Top CPCSC Consultants in Canada (2026): A Buyer's Guide

Truvo Cyber is a Canadian cybersecurity firm that prepares defence suppliers for the Canadian Program for Cyber Security Certification (CPCSC): scoping, gap assessment against ITSP.10.171, control implementation, the Level 1 self-assessment, and readiness for Level 2 third-party certification. CPCSC Level 1 became available on April 1, 2026 and is required in select defence contracts from summer 2026, at contract award. Level 2 is scheduled for select contracts from spring 2027. This guide sets out how to evaluate a CPCSC consultant and compares nine Canadian providers, including us, on specialty, location, frameworks and engagement model.

CPCSC is new enough that the consultant market is still forming. In October 2026 we found Big 4 practices, national accounting firms, managed security providers, platform vendors and small specialists all selling CPCSC readiness, and the Government of Canada publishes no official list of consultants. Buyers have to judge each firm on its own evidence.

This page is for the defence supplier who has seen CPCSC in a solicitation or a prime contractor's flow-down clause and needs to pick a firm to get ready. The first half covers the criteria that predict whether a CPCSC engagement holds up when the contract is awarded. The second half compares the providers we could verify. We list ourselves first because leaving ourselves off would be odd, and we describe every other firm as accurately as public information allows.

If you want the program basics first, our CPCSC certification guide covers the levels, and the CPCSC Level 1 Readiness Scorecard gives you a benchmark before you scope a vendor.

CPCSC in 2026: the dates and levels that set your timeline

CPCSC has three levels, all based on ITSP.10.171, the Canadian standard closely adapted from NIST SP 800-171 and 800-172. Public Services and Procurement Canada (PSPC) runs the program with the Department of National Defence (DND).

Two details change how you plan. Level 1 is required at contract award, not during bidding, so the deadline is the date you win work. And SCC accredits Level 2 certification bodies as third-party assessment organizations (3PAOs) under ISO/IEC 17020; as of October 2026 we could not find a public list of accredited CPCSC certification bodies, so assessor capacity for 2027 is still an open question.

How to evaluate a CPCSC consultant in Canada

The best predictor of a good CPCSC engagement is whether the consultant scopes the controlled information first and the controls second. The seven criteria below separate consultants who get you through contract award from those who sell a generic NIST checklist.

1. Scoping before controls

CPCSC applies to the systems that handle the controlled information in your defence contracts, and a tight scope is the biggest cost lever you have. A good consultant starts by mapping where that information flows (email, file shares, engineering workstations, cloud tenants) and proposes an enclave or segmented scope where it makes sense. Our post on CPCSC Level 1 scoping before the contract goes into the decisions.

2. Level 1 now, Level 2 by design

CPCSC Level 1 covers 13 controls; Level 2 covers 98. A consultant who builds Level 1 as a standalone checklist leaves you to rebuild for Level 2 in 2027. Ask how the Level 1 work feeds a Level 2 program, including the system security plan and plan of action that Level 2 assessors expect.

3. Consultant and certification body must be separate

The consultant who prepares you for CPCSC Level 2 cannot be the body that certifies you. SCC accredits Level 2 assessors under ISO/IEC 17020, which carries impartiality requirements. Ask every firm whether it intends to become a CPCSC certification body; if it does, it cannot also be your consultant.

4. CMMC and dual-market experience

CPCSC and the US CMMC program share the NIST SP 800-171 foundation, and suppliers selling to both governments face both. A consultant who has worked across CPCSC and CMMC can build one control set for both. PSPC's Level 1 guidance says it may accept a valid CMMC certification case by case, after confirming the assessment covers the required scope. Recognition is not automatic, and no equivalent Level 2 pathway has been published.

5. Framework breadth beyond CPCSC

Many defence suppliers also sell commercially and get asked for SOC 2 or ISO 27001. ITSP.10.171 controls overlap heavily with both. A consultant who maps SOC 2 onto CPCSC builds the program once and evidences it several ways.

