Government of Canada introduces Level 1 of Canadian Program for Cyber Security Certification

Press Release + Noah Note

April 14, 2026 - Gatineau, Quebec

The Government of Canada is committed to implementing robust cyber security measures, which are fundamental to Canada’s economic stability and national security. Canada’s domestic supply chains are increasingly targeted by malicious cyber activities, including those aimed at defence contractors to obtain sensitive government information. Strengthening cyber security across Canada’s defence supply chains and protecting information used in defence contracting is essential.

Today, the Honourable Joël Lightbound, Minister of Government Transformation, Public Works and Procurement and Quebec Lieutenant, announced the introduction of Level 1 of the Canadian Program for Cyber Security Certification (CPCSC), which will be required in select defence contracts beginning in Summer 2026. To become certified, suppliers will complete, and attest to meeting, all Level 1 criteria. It is the first of three levels of certification to be introduced in the coming years.

Changes to the certification requirements will be introduced in a phased approach to give suppliers and the cyber security community time to adapt. During the initial phase, certification will not be required throughout the bidding process, rather, only upon contract award.

The CPCSC strengthens Canada’s Defence Industrial Strategy by ensuring all defence suppliers meet robust, standardized cyber security requirements, reinforcing a secure and resilient domestic defence supply chain. It helps defence suppliers better identify, assess and manage potential risks, including protecting certain types of sensitive, unclassified information called specified information, as defined in the new industrial cyber security standard.

By enhancing cyber security practices across the defence industry, the CPCSC will boost the basic level of cyber security among Canadian suppliers, making a critical contribution to the readiness of Canada’s armed forces.

---

Quotes

“The Government of Canada is committed to strong cyber security measures to protect Canada’s economic stability and national security, including defence supply chains. The Canadian Program for Cyber Security Certification is designed to align with the standards of international partners, ensuring Canadian companies remain competitive in international defence markets. The phased approach, domestic accreditation system and harmonization with the United States requirements all work to efficiently help suppliers to strengthen their cyber security in a cost-effective, predictable way.”

The Honourable Joël Lightbound

Minister of Government Transformation, Public Works and Procurement and Quebec Lieutenant

“Cyber security is no longer optional for companies operating in Canada’s defence ecosystem: it is a prerequisite for resilience, trust and growth. The introduction of Level 1 of the Canadian Program for Cyber Security Certification gives suppliers, particularly small and medium‑sized enterprises, a clear and accessible pathway to strengthen their cyber practices while remaining competitive at home and with our allies. By raising the baseline across the supply chain, we are protecting sensitive information and supporting Canadian businesses as they participate in defence procurement opportunities.”

The Honourable Stephen Fuhr

Secretary of State (Defence Procurement)

“A secure supply chain is foundational to the Canadian defence ecosystem’s operational readiness. The Canadian Program for Cyber Security Certification reinforces Canada’s Defence Industrial Strategy by ensuring suppliers can identify and manage cyber risks before they become operational vulnerabilities. Level 1 certification establishes a common, standardized baseline that improves resilience across the defence industrial base and reinforces the reliability of the suppliers our armed forces depend on.”

Doug Guzman

Chief Executive Officer, Defence Investment Agency

“The foundational standards developed by the Canadian Centre for Cyber Security are at the heart of the Canadian Program for Cyber Security Certification. Their expertise helps ensure that every organization working with the Canadian Armed Forces meets consistent, reliable expectations for protecting sensitive information. This strengthens the CAF’s confidence in its partners and contributes to a more resilient defence supply chain. The program presents a meaningful step forward in boosting Canada’s defence readiness and supporting our national security.”

The Honourable David J. McGuinty

Minister of National Defence

---

Quick facts

• A Request for Information was issued in May 2024, offering industry an opportunity to provide feedback on the design and implementation of the CPCSC. Results of the Request for Information are available on CanadaBuys.

• Public Services and Procurement Canada engaged with industry stakeholders, including the Canadian Association of Defence and Security Industries, in the development of the CPCSC. Stakeholders had an opportunity to provide their feedback on the draft standard, as part of industry engagement sessions organized following the publication of the standard.

• In its National Cyber Threat Assessment 2025-2026, the Canadian Centre for Cyber Security states that Canada is confronting an expanding and complex cyber threat landscape and that attacks against digital supply chains will almost certainly continue in the next two years.

Specified information can include:

• unclassified information with contract details not intended for public release, between the contractor and National Defence

• controlled goods information

• protected information

---

Noah Note: I am not a Cyber expert, far from it. As such I give the Mandate of Heaven to my bestie Alex Rudolph at Canadian Cyber in Context to better dive into this topic at depth. What he says is what I would say in this case.