Canada's Emerging CPCSC Program Is Here: How Zscaler Helps Canadian Defence Suppliers Achieve Compliance
Zscaler, Thursday, October 29th, 2026
Zscaler explains Canada's CPCSC defence cybersecurity certification, launched at Level 1 on April 1, 2026, and how Zscaler helps suppliers comply.
The Canadian Program for Cyber Security Certification, run by Public Services and Procurement Canada, is Canada's counterpart to the US CMMC and is based on ITSP.10.171, which aligns with NIST SP 800-171.
Level 1 is an annual self-assessment against 13 foundational controls; Level 2 requires third-party assessment every three years starting spring 2027; Level 3 is government assessed against NIST SP 800-172-aligned requirements for the highest-risk contracts.
Certification is verified at contract award, so a supplier could win a bid and still be ineligible.
Zscaler argues that meeting only Level 1 is not enough.