CPCSC Is Coming for Canadian Defense Suppliers. Here’s What Partners Need to Know

If you support customers who sell into Canada’s defense supply chain, there’s a new acronym on your desk: CPCSC, the Canadian Program for Cyber Security Certification. It’s led by Public Services and Procurement Canada and National Defence, and it exists to make sure sensitive, unclassified information used in federal contracting is handled properly across the defense supply chain.

Level 1 officially launched in April 2026. The government announced that Level 1 requirements would be introduced in select defense contracts beginning in summer 2026. Here’s an important distinction: during this initial phase, certification isn’t required to bid. It’s required upon contract award. That’s a meaningful difference if you’re advising a customer on timing.

Level 1 requires an annual self-assessment against 13 security requirements, using a government-provided self-assessment tool. For contracts requiring Level 1, suppliers must also retain proof of self-attestation and its expiry date and confirm those details in their CanadaBuys supplier profile. Level 2 requires up to 98 controls and an external assessment by an accredited certification body. Level 3 will require a Government of Canada-led assessment, plus annual affirmation, and is reserved for the highest-risk work.

So, the question partners should be asking their defense-adjacent customers right now is simple: can they actually prove cyber hygiene across the systems, people, data, and vendors touching their defense work, or is this still a folder of policies nobody’s tested?

CPCSC and CMMC are cousins, not twins

There’s a real, documented connection between CPCSC and the US Cybersecurity Maturity Model Certification (CMMC) program. Ottawa designed CPCSC specifically to avoid duplicating US requirements, and the underlying Canadian industrial cyber security standard uses the same technical control set as NIST SP 800-171 and 800-172, the backbone of CMMC. That alignment is intentional and supports interoperability with Five Eyes partners.

If your customer has already completed CMMC readiness work, that effort carries over. CPCSC relies on the same control families and similar expectations for patching, monitoring, and endpoint hygiene.

But don’t assume this means „CMMC equals CPCSC,“ because it doesn’t. CPCSC is a Canadian program with Canadian procurement rules, Canadian terminology, and its own scoping guidance. The accurate pitch is: CMMC readiness gives you a strong head start on CPCSC, but you still need to review scope, data residency, data sovereignty, and contract language specific to this program. Skip that step and you risk overlooking gaps that could affect contract eligibility.

Specified information: where does it actually live?

CPCSC protects what the government calls „specified information,“ or SI: Government of Canada information that must be protected when a non-government organization handles, processes, or stores it.

The Level 1 scoping guidance asks a question very relevant to MSPs: what assets and activities touch that information? Devices, applications, servers, email, cloud services, collaboration tools, backups, removable media, even paper files and support paths, admin access, and external providers all count.

Translation for partners: you need to actually help your customer map this out. Where does specified information land? Where is it stored and backed up? Who can access it? Which tools protect the systems that touch it? Which outside vendors are in the mix? If you can’t answer those questions for a customer today, that’s the starting point, not the finish line.

This is also where residency and sovereignty stop being interchangeable buzzwords. Data residency is about physical location: where data is located while at rest. Processing, support access, legal jurisdiction, and operational control are related concerns, but they are not the definition of residency. Data sovereignty is about jurisdiction: which countries’ laws and legal authorities can apply to that data. The government has been explicit that storing data in Canada doesn’t automatically remove sovereignty risk. A cloud provider with foreign operations can still be compelled by a foreign warrant or subpoena even if the servers are in Mississauga. Location and legal exposure are two different conversations, and both need to happen.

MSPs are explicitly addressed in the scoping guidelines

Here’s the part that should get every partner’s attention: the Level 1 scoping guidance names external service providers directly as part of a customer’s scope. Examples include cloud providers, MSPs, MSSPs, hosted email providers, backup vendors, and remote access providers. The guidance defines an external service provider (ESP) simply as an outside company or person delivering IT or cyber security services. It doesn’t explicitly state an exception based on where that provider is headquartered. So, my read, which is an interpretation rather than an explicit quote or statement in the guidance, is that a US or European MSP, cloud host, or backup provider serving a Canadian defense customer is in scope the same way a Canadian one would be. What the guidance does flag explicitly is that CPCSC scoping isn’t identical to CMMC scoping, so don’t assume the two line up detail for detail just because the concept is similar.

The customer stays responsible for verifying whether their providers operate within the agreed security scope and, if so, whether their security measures meet Level 1 requirements. The customer must also verify that provider contracts meet applicable data location and privacy requirements and that providers enforce multifactor authentication (MFA) and secure sign-in rules. If you manage systems touching specified information, your tooling, your access model, your contract terms, and your supporting documentation become part of your customer’s readiness picture. The guidance explicitly addresses these responsibilities.

Where N-central for CMMC Compliance fits and where it doesn’t

N-central for CMMC Compliance is built to help accelerate NIST SP 800-171-aligned readiness aligned with NIST SP 800-171 through patching, remote monitoring and management (RMM), endpoint protection, automation, structured reporting, logging, policy-driven workflows, and continuous endpoint monitoring. Given that CPCSC’s technical controls map to the same NIST foundation, those capabilities can also support CPCSC readiness. Canadian defense suppliers don’t just need a binder of policies. They need repeatable hygiene they can actually prove: patching that happens on schedule, monitoring that’s continuous, access that’s controlled, and evidence that holds up when someone asks for it.

I’ll draw the same distinction here that N-able draws on the CMMC side: because the logic carries over one-to-one, certification includes technical requirements and non-technical requirements, things like policy, training, and organizational process. N-central covers the technical side well: patching, monitoring, endpoint protection, evidence, the stuff an assessor actually wants to see logs for. It doesn’t touch the non-technical side, and it doesn’t hand provide certification. That distinction applies whether a customer is preparing for CMMC or CPCSC. Position it as what it is: a tool that supports the operational foundation for readiness. Setting clear expectations helps build customer trust.

Hosted, self-hosted, or Canadian-resident?

First, a clarification: N-central for CMMC Compliance is a dedicated on-premise edition deployed and operated by the partner or customer; N-able does not host it. Although N-able can host the commercial version of N-central, the CMMC-ready edition is self-hosted only. For CPCSC, that makes the deployment location, whether in Canada or elsewhere, even more important.

No published Government of Canada rule requires on-premise or Canada-only hosting for CPCSC, at any level. Level 1 guidance instead requires suppliers to verify that their hosting model and external providers meet data location, residency, and privacy requirements. Scoping guidance for Levels 2 and 3 has not yet been published.

Here’s my read on where this is heading, based on the CMMC precedent, CPCSC may move in a similar direction. At CMMC Level 2, DFARS 252.204-7012 requires cloud provider touching that data to be FedRAMP Moderate authorized or equivalent. Canada already has the matching infrastructure for this: the CCCS Medium assessment uses the Protected B, Medium Integrity, Medium Availability (PBMM) security profile, with providers like Microsoft Azure and AWS already holding it for their Canadian regions. Nothing in CPCSC references that yet, but I’d expect Level 2 guidance may adopt a similar approach. Building toward that standard now may be wiser than waiting for it to become official.

For CPCSC today, self-hosting in a Canadian environment is the clearest way to sidestep the residency and sovereignty questions. A hosted platform may still work, but its scope should be verified in writing: where the instance, backups, and logs reside; who can access them and from where; which subprocessors are involved; and whether the contract actually covers data location, privacy, and MFA.

There is no universal answer. Both “hosted is always fine” and “always self-host are difficult positions to defend without first defining. Define the scope first, then choose the architecture. For N-central for CMMC Compliance, however, self-hosting is not a preference. It is the only option on the table.

The opportunity for partners

This is not a niche compliance play. Canada has achieved NATO’s 2% defence spending benchmark for 2025-26, is increasing defence-related investment, and has committed to a path toward 5% of GDP in defence and security spending by 2035. That means more opportunity across the defence supply chain, and more suppliers who will need to understand CPCSC readiness.

CPCSC is also going to confuse a lot of smaller Canadian suppliers who do defense work but don’t have a compliance team on staff. For MSPs, that challenge creates an opportunity.

Partners can help customers determine whether CPCSC applies to their contracts, map where specified information resides and moves, define what’s in scope, establish practices that hold up to self-assessment and eventually external assessment, and choose the right deployment model. instead of guessing. N-central for CMMC Compliance is a solid piece of that puzzle, but it is only one part of the bigger picture.

Bottom line

CPCSC shares a strong technical DNA with CMMC, giving customers with existing CMMC readiness work a head start. However, CPCSC remains a distinct Canadian program with its own rules around specified information, residency, sovereignty, and contract scope. No platform or certification checks all those boxes on its own.

Partners should help customers define their scope, lock down the systems that matter, document what they’re doing, and select an architecture that fits their Canadian defense obligations. That is the real CPCSC opportunity: not selling a checkbox, but helping customers achieve and maintain genuine readiness.