says Levels 2 and 3 are under development and gives no date. The same announcement says suppliers "will first need to show they meet the new Level 1 controls", with Level 2 and 3 "requested later".

Yes. ITSP.10.171 requirement 03.05.03 and PSPC's Level 1 assessment criteria cover privileged and non-privileged accounts. PSPC's how-to page words the Level 1 duty more narrowly: MFA for privileged accounts and for systems that store Specified Information. The American CMMC Level 1 has no MFA requirement.

Not automatically. The programs share the NIST SP 800-171 lineage, but there's no mutual recognition. PSPC may accept a valid CMMC certification case by case at Level 1, after confirming the assessment covers the required scope; Level 2 and Level 3 recognition hasn't been announced. Implementation work carries over; attestations, portals, and assessments mostly don't.

Expect not. PSPC's pages do not address subcontractors directly; my reading is that the requirement follows the data, so each supplier holding Specified Information attests or certifies on its own account. Check the security clauses in your own contract.

Complete the self-assessment with PSPC's online tool, save the results page with its expiry date, and confirm the result and expiry date in the organizational supplier profile questionnaire in CanadaBuys. The certification has to be in place at contract award, not during bidding. PSPC also requires proof in your CanadaBuys profile and again when you submit a bid on a contract that requires Level 1.

The Canadian Centre for Cyber Security's adaptation of NIST SP 800-171 Revision 3, and the technical standard behind CPCSC. The second release, dated October 28, 2025, is current.

Not before you've scoped. Map where Specified Information lives and run a gap assessment first; most small shops find their biggest costs are documentation and architecture, not software.

Whenever the program does. See the updates log.