CPCSC Level 1: What suppliers actually need to secure – and how to prove it
By Arnold Villeneuve
There is no stand‑alone Government of Canada document that publishes a final, authoritative list of “CPCSC Level 1 security control requirements” yet. Public Services and Procurement Canada (PSPC) launched Phase 1 on March 12, 2025 and signaled an “upcoming Level 1 guidance document (Spring 2025)”—but that guidance is not posted as of today. Level 1 will be an annual self‑assessment aimed at protecting federal contractual information held below the classified level (not Controlled Information). Level 2, by contrast, is where ITSP.10.171 (effective Apr 2, 2025) applies for the protection of Controlled Information (CI).
Plan your Level 1 readiness around where unclassified contractual information lives and how you will show evidence of basic cyber hygiene, while keeping Level 2 scoped to a separate CI enclave when contracts actually include CI.
What Level 1 is—and what it isn’t
- Is: A baseline, self‑attested level meant to safeguard the ordinary, unclassified contractual information you exchange to bid, win, and execute defence work (think solicitations, statements of work, delivery schedules, invoices, and non‑public contract correspondence). PSPC states the program is designed to “protect federal contractual information held below the classified level,” with Level 1 delivered via annual self‑assessment. Canada.ca
- Isn’t: A CI regime. Controlled Information (CI) (Canada’s term for what the U.S. calls CUI) triggers Level 2 expectations anchored to ITSP.10.171 and eventually assessed by accredited third parties. Canada.caCanadian Centre for Cyber Security
The state of play (dates matter)
- Mar 12, 2025: GoC announces Phase 1 of CPCSC: new standard available, accreditation ecosystem opens, and a pilot focusing on self‑assessment for select contracts. Certification in Phase 1 is required at contract award, not at bid. Canada.ca+1
- Apr 2, 2025: ITSP.10.171 takes effect; it’s the Canadian version of NIST SP 800‑171, used to protect CI on non‑GC systems and scoped only to components that handle or protect CI (with explicit encouragement to isolate the CI domain). No substantial technical changes from 800‑171; differences are Canadian law/policy fit. Canadian Centre for Cyber Security
- As of Aug 25, 2025: PSPC’s CPCSC page still shows an “upcoming Level 1 guidance document” (Spring 2025). No public Level 1 control list is posted. Canada.ca
Scope from an assessor’s perspective (Level 1)
Object of protection: unclassified federal contractual information on contractor‑controlled systems (email, collaboration suites, contract repositories, ticketing, supplier portals, finance/ERP touchpoints for invoicing). Not CI. Canada.ca
Boundary: For Level 1, draw a pragmatic boundary around the workflows and systems where that contractual information is created, transmitted, stored, and disposed. Keep a separate, tighter enclave for CI (Level 2) when and if a contract includes CI—per ITSP.10.171 scoping guidance. Canadian Centre for Cyber Security
What evidence will Level 1 likely expect? (Self‑assessment mindset)
PSPC has not published a Level 1 control catalogue. Still, you can prepare without guessing by aligning to the self‑assessment nature of Level 1 and the contractual‑information focus. Build an evidence pack that shows policies exist, are implemented, and are working where that information flows.
Evidence pack blueprint (not an official control list):
| Area | What to Examine | Who to Interview | What to Test (lightweight) |
| Account & access hygiene | Joiner/mover/leaver records; access reviews for contract folders/mailboxes | IT operations (IAM), contract admin | Spot‑check a sample of disabled leavers; verify MFA on email/portals |
| Endpoint baseline | Endpoint config standards; AV/EDR deployment dashboards | EUC/desktop lead | Confirm EDR/AV installed & updating on random sample; check disk encryption enabled |
| Patch/vuln handling | Patch policy; monthly patch reports; high‑risk remediation notes | Infra lead; app owners | Validate patch cadence on a sample; verify exceptions documented |
| Boundary & email protections | Email security settings; spam/phish controls; safe‑links/attachments | Messaging admin | Send a harmless test (e.g., EICAR file where permitted) to confirm detection/quarantine |
| Data handling & disposal | Handling rules for unclassified contract data; media sanitization SOP | Records mgmt; helpdesk | Verify secure disposal process on one device; confirm repository retention settings |
| Physical/logical access to repos | ACLs on SharePoint/Drive; print device controls in contract areas | Facilities; data owners | Confirm non‑public contract folders aren’t world‑readable; test badging on entry points |
| Incident basics | Playbook for suspected compromise of contract info; contacts/escalation | SecOps; legal/PMO | Tabletop a minor phish incident; capture lessons learned |
| Vendor touchpoints | Clauses/terms for tools that host contract data (SaaS, MSP) | Procurement; vendor mgr | Confirm contractual privacy/security terms; confirm admin access logging |
Rationale: This mirrors what a self‑assessment must credibly demonstrate without importing Level 2/ITSP.10.171 wholesale. It stays laser‑focused on the contractual‑information footprint that PSPC says Level 1 exists to protect. Canada.ca
How Level 1 interacts with Level 2 (and why segmentation pays)
When a contract includes CI, you step into Level 2 requirements based on ITSP.10.171. Limit blast radius and audit scope by isolating the CI domain—separate identity plane (or at least dedicated groups), network segmentation, dedicated repositories, and strict administrative boundaries. Only components that handle or protect CI come into the Level 2 scope; your Level 1 footprint stays broad but lighter‑weight. Document this separation in your System Security Plan when Level 2 is in play.
