SAVE TIME. REDUCE RISK. WIN MORE CONTRACTS.
Get CPCSC Level 1 Compliance
Canadian companies wanting to be Level 1 CPCSC compliant to be eligible for Defence contracts
Join a Free Webinar, See a demo, or get our Coaching
At Our Webinar Learn About: Our 6 Step Process
A Simple Pathway to Compliance
Save time, frustration and money while reducing risk. Join our weekly webinar Wednesday at 4:00pm on our 6-step process. You will achieve your Canadian Program for Cyber Security Certification (CPCSC) Level 1 Compliance with confidence.
Learn about:
- CPCSC, what is it and what is it meant to protect
- The 6 steps should you take to prepare for your CPCSC Level 1 “Self Assessment”
- How to approach the scoping of your specified information
- A simple process for collecting evidence, identifying and remediating your gaps
- The 123 AuditPrep™ Tool and 3rd party Validation
- The free resources that can help your “do it yourself” project to complete CPCSC Level 1.
Reduce risk, avoid common mistakes, and move from self-assessment to verified compliance.
Learn about 123 AuditPrep™
New to the Canadian Program for Cyber Security Certification?
123 AuditPrep™ is an online application that was built to speed the process of policy development and evidence collection, essential to the “self-assessment” legal requirement on Canada Buys. 123 AuditPrep™ offers guidance for creating your cybersecurity policies, complete with detailed suggestions for essential content. Easily demonstrate your policy implementation by attaching the necessary evidence for each control of the CPCSC Level 1 and CMMC Level 1 requirements. When it’s time for your audit, quickly extract all your policies and evidence into one organized file to streamline your compliance.
Want to be sure of your answers? Use 123 AuditPrep™ and get a free 3rd party validation conducted by the Digital Governance Council. Your designated Company Security Officer or CEO will be liable for the truth of your submission.
Buy it now: 123 AuditPrep™ – Digital Governance Council
Use 123 AuditPrep™ and get a free 3rd party validation conducted by the Digital Governance Council. Your designated Company Security Officer or CEO will be liable for the truth of your submission.
What We Offer
Start where you are. We'll guide you to the next step.
CPCSC Level 1
Compliance preparation backed by real-world experience
Proven Tools
123 AuditPrep system to guide your compliance
Policy Library
Customizable templates and structured guidance
Expert Coaching
Live support when you need it
Validation Support
Prepare for 3rd-party validation with confidence
Veteran Ground Truth
Hear from someone with experience in defence
ABOUT CPCSC LEVEL 1
CPCSC Level 1 certification is required for suppliers bidding on or working on select Government of Canada defence contracts starting in Summer 2026. This mandatory self-assessment, which went live on April 1, 2026, applies to organizations of all sizes handling sensitive, unclassified information and is required at the time of contract
The Canadian Program for Cyber Security Certification (CPCSC) is an official cyber security certification in Canada for defence suppliers.
It is required for organizations working within the Defence Industrial Base that handle Specified Information. CPCSC provides guidance on implementing safeguards that meet Canadian national defence requirements for confidentiality, integrity, and availability of sensitive data.
It was created to help businesses remain secure and trusted partners in Canada’s defence and security supply chain.
Level 1 requires an annual self-assessment, subject to the Government of Canada’s Code of Conduct for Procurement.
Do you need 3rd Party Validation for CPCSC Level 1?
Do you need third-party validation for your Level 1 self-assessment and why it matters for your business.
Why was CPCSC Created?
CPCSC was created to help businesses to remain secure and trusted partners in Canada’s defence and security supply chain. It is a requirement on the “Buys Canada” portal for many defence contracts. Level 1 requires and annual “Self-Assessment” which is subject to the Code of Conduct for Procurement (Code of Conduct for Procurement – Canada.ca).
Your attestation carries legal weight
The self-assessment is not simply self-graded. The attestation carries legal weight: you are affirming to the Government of Canada that your organization meets these requirements. Treating it as a checkbox exercise creates real exposure if an incident reveals that the attested controls were not actually in place. An independent review provides a documented, defensible basis for that attestation.
Prime contractors will ask for proof
The real impact cascades downward. To maintain their own compliance, primes must verify that their supply chain partners also meet the standard. That means the prime you supply parts, software, or services to will soon ask you to prove your CPCSC Level 1 compliance — or risk losing the relationship. A Statement of Verification from a recognized body like the Digital Governance Council is far more convincing than a self-declared checkbox.
It builds your evidence base for Level 2
Starting your evidence collection now means 12 months of history when Level 2 assessors arrive in April 2027. That unbroken chain of evidence is worth far more than a fresh start. Assessors evaluating Level 2 readiness strongly prefer organisations with months of documented compliance history over those starting from scratch. Third-party validation today essentially gives you a head start on the mandatory external audit coming in 2027.
It catches blind spots you may have missed
SMEs often lack in-house cybersecurity expertise. An independent reviewer assessing your policies and evidence against the 13 controls will identify gaps your team may have overlooked — before a contract is on the line, not after.
It signals credibility beyond government contracts
Upon completion of the DGC’s CyberDefence program, DGC issues a Statement of Verification suitable for sharing with federal departments, defence primes, international partners, investors, and program administrators. That reach beyond just government procurement — to investors and international partners — adds tangible commercial value for growing SMEs. Dgc-cgn