Canada’s Emerging CPCSC Program Is Here: How Zscaler Helps Canadian Defence Suppliers Achieve Compliance

Canada’s new defence cyber certification is live. Here’s what it asks of suppliers, and how Zscaler helps them achieve compliance.

On April 1, 2026, Canada’s Public Services and Procurement Canada (PSPC) launched Level 1 of the Canadian Program for Cyber Security Certification (CPCSC). For companies supporting  Canada’s defence supply chain, cybersecurity has transitioned from being a best practice to a prerequisite for conducting business with Canada’s Department of National Defence (DND).

The CPCSC is Canada’s counterpart to the U.S. Cybersecurity Maturity Model Certification (CMMC). It safeguards sensitive, unclassified "specified information" possessed by suppliers and is based on ITSP.10.171, the standard from the Canadian Centre for Cyber Security, which aligns with NIST SP 800-171. 

What CPCSC requires

The program has three levels, phased in over the next two years:

An important detail to keep in mind! 

The certification is verified upon contract award, not during the bidding process. This means a supplier could potentially win a bid but still be deemed ineligible. 

What Level 1 actually asks for

The Level 1 asks suppliers to self-attest to 13 foundational controls which are drawn from ITSP.10.171. This is the standard that also underpins Levels 2 and 3. These controls fall into six families:

• Access control: account management, access enforcement, use of external systems, and control of publicly accessible content.

• Identification and authentication: multifactor authentication, custom user identification and authentication, device identification and authentication.

• Media protection: sanitizing or destroying media before disposal or reuse.

• Physical protection: physical access authorizations and physical access control. 

• System and communication protection: boundary protection.  

• System and information integrity: flaw remediation and malicious code protection.  

These are the baseline requirements. CPCSC positions Level 1 as lower risk work requiring the controls to be self assessed, rather than verified independently by a third party. Because of this flexibility and ease of path to compliance, it also offers the clearest starting point for building toward higher levels.

Why the easiest path to Level 1 isn’t enough

In times of new requirements, most suppliers look for the quickest way to check the box. Many suppliers can do this with technology they already own in their inventory: a firewall at the perimeter, a VPN for remote access, antivirus software, and multifactor authentication on the landing page. For a self-assessment, this reads as compliant. While each of these controls is technically compliant and satisfied, bad actors are skilled at exploiting exactly the gaps that remain. 

• Flat networks. A VPN connects remote engineers and subcontractors to the whole network, not just the systems they need. One stolen credential becomes a path for lateral movement to vulnerable information. 
• Exposed edge devices. Internet-facing VPN concentrators and firewalls are among the most frequently exploited systems in Cyber Centre alerts.
• Unmanaged devices. Partners and contractors reach sensitive systems from laptops the supplier doesn’t control.
• Point-in-time evidence. Even where controls exist, pulling together proof for an assessor takes weeks. A self-assessment captures how controls were configured on one day; it says little about whether they were consistently enforced for the rest of the year. 

Why stronger controls now pay off at Levels 2 and 3

These check boxes don’t just leave risks in place; they create rework. They are shortcuts. Level 2 is a third-party independent assessment against the broad ITSP. 10.171 requirement set. Auditors will look for controls that are enforced consistently and are defensible, such as least privilege, session controls, audit logs, and protection of data in transit.

Level 3 includes enhanced requirements aligned to NIST 800-171 that protect against bad actors, including stronger isolation of systems that hold specified information and continuous monitoring. A perimeter and VPN design built to only pass Level 1, more often than not, has to be rebuilt to meet them. 

Controls built on zero trust principles take the opposite approach; access is granted per application based on identity, device posture, and context. Applications have no exposed attack surface, traffic is inspected inline, and every decision is logged centrally. Those same controls satisfy Level 1 today and really become the foundation that Level 2 and Level 3 assessments build on. The goal isn’t just to pass Level 1, but to meet it once, in a way you won’t have to undo. This approach saves both cost and time down the road.

How Zscaler supports CPCSC

No product is “CPCSC certified.” Only the supplier is assessed. The platform must be capable of enforcing controls and providing the necessary evidence for the self-assessment and upcoming Level 2 evaluation. Zscaler’s Zero Trust Exchange directly covers 10 out of the 13 Level 1 controls and also backs up five additional controls.  As organizations consider both Level 1 and higher levels of maturity, moving to a true zero trust technology foundation will provide adaptable controls that position organizations to demonstrate higher levels of compliance.

The remaining three Level 1 controls, e.g. media sanitization and two physical-security controls, stay with the supplier.

One platform, Multiple Compliance Programs, Endless Supportability 

Since ITSP.10.171 mirrors NIST SP 800-171, DND suppliers can leverage the same Zero Trust Architecture to monitor, enforce, and log access to support their CPCSC program, along with other Canadian Public Sector requirements. This reduces investment and maintenance costs and enables suppliers to set up controls once and show evidence for multiple programs, instead of managing multiple technologies to secure multiple programs. 

Ready for Level 2, on Day One

Level 1 leverages a self-assessment, but Level 2 will require more formal assessment.  As assessors arrive in 2027, suppliers will need to show how controls are consistently enforced, not just configured. Centralized management, enforcement policy, and logging across every user, device, and application provide suppliers with a single platform with evidence built in. A robust Zero Trust Architecture will ease this transition.

Getting started

1. Identify which current or upcoming DND contracts involve specified information.
2. Map how remote users, subcontractors, and partners reach systems that hold specified information today.
3. Replace network-level access with Zero Trust Network Access for those users first.
4. Align your platform configuration with the required CPCSC evidence, so that one set of controls serves more than one program.

CPCSC requirements can appear in defence contracts this year. The suppliers who start now will treat Level 2 as a formality. To learn how Zscaler can help, contact our team or visit the Zscaler Compliance Center.

References

• PSPC – Canadian Program for Cyber Security Certification: Level 1 (April 2026)
• Canadian Centre for Cyber Security
• Pilotcore – CPCSC for Canadian Defence Suppliers