Gatineau, Quebec
The Government of Canada is committed to implementing robust cyber security measures, which are fundamental to Canada's economic stability and national security. Canada's domestic supply chains are increasingly targeted by malicious cyber activities, including those aimed at defence contractors to obtain sensitive government information. Strengthening cyber security across Canada's defence supply chains and protecting information used in defence contracting is essential.
Today, the Honourable Joël Lightbound, Minister of Government Transformation, Public Works and Procurement and Quebec Lieutenant, announced the introduction of Level 1 of the Canadian Program for Cyber Security Certification (CPCSC), which will be required in select defence contracts beginning in Summer 2026. To become certified, suppliers will complete, and attest to meeting, all Level 1 criteria. It is the first of three levels of certification to be introduced in the coming years.
Changes to the certification requirements will be introduced in a phased approach to give suppliers and the cyber security community time to adapt. During the initial phase, certification will not be required throughout the bidding process, rather, only upon contract award.
The CPCSC strengthens Canada's Defence Industrial Strategy by ensuring all defence suppliers meet robust, standardized cyber security requirements, reinforcing a secure and resilient domestic defence supply chain. It helps defence suppliers better identify, assess and manage potential risks, including protecting certain types of sensitive, unclassified information called specified information, as defined in the new industrial cyber security standard.
By enhancing cyber security practices across the defence industry, the CPCSC will boost the basic level of cyber security among Canadian suppliers, making a critical contribution to the readiness of Canada's armed forces.
