.svg)
CPCSC
Featured Insights
Bill C-8 vs CPCSC: Canada Now Has Two Cyber Mandates. Which One Reaches You?
Canada now runs two federal cybersecurity mandates that reach companies through entirely different doors. Bill C-8's Critical Cyber Systems ...
Filter by Tag
Mapping the CCSPA to ISO 27001, NIST CSF 2.0, and CPCSC: The Complete Crosswalk
This crosswalk maps the seven obligation areas of the Critical Cyber Systems Protection Act (CCSPA), enacted June 16, 2026 as Part 2 of Bill C-8,...
CPCSC & CMMC Cost in 2026: The 4 Factors
There is no single price tag for CPCSC or CMMC compliance, and any consultancy that quotes one before scoping your environment is guessing. The real...
CMMC Compliance Consulting for Canadian Defence Contractors
Canadian companies selling into the U.S. defence supply chain face a compliance requirement that is no longer theoretical. The Cybersecurity Maturity...
CPCSC Level 1 vs Level 2: The Cost Cliff Suppliers Miss
Canadian defence-adjacent suppliers keep running into the same pattern. A team clears CPCSC Level 1 in a few weeks, files self-attestation in Canada...
CPCSC Level 1 Scoping Before You Have a Contract
DND has been clear about direction and quiet about timing. Canada Buys is collecting expressions of interest, industry days are running, and the...
CPCSC Level 1 Self-Assessment: What Apr 14 Actually Requires
On April 14, 2026, the Government of Canada published the CPCSC Level 1 self-assessment guide, the scoping guide, and practical implementation steps....
CPCSC Compliance Consulting for Defence Contractors
CPCSC Level 1 attestation becomes a procurement requirement for Department of National Defence contracts in April 2026. Companies that can't attest...
Risk Assessment and Security Planning for ITSP.10.171
The majority of ITSP.10.171 control families deal with operational security: how you configure systems, manage access, protect data. The Risk...
SOC 2 to CPCSC: Extending Your Security Program
The question comes up consistently when companies with established security programs look at entering the Canadian defence supply chain: Do we need...
Physical Security and Personnel Controls Under CPCSC
Every other control family in ITSP.10.171 has a reasonable analogue in the commercial compliance world. Access control maps to SOC 2 CC6. Incident...
Protecting Controlled Information: Media and Communications Security (CPCSC)
In a compliance landscape that increasingly assumes cloud-first architecture, media protection controls tend to get deprioritized. The assumption is...
Incident Response and System Integrity Under CPCSC
An incident response plan that exists only in a shared drive is not evidence of preparedness. It is evidence of intent, and the Canadian Program for...
Security Awareness, Training, and Governance for CPCSC
The previous twelve posts in this series covered the technical and operational control families in ITSP.10.171: access control, incident response,...
Configuration Management and System Maintenance for Defence Contractors Under CPCSC
There is a specific phrase that comes up in nearly every environment that has never been through a formal configuration review: We know our systems....
Audit Logging, Monitoring, and Accountability for CPCSC
Most organizations produce logs. Application servers generate them, firewalls record them, identity providers track them. The volume is rarely the...
Supply Chain Risk Management Under CPCSC
For most of the history of Canadian defence procurement, cybersecurity obligations ended at the prime contractor's perimeter. A prime could hold a...
Access Control and Identity Management Under ITSP.10.171
Every security program has access controls of some kind. Password policies exist, MFA is probably enabled somewhere, and someone has a spreadsheet...
CPCSC vs CMMC: What Dual-Jurisdiction Contractors Need to Know
CPCSC (Canada) and CMMC (United States) both derive from NIST SP 800-171, so their control sets largely overlap. They differ in how each program...
CPCSC Level 1 Self-Assessment: A Practical Guide
CPCSC Level 1 is an annual self-assessment of your organization against the expected security requirements of the Canadian Program for Cyber Security...
CPCSC: What Defence Contractors Need Before April 2026
The Canadian Program for Cyber Security Certification (CPCSC) is Canada's mandatory cybersecurity certification for companies bidding on Department...