6. Fit for small suppliers and on-prem environments

The CPCSC supply chain includes many small machine shops, engineering firms and manufacturers running on-prem servers, shop-floor equipment and shared workstations. Ask how many engagements the consultant has run on infrastructure like yours, and whether it can work with a small IT team or a managed service provider.

7. Fixed price after scoping

A CPCSC quote is only meaningful after scoping, because scope sets the effort. Once scope is agreed, a consultant who knows the work can fix the price and the calendar. Ask for a written plan with the Level 1 self-assessment date and the Level 2 readiness milestones.

Frequently asked questions about CPCSC consulting

How much does CPCSC consulting cost in Canada?

Costs vary with scope and level. Public reference points: Markham firm RiskAware publishes CAD $4,000 to $8,000 for a Level 1 gap assessment. In PSPC's 2025-26 program evaluation, 46% of sub-contractors expected to invest less than $50,000, while 29% of consultants projected $150,000 to $175,000. Our CPCSC and CMMC cost guide explains the factors.

When do I need CPCSC Level 1 and Level 2?

CPCSC Level 1 has been available since April 1, 2026 and is required in select defence contracts from summer 2026, at contract award. Level 2 third-party certification is scheduled for select contracts from spring 2027. Check each solicitation for the level it names.

Can my CPCSC consultant also certify me?

No. Level 2 certification is done by certification bodies accredited by the Standards Council of Canada under ISO/IEC 17020, which requires impartiality. The firm that builds your controls cannot assess them. Level 1 is a self-assessment, so a consultant can support it directly.

Top CPCSC consulting firms in Canada

The list below covers nine providers with a public CPCSC offering, checked against each firm's own website in October 2026. We left out firms whose CPCSC service we could not verify, and US firms that list Canada among other regions. Several national firms with defence practices (MNP, KPMG, Deloitte, Calian, CGI) may offer CPCSC work that we could not find on their public sites.

1. Truvo Cyber (Toronto / Ottawa)

One-line positioning. Canadian security consultancy that builds a working security program first, then evidences CPCSC, CMMC, SOC 2 and ISO 27001 on top of it.

What we do well. We run fixed-price CPCSC engagements across Assess, Build and Operate, including a CPCSC Accelerator that covers scoping, gap assessment against ITSP.10.171, control implementation, GRC platform setup and Level 2 readiness. The same program carries SOC 2, ISO 27001, CMMC, PIPEDA and Law 25, and we work on on-prem and hybrid infrastructure as well as cloud.

Best fit for. Defence suppliers that also sell commercially and need SOC 2 or ISO 27001, suppliers selling to both Canadian and US defence, and companies with on-prem or hybrid environments in scope.

Notable signals. Founded 2018, offices in Toronto and Ottawa, SOC 2 Type II attested ourselves, 19 published guides on CPCSC domains and Level 1 requirements.

Caveats. We are deliberately small. We are not a certification body and do not intend to become one, so we coordinate your Level 2 assessment with an accredited assessor.

2. PwC Canada (national)

One-line positioning. Big 4 cybersecurity practice offering CPCSC from Level 1 through Level 2.

What they do well. PwC Canada states it helps organizations "from Level 1 self-assessments to Level 2 third-party certifications" and offers an integrated approach that aligns CPCSC and CMMC into one program.

Best fit for. Large primes and mid-tier suppliers with an existing PwC relationship.

Notable signals. National practice; CPCSC service announced in Toronto in May 2026.

Caveats. Enterprise pricing rarely suits small suppliers. PwC Canada is an SCC-accredited certification body for other standards; if it seeks CPCSC accreditation, the independence rule would apply.

3. BDO Canada (national)

One-line positioning. National accounting and advisory firm with a Defence Cyber Readiness Accelerator for CPCSC.

What they do well. BDO launched the accelerator in June 2026 as an advisory service for CPCSC and reports more than 250 clients across the Canadian defence ecosystem.

Best fit for. Mid-market defence suppliers already working with BDO on audit, tax or defence advisory.

Notable signals. Dedicated CPCSC offering, large existing defence client base.

Caveats. Confirm the scope of the accelerator (assessment only, or implementation too) and the level of hands-on technical work.

