Since April 2026, Level 1 of the Canadian Program for Cyber Security Certification (CPCSC) has officially been available. For some small and medium-sized businesses seeking to work on defense contracts, cybersecurity is therefore no longer simply a best practice: it is beginning to become a direct contractual requirement.
But what is the difference between Level 1 and Level 2? More importantly, what should a company be preparing today?
Level 1: Building a Solid Foundation
The Government of Canada describes Level 1 as a baseline level of cyber hygiene. It includes 13 controls and is based on an annual self-assessment.
For certain defense contracts, these requirements began to be introduced gradually in summer 2026. However, the required level depends on the contract: not every business opportunity in the defense sector automatically requires the same certification.
The key is not to confuse a self-assessment with a simple administrative questionnaire. A company must genuinely assess the state of its security measures and be able to document its practices. Key areas include access management, authentication, system protection, and activity monitoring.
Level 2: A Much More In-Depth External Assessment
Level 2 is a significant step up. Under the program currently published by the government, it includes 98 controls and requires an external assessment by an accredited organization, generally every three years, along with an annual affirmation.
Level 2 requirements are expected to be gradually incorporated into certain contracts involving the handling of Controlled Unclassified Information (CUI) or more sensitive work. This means that an SMB must be able to do more than simply state that its security measures exist. It must be prepared for an assessor to review documents, interview responsible personnel, and test the mechanisms in place.
The Canadian Centre for Cyber Security identifies three main assessment methods in ITSP.10.171-01: examine, interview, and test.
A written policy stating that access is reviewed may therefore not be sufficient. The organization may need to provide user lists, permissions, logs, review procedures, and evidence demonstrating that the review actually took place.
Start by Understanding the Target Contract
Before purchasing software or making changes across the entire network, a company should determine exactly what it is trying to accomplish. What type of contract are you pursuing? What information will you handle? Which employees will need access to it? Which systems will be used? Which CPCSC level is likely to be required?
This analysis helps avoid two opposite mistakes: underestimating the requirements or overinvesting in infrastructure that is far more extensive than necessary.
Documentation Should Start Early
One common mistake is waiting until a few weeks before an assessment to begin gathering evidence. Compliance, however, often relies on activities that take place over time.
Access reviews, alert handling, change management, employee training, backups, and incidents: over time, these activities create a record of the environment. That is the history an assessor needs to be able to understand.
TechNuCom’s work on its own SOC 2 Type 2 compliance journey illustrates this approach well. As we explained in our article on the importance of SOC 2 Type 2, a serious compliance program is not based on a document created at the last minute, but on processes that are consistently applied and can be demonstrated over time.the importance of SOC 2 Type 2
Level 1 Today, Level 2 Tomorrow?
Not every SMB will necessarily move from one level to the next. The applicable level will depend on the contracts and the risks associated with the information being handled. However, an organization that intends to build a long-term presence in the defense sector benefits from laying its foundations with future requirements in mind.
Properly managed individual accounts, effective separation of roles, strong authentication, usable logs, and structured documentation are valuable at Level 1 and become even more important when an external assessment is involved.
The goal, therefore, is not simply to “pass” an assessment. It is to build an environment whose day-to-day operations naturally generate the controls and evidence required.
Would you like to determine where your organization currently stands in relation to CPCSC requirements? TechNuCom and its partners can help you assess your level of readiness and structure the next steps.