The 60‑day Level 1 readiness sprint (actionable, low friction)
- Map contractual‑information flows. Inventory mailboxes, Teams/SharePoint/Drive locations, finance/ERP touchpoints, and any supplier portals that store or transmit non‑public contract data. Canada.ca
- Harden the obvious. Enforce MFA everywhere that touches those flows; close guest access where it’s not required; disable legacy auth.
- Prove your patch story. Produce one quarter of patch records showing routine cadence and documented exceptions.
- Show endpoint diligence. Demonstrate full AV/EDR coverage, disk encryption, screen‑lock policy, and removable‑media controls.
- Lock the boundary. Confirm email threat defenses and web filtering; verify that admin interfaces are not exposed to the internet.
- Tighten access. Re‑permission contract repositories to least privilege; show a completed access review with remediations.
- Sanitize and retire. Verify a working media sanitization process before devices leave your control.
- Vendor hygiene. Identify SaaS/MSP services that host contract data; ensure agreements address safeguarding and breach notice.
- Incident drill. Tabletop a phishing‑led compromise of contract communications; record the after‑action.
- Attest responsibly. Draft a concise, dated Level 1 self‑assessment statement with the above evidence cross‑referenced.
(These steps align with Level 1’s self‑assessment intent and the stated objective—protecting unclassified contractual information—without speculating on unpublished controls.) Canada.ca
Procurement timing: when will Level 1 actually gate you?
- Phase 1 (since Mar 2025): Certification gating happens at contract award, not at bid; pilot activity uses self‑assessment. Canada.ca
- Phase 2 (planned Fall 2025): Some contracts will require Level 1 (self‑assessment) and begin testing Level 2; Level 3 becomes accessible. Track your solicitations accordingly. Canada.ca
What we still don’t know (and won’t speculate on)
- The exact published Level 1 control set or checklist (PSPC flagged it as “upcoming”; not posted today).
- The final format of the self‑assessment tool and any scoring or evidence thresholds.
- Any model clauses that will eventually appear in RFPs beyond the high‑level program description.
When in doubt, cite the program pages and avoid claiming compliance to a non‑existent public list. Canada.ca
Bottom line
If you’re serious about being procurement‑ready, do two things now: (1) baseline the systems that hold your unclassified contractual information and be ready to self‑attest with credible evidence; and (2) stand up a clean CI enclave so Level 2 is contained to only what truly handles Controlled Information when a contract calls for it. That’s how you stay fast at bid time and credible at award.
Sources (primary)
- PSPC: Cyber security certification for defence suppliers in Canada — program purpose, Level 1 self‑assessment, “contractual information below the classified level,” phased timing, and the “upcoming Level 1 guidance” note (page last modified Apr 4, 2025). Canada.ca
- GoC news release (Mar 12, 2025): First phase of CPCSC announcement and pilot context. Canada.ca
- Cyber Centre: ITSP.10.171 landing — statement of purpose to protect CI in non‑GC systems. Canadian Centre for Cyber Security
- ITSP.10.171 (PDF, effective Apr 2, 2025): Canadian adaptation of NIST 800‑171, applicability to components that handle/protect CI, scoping/isolation guidance, no substantial technical changes from 800‑171. Canadian Centre for Cyber Security
1 thought on “CPCSC Level 1: What suppliers actually need to secure – and how to prove it”
It’s now Specified Information vs Controlled Information; CCCS content changes pending. It’s also safe to note that our Level 1 will include all that of CMMC plus MFA.
Comments are closed.