4. ISA Cybersecurity (Toronto, Calgary, Ottawa)

One-line positioning. Large Canadian security services firm offering CPCSC readiness through its compliance management practice.

What they do well. ISA offers readiness and gap assessments and compliance management for CPCSC, alongside NIST SP 800-171 and CMMC, backed by managed detection and response.

Best fit for. Suppliers that want CPCSC advisory and managed security from one Canadian vendor.

Notable signals. More than 30 years in the Canadian market, national offices.

Caveats. CPCSC sits inside a large services portfolio. Ask who leads the engagement and for a sample deliverable.

5. Plurilock (multiple Canadian cities)

One-line positioning. Publicly traded security company offering CPCSC Level 1 and Level 2 readiness.

What they do well. Plurilock lists a structured Level 1 and Level 2 readiness assessment aligned to NIST SP 800-171, with gap analysis, system security plan and plan of action documents, and remediation.

Best fit for. Suppliers that want readiness work and security products from one vendor.

Notable signals. Level 2 documentation (SSP, POA&M) named in the service.

Caveats. Plurilock's city pages list many Canadian locations without addresses. Confirm where the delivery team sits.

6. Carbide (Canadian, platform plus advisory)

One-line positioning. Compliance platform with an advisory team that tracks ITSP.10.171.

What they do well. Carbide combines software with advisors across CPCSC, CMMC, SOC 2, ISO 27001 and PIPEDA, and offers a free CPCSC readiness call. It estimates Level 1 readiness at three to six months for small and mid-size contractors.

Best fit for. Small suppliers that want the tooling and the guidance from one vendor.

Notable signals. Reports more than 200 customers.

Caveats. Platform-led advisory tends to scale consultant time with the subscription. Confirm how much hands-on implementation is included.

7. Pilotcore (Toronto, Ottawa, Montreal)

One-line positioning. Canadian consultancy offering CPCSC readiness with CMMC-certified advisors.

What they do well. Pilotcore covers scoping, gap closure, documentation and evidence, and states plainly that it supports preparation while certification decisions stay with the accredited body.

Best fit for. Suppliers facing both CPCSC and CMMC.

Notable signals. CMMC Certified Professional advisors; clear statement on independence.

Caveats. Pricing is quote-based. Office details on the site are limited to city links.

8. RiskAware (Markham, ON)

One-line positioning. Small Ontario firm offering fixed-price CPCSC Level 1 gap assessments.

What they do well. RiskAware publishes its price: CAD $4,000 to $8,000 for a gap assessment, policy creation and CanadaBuys attestation guidance, over two to three weeks.

Best fit for. Small suppliers that need Level 1 done quickly and on a known budget.

Notable signals. Published CAD pricing and timeline.

Caveats. The published package targets Level 1. Ask how it extends to Level 2. Its page notes CMMC certification may be accepted; PSPC's Level 1 guidance says that happens case by case after a scope check.

9. Accerta (Toronto)

One-line positioning. Toronto-headquartered firm offering CPCSC readiness through to audit preparation.

What they do well. Accerta lists readiness and gap assessments, remediation roadmaps, policy development, control implementation guidance and audit preparation for CPCSC.

Best fit for. Ontario suppliers that want a local firm across the full readiness path.

Notable signals. Toronto headquarters, end-to-end service list.

Caveats. Pricing and other frameworks are not published.

CPCSC consultant comparison table

What does CPCSC readiness cost in Canada?

CPCSC readiness cost depends on level and scope. Level 1 work for a small, tightly scoped supplier can be a few thousand dollars; a Level 2 program across a mid-size manufacturer can run well into six figures.

Level 1 gap assessment. CAD $4,000 to $8,000 at one published Canadian firm (RiskAware), over two to three weeks.

Industry expectations. PSPC's 2025-26 evaluation found 46% of sub-contractors expected to invest less than $50,000, while 29% of consultants projected $150,000 to $175,000.

Level 2 certification audit. Assessor fees are not yet public, because accredited CPCSC certification bodies had not published pricing as of October 2026.

