pilotcore.io Canada Launches CPCSC Cybersecurity Certification for Defence Suppliers
Article Content
- •CPCSC Level 1 launched on April 1, 2026, for Canadian defence suppliers.
- •Suppliers must self-assess against 13 foundational cybersecurity controls.
- •Compliance verification occurs at contract award, not during bidding.
On April 1, 2026, Canada initiated the Canadian Program for Cyber Security Certification (CPCSC) Level 1, mandating cybersecurity compliance for suppliers in the defence sector. This program, akin to the U.S. CMMC, requires suppliers to self-assess against 13 foundational controls derived from ITSP.10.171, a standard from the Canadian Centre for Cyber Security. Compliance will be necessary for select defence contracts starting summer 2026, with verification occurring at contract award rather than during bidding. The CPCSC aims to protect sensitive unclassified information handled by suppliers. Levels 2 and 3 will follow, introducing more stringent requirements and third-party assessments. Suppliers must be aware that winning a bid does not guarantee eligibility if certification is not achieved by contract award.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Department Of National Defence in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Who needs to comply with CPCSC?
What are the foundational controls?
When will compliance be required for contracts?
Continue Reading
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25… 
KeyDrift Malware Exploits Cisco SD-WAN Flaw CVE-2026-20127 Cisco Talos reported that the advanced persistent threat group UAT-11473 exploited a critical authentication bypass vulnerability (CVE-2026-20127) in Cisco SD-WAN Catalyst Controllers. This flaw, which has a CVSS score of 10.0, allows unauthorized remote