NIST SP 800-171 and CMMC focused gap assessment
A scoping call covers what Level 2 would mean for a specific contract and where the gaps are likely to sit.
// CPCSC · LEVEL 2 · UNDER DEVELOPMENT
CPCSC Level 2
- 98 requirements
- Third-party assessment
- Every 3 years plus annual affirmation
- Under development; PSPC timeline April 2027 to March 2028
- Last verified: 2026-10-05
- Revised October 12, 2026
Level 2 assesses all 98 ITSP.10.171 requirements. Assessments are done by certification bodies accredited through the Standards Council of Canada, using assessors certified under the program, on a 3-year cycle with an annual affirmation in between. PSPC's April 2026 announcement planned Level 2 for select contracts from spring 2027, and its timeline page says April 2027 to March 2028; its September 29, 2026 program overview says Levels 2 and 3 are under development and gives no date. PSPC says suppliers "will first need to show they meet the new Level 1 controls", with Level 2 and 3 "requested later".
// WARN
The assessment methodology, the list of accredited certification bodies, the fee structures, and the rules for gaps found at assessment had not been published as of this page's verification date. That last one matters: there's no published position on whether a supplier can be certified with open items under a plan of action and milestones (a POA&M), which items would qualify, or how long it would have to close them. CMMC allows limited POA&Ms with a 180-day closeout; don't assume Canada will match that. What follows is the announced structure plus the way accredited certification bodies already work under other schemes. Check the updates log before booking anything.
// 01 · SCALE
The jump from 13 to 98
Level 1 asks whether you do sensible things. Level 2 asks you to prove it to a stranger: written policies, procedures people follow, a system security plan that matches the running network, evidence for every requirement, and a scope tight enough that the assessment doesn't wander across the whole business. Governance fails small shops more often than technology does. Firewalls get budget; documented procedures, separation of duties, and evidence habits are what the assessor reads first.
// 02 · THE ASSESSMENT
What assessors do
They sample and they triangulate. For each requirement: read what the SSP claims, ask the person responsible what happens, then ask for the artifact that shows it happening. When the 3 agree, the requirement closes quickly. When they don't, the pulling starts, and neighbouring requirements get pulled too. Interviews reach past IT to the engineer handling drawings, the office manager onboarding new hires, and the shop lead whose crew uses the enclave workstations.
// 03 · COMMON FINDINGS
The findings that show up first
- MFA on the main paths and missing on a secondary one
- Log review that exists on paper only
- Access lists with departed staff still on them
- SSP claims the evidence can't back
- Remediation registers whose dates keep sliding
- Specified Information found outside the agreed boundary
Every one of these is findable in your own rehearsal. Found by you, it's a task; found by the assessor, it's a result.
// 04 · SCHEDULE
The calendar math
| Milestone | Target, as of October 2026 |
|---|---|
| Contract-ready | As early as possible in 2027 |
| Assessment complete | Q2 2027 |
| Certification body engaged | Now, given queue risk |
| Internal rehearsal | Q1 2027 |
| Remediation | Now through Q1 2027, longer if the gap register says so |
| Gap assessment | Now (Q4 2026) |
If PSPC holds to the spring 2027 plan, the calendar is already tight, and a shop starting now should expect its first Level 2-eligible bids later in 2027.
A contained shop with current infrastructure is looking at roughly 6 months of part-time effort. A flat network with shared admin accounts and no logging is looking at 18 months and some capital. Measuring optimistically doesn't change the number.
References
- Cyber security certification for defence suppliers in Canada: Program overviewPublic Services and Procurement Canadacanada.ca
- Protecting specified information in non-Government of Canada systems and organizations (ITSP.10.171)Canadian Centre for Cyber Securitycyber.gc.ca
- CPCSC accreditation schemeStandards Council of Canadascc-ccn.ca
Outbound links open in a new tab. Source-pinned. If a vendor moves a doc, this block gets updated.