Four factors move CPCSC cost more than anything else:

• Scope. Segmenting the controlled information into a smaller enclave reduces the number of systems and people in scope.
• Level. Level 2 covers 98 controls against 13 for Level 1, plus formal documentation and a third-party audit.
• Existing programs. SOC 2, ISO 27001 or CMMC work already in place carries over to ITSP.10.171.
• Infrastructure. On-prem servers, shop-floor equipment and shared workstations need more hands-on effort than a cloud-only environment.

How Truvo approaches CPCSC differently

We treat CPCSC as evidence of a working security program. The first thing we build is the scope: where controlled information lives and who touches it. Then come the controls that protect it, written to match how your team works, and evidence collection wired into the tools you already run. Level 1 sits on that program, Level 2 extends it, and SOC 2 or ISO 27001 map onto the same controls when commercial customers ask.

The plan starts from your contract date. We name the Level 1 self-assessment date and the Level 2 readiness milestones on the first call, then plan backwards. Our readiness assessments cover the gap analysis, and the CPCSC Accelerator runs the build on a fixed timeline and price.

We work with small suppliers and on-prem environments as first-class scope, including Active Directory, file servers, firewalls and engineering workstations. We do not plan to become a CPCSC certification body, so there is no conflict when your Level 2 assessor arrives.

If you are comparing us with the firms above, the questions that tend to decide it are these: do you need one firm across CPCSC, CMMC, SOC 2 and ISO 27001; do you have on-prem infrastructure in scope; do you want a Canadian partner with PIPEDA and Law 25 fluency; and do you want a fixed price after scoping. If those match, we are likely a good fit. If they do not, one of the other firms on this list probably is. Our SOC 2 consultants in Canada guide compares the commercial side of the market the same way.

Frequently asked questions

What is CPCSC?

The Canadian Program for Cyber Security Certification (CPCSC) is the Government of Canada's cyber security certification for defence suppliers that handle controlled information. It has three levels based on ITSP.10.171, the Canadian standard adapted from NIST SP 800-171 and 800-172, and it is being added to select defence contracts in phases from 2026.

What is the difference between CPCSC Level 1 and Level 2?

CPCSC Level 1 is an annual self-assessment against 13 foundational controls. Level 2 is a third-party certification against 98 controls, done by a certification body accredited by the Standards Council of Canada. Level 1 is required in select contracts from summer 2026 and Level 2 from spring 2027.

Does CMMC certification count for CPCSC?

Sometimes, at Level 1. PSPC says it may accept a valid CMMC certification case by case, after confirming the assessment covers the required scope, and may verify specific controls. No equivalent Level 2 pathway has been published, so suppliers selling to both governments should plan for both.

How long does CPCSC Level 1 readiness take?

CPCSC Level 1 readiness typically takes weeks to a few months, depending on scope and starting point. One Canadian firm publishes two to three weeks for a Level 1 gap assessment, and another estimates three to six months to full Level 1 readiness for small and mid-size contractors.

Is there an official list of CPCSC consultants?

No. As of October 2026, neither PSPC nor the Standards Council of Canada publishes a list of CPCSC consultants. SCC accredits Level 2 certification bodies, which assess suppliers and are separate from consultants. Evaluate consultants on scoping method, Level 2 planning, independence and published evidence.

Can SOC 2 or ISO 27001 help with CPCSC?

Yes. SOC 2 and ISO 27001 controls overlap heavily with ITSP.10.171, especially access control, logging, configuration management and incident response. A supplier with an existing SOC 2 or ISO 27001 program usually starts CPCSC with much of the control and evidence work done.

Further reading

• CPCSC compliance consulting: what a consultant does
• CPCSC vs CMMC comparison
• CPCSC Level 1 vs Level 2 cost
• ITSP.10.171 explained
• CPCSC Level 1 self-assessment guide
• SOC 2 to CPCSC mapping guide
• Top SOC 2 consultants in Canada

Ready to scope CPCSC?

If CPCSC is in a solicitation or a prime's flow-down clause, a 30-minute call is enough to scope the controlled information and name a realistic Level 1 date. Book a strategy call, see our CPCSC compliance service, or start with the CPCSC Level 1 Readiness Scorecard.