CPCSC Level 1 Self-Assessment: What Canadian Defence Suppliers Need to Do

CPCSC Level 1 is the entry point of Canada's cyber security certification program for defence suppliers. It requires an annual self-assessment and asks suppliers to identify the implementation status of 13 security requirements and controls drawn from ITSP.10.171.

The purpose is practical: make sure suppliers preparing for defence contracts have the security basics covered before they handle sensitive, unclassified Government of Canada information. The official guidance says Level 1 certification will be required at contract award, not during the bidding process.

A valid CMMC certification may be recognized case by case if it covers the required scope, but Canadian suppliers should not assume equivalence without confirmation. CPCSC is aligned with U.S. technical controls, but it is still Canada's domestic pathway for defence procurement cyber expectations.

Level 1 matters for suppliers bidding on, or working under, defence contracts that require CPCSC Level 1. That can include smaller companies, subcontractors, service providers, technical vendors, professional services firms, and other organizations that may handle specified information on non-government systems.

Specified information can include unclassified contract details not meant for public release, controlled goods information, and protected information. The contract authority decides which information must be safeguarded. Your job is to know where that information lives and whether your systems, people, devices, and vendors can protect it.

If your organization is still trying to map broader Canadian cyber and privacy obligations, use GreenHat's Cybersecurity and Privacy Requirements for Your Organization tool first, then return here for the CPCSC-specific self-assessment work.

The 13 Level 1 controls are not meant to be mysterious. They are baseline controls around account management, least privilege, approved systems, public disclosure, user and device authentication, MFA, media sanitization, physical access, boundary protection, flaw remediation, and malicious-code protection.

For control-by-control implementation help, use the CPCSC Level 1 Control Library. Each control page includes the formal wording, plain-English explanation, implementation steps, evidence examples, auditor questions, and related controls.

The real work is proving that these controls are true in your environment. A small supplier does not need a giant policy library for Level 1, but it does need short rules, owner names, approved system lists, account and device records, MFA evidence, patching routines, and a way to show old devices or media are wiped or destroyed.

Use this GreenHat pre-check before completing the official Government of Canada self-assessment. It does not submit anything, certify anything, or replace the official tool. It helps your team decide whether the 13 controls are actually implemented, partially implemented, or still gaps.

The export is meant for an internal owner review. If several controls are partial or gaps, fix those before attesting. If most answers are implemented and the contract scope is more sensitive, use the result as the starting point for CPCSC Level 2 readiness planning.

Level 1 is a self-assessment, but self-assessment does not mean evidence-free. The official guidance says suppliers are responsible for retaining the results of the self-assessment. Once complete, suppliers should save the results page, expiry date, and proof needed for CanadaBuys or bid support when a contract requires CPCSC Level 1.

A defensible Level 1 file should be simple and boring: one folder, clear owner, current export date, and enough proof to show the 13 answers were not guessed. That is also what makes the transition to Level 2 easier if the next opportunity carries higher assurance expectations.

Level 1 is best for baseline cyber hygiene and lower-risk supplier situations. It starts to turn into a Level 2 planning conversation when the work involves controlled defence information, complex technical data, supplier systems deeply connected to the customer, subcontractors that can touch the information, or privileged IT and cyber security access.

The Government of Canada has described Level 2 as the path for more complex cyber-sensitive work, with external cyber security assessments led by accredited third-party assessment organizations once Level 2 becomes available. GreenHat's CPCSC Level 2 guide explains the 98-control readiness jump, evidence library, supplier flow-down, CMMC overlap, and 30/60/90 day preparation plan.

The move is not to over-engineer Level 1. The move is to use Level 1 as a clean baseline. If you cannot prove the 13 controls, Level 2 will be messy. If you can prove the 13 controls and your contract risk is rising, you have the foundation for a real readiness roadmap.

The most common mistake is treating Level 1 as a form instead of a security decision. If the team does not know where specified information lives, which systems are approved, whether MFA covers the right accounts, or whether old media is sanitized, the attestation becomes fragile.

The second mistake is ignoring the Level 2 signal. A supplier may only see a Level 1 clause today, but the customer, prime contractor, or future RFP may expect more if the work touches sensitive technical data or defence supply-chain dependencies. Capture the Level 1 evidence in a way that can grow.

These quick answers are written for suppliers trying to decide what to do next before a bid, contract award, or prime-contractor request.