CPCSC is coming: what Canadian suppliers should do in the next 90 days
Requirements flow down the supply chain, which means subcontractors are affected by contracts they never signed.
The Canadian Programme for Cyber Security Certification introduces a certification requirement for suppliers handling protected information in defence procurement. The pattern will be familiar to anyone who watched CMMC arrive in the United States: a long announcement period, then clauses appearing in solicitations faster than suppliers can certify.
The flow-down problem
Requirements do not stop at the prime contractor. If you supply a company that supplies the Department of National Defence, the obligation reaches you through your customer’s contract — often with a deadline set by someone you have never spoken to. Companies that assume they are out of scope because they do not bid directly are the ones most likely to be surprised.
What to do in the next 90 days
- Ask your customers. A direct question to your primes about anticipated flow-down requirements costs nothing and sets your timeline.
- Map where protected information lives. This is the work that determines cost, and it is entirely independent of which level you eventually need.
- Run a gap assessment against NIST SP 800-171. CPCSC control expectations align closely with it, and the assessment is reusable if you also need CMMC.
- Decide on an enclave now. Retrofitting a boundary after controls are implemented means doing the work twice.
- Budget for assessment, not just remediation. Third-party assessment is a separate line item and assessor availability tightens as deadlines approach.
The commercial argument
Certification is being framed as a compliance cost. For suppliers who move early it is the opposite: when clauses land and most of your competitors are twelve months from certification, being ready is a bidding advantage with a limited shelf life.