Defence supplier certification

Ready for your next defence contract

Canada now requires cyber security certification for some defence contracts. The Canadian Program for Cyber Security Certification (CPCSC) starts with Level 1: an annual self-assessment of 13 security controls. We get you ready, close the gaps and build the evidence behind your answers.

Book a readiness callHow we help

Level 1 at a glance

13

Security controls to meet

6

Areas: access, sign-in, media, physical, communications, system integrity

1 yr

Self-assessment repeated every year, with evidence kept

Award

Required when a contract is awarded, for contracts that call for it

The controls come from the Canadian Centre for Cyber Security's ITSP.10.171 standard. Not every defence contract requires certification, and Levels 2 and 3 add independent assessment for more sensitive work. Source: Public Services and Procurement Canada

01

How we get you ready

Assessment · Fixes · Evidence · Renewal

A self-assessment is only as good as the evidence behind it. If you attest to a control you don't actually meet, it puts your contracts at risk. We make sure every answer is true and documented.

  • Gap assessmentWe check your systems and practices against all 13 controls and give you a clear list of what passes and what doesn't.
  • Fix the gapsMulti-factor sign-in, user access, device security, patching, firewalls, secure disposal of media and physical access to your premises.
  • Evidence packPolicies, screenshots and records that back up each answer, organized and ready to show if Canada asks.
  • Submission supportWe walk you through the self-assessment and adding the result to your CanadaBuys supplier profile.
  • Stay certifiedOngoing monitoring and a yearly review, so renewal is a check-in, not a scramble.
02

Why Bee8

Our team comes from aerospace software, one of the most tightly regulated industries there is. There, every requirement is traced, every change is reviewed, and every claim needs evidence.

  • We know the difference between being compliant and looking compliant
  • We fix the problems ourselves instead of handing you a report and leaving
  • Your IT, security and certification sit with one team
  • Sized and priced for small and mid-sized suppliers, not large contractors

Common questions

Do all defence contracts require CPCSC certification?

No. Only contracts that involve certain sensitive government information will require it, and the contract will say so. If you supply defence or aerospace customers, it is worth getting ready before a contract asks for it.

Is Bee8 a certification body?

No. Level 1 is a self-assessment that your company completes and attests to. We prepare your systems and your evidence so your answers hold up. Levels 2 and 3 are assessed independently by accredited bodies.

We already have CMMC certification for U.S. work. Do we need this too?

Canada may accept a valid CMMC certification once it confirms the assessment covers what the contract requires. We can review your CMMC scope against the Canadian requirements.

How long does it take to get ready?

It depends on where you start. Many small suppliers already meet some controls. The gap assessment tells you exactly what's left, and we give you a fixed quote for closing it.

Find out where you stand

Book a free call. We'll walk through the 13 controls with you and tell you honestly how close you are.

Book a readiness call