Governance, risk & compliance
Canadian Program for Cyber Security Certification (CPCSC) 1.0
SecurityCanada
The CPCSC is Canada's official cyber security certification program for defence and government suppliers, managed by Public Services and Procurement Canada (PSPC).
It protects Government of Canada unclassified contractual information and Controlled Information (CI) held on suppliers' networks. The program is based on the ITSP.
10. 171 standard published by the Canadian Centre for Cyber Security, which adapts NIST SP 800-171 Rev 3 to the Canadian context.
Three certification levels address increasing sensitivity: Level 1 (self-assessment for basic cyber hygiene), Level 2 (third-party assessment against ITSP. 10.
171), and Level 3 (Department of National Defence assessment for highest-sensitivity contracts). The CPCSC aligns with international standards and seeks mutual recognition with the US CMMC program, supporting interoperability with Five Eyes allies.
Official reference: https://www.canada.ca/en/public-services-procurement/services/industrial-security/security-requirements-contracting/cyber-security-certification-defence-suppliers-canada.html
Assessment tiers & levels Lavawall supports
Lavawall assesses Canadian Program for Cyber Security Certification (CPCSC) at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Level 1 — Basic Cyber Hygiene | Annual self-assessment covering basic cyber hygiene practices to protect federal contractual information held below the classified level. Applicable to all Government of Canada defence suppliers. Covers fundamental practices including access controls, MFA, security awareness, patching, and incident reporting. Based on FAR 52.204-21 equivalents plus Canadian-specific additions including mandatory MFA. | — |
| Level 2 — Enhanced Security (ITSP.10.171) | Third-party assessment by an accredited certification body (3PAO) against the full ITSP.10.171 standard (Canadian adaptation of NIST SP 800-171 Rev 3). Required for contracts involving Controlled Information (CI). Covers 97 security requirements across 17 control families. Includes all Level 1 requirements plus comprehensive controls for access management, audit logging, configuration management, incident response, media protection, and supply chain risk management. | Yes |
| Level 3 — Advanced Security (DND) | Assessment conducted directly by the Department of National Defence (DND) for the highest-sensitivity defence contracts. Builds on Level 2 with enhanced security requirements derived from NIST SP 800-172. Addresses advanced persistent threats (APTs) and state-sponsored adversaries through enhanced controls for penetration-resistant architectures, advanced monitoring, cyber threat intelligence, and supply chain integrity. | Yes |
How Lavawall® helps you get to Canadian Program for Cyber Security Certification (CPCSC) compliance
Most of Canadian Program for Cyber Security Certification (CPCSC) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Canadian Program for Cyber Security Certification (CPCSC), and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against Canadian Program for Cyber Security Certification (CPCSC) in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Ready to tackle Canadian Program for Cyber Security Certification (CPCSC)?
Assess, remediate, and stay audit-ready for Canadian Program for Cyber Security Certification (CPCSC) — and every other framework you carry — from one Lavawall® console.
Lavawall® supports Canadian Program for Cyber Security Certification (CPCSC) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.