// SECURITY AND COMPLIANCE · HANS STUDY · ONTARIO, CANADA

Security and compliance readiness

Hans Study provides independent readiness work for CPCSC, CMMC and NIST SP 800-171, and ISO 27001, alongside security assessments, reviews, and a written policy pack. No CPCSC engagements have been completed to date; the readiness work here is built from NIST SP 800-171 and CMMC readiness work with small defence suppliers.

Program status

Program status as of October 1, 2026

CPCSC Level 1 (13 controls, annual self-assessment) has been available to suppliers since April 1, 2026, and is required in select defence contracts from summer 2026, at contract award.

CPCSC Level 2 (98 controls, third-party assessment by an accredited certification body) is planned for select contracts between April 2027 and March 2028 in PSPC's timeline; its latest overview gives no date. CPCSC Level 3 (130+ controls) is assessed by National Defence. Controls for all 3 levels come from ITSP.10.171, and the level a given contract carries is set through a contract cyber security risk assessment and stated in the RFP and the contract clauses, not chosen by the supplier.

CMMC Phase 2 (the US third-party assessment requirement) was suspended on July 13, 2026, pending review. Phase 1 self-assessment and DFARS 252.204-7012 still apply.

Advise

SC-02

CMMC and NIST SP 800-171 readiness

Independent CMMC and NIST SP 800-171 consulting for the defence industrial base: architecture review, gap assessment, and the technical work an assessment checks.
SC-03

ISO 27001 readiness

Gap assessment and readiness work toward ISO/IEC 27001 for small and mid-size organizations.
SC-04

Policy pack

Policies written for your shop, with the procedures behind them and a map to the evidence each one produces. For a Level 1 set you can fill in yourself, start with the free policy builder.

Assess

SC-05

Security assessments and reviews

Vendor-agnostic security assessments and reviews: program and gap assessments, architecture, network hardening.
SC-06

Vulnerability assessment

Authenticated and unauthenticated scanning of an agreed scope, findings ranked by business risk, and a rescan of what was fixed.
SC-07

Network security assessment and gap analysis

Segmentation, the firewall rule base, switch configurations, remote access, and logging compared against the standard you owe.

Questions

Which applies to my company: CPCSC, CMMC, or ISO 27001?

It depends on your contracts, your customers, and your sector. A scoping call sorts that out before anything is quoted. For CPCSC, the level a contract carries is set through a contract cyber security risk assessment and stated in the RFP and the contract clauses, not chosen by the supplier.

Where does CPCSC stand right now?

As of October 1, 2026, Level 1 has been available since April 1, 2026 and is required in select defense contracts from summer 2026, at contract award. PSPC's timeline puts Level 2, with third-party assessment by an accredited certification body, into select contracts between April 2027 and March 2028; its latest overview gives no date.

How is CPCSC different from CMMC?

Both come from the NIST SP 800-171 lineage, and CPCSC takes its controls from ITSP.10.171. CPCSC Level 1 requires MFA and the American CMMC Level 1 does not, and there is no mutual recognition between the programs.

What can I do for free before booking anything?

Read CPCSC, explained and the Study Guide to CPCSC Readiness, the free book. The policy builder and the CPCSC templates are free too.

What do the assessments cover?

The vulnerability assessment scans an agreed scope and ranks findings by business risk. The network security assessment compares segmentation, the firewall rule base, switch configurations, remote access, and logging with the standard you owe.

How is this work priced?

Each engagement is scoped on a call, and a written quote comes before any work starts.

Find out which framework actually applies

Which program reaches your organization depends on your contracts, your customers, and your sector. A scoping call sorts that out before anything is quoted.

All services

Book a scoping call Get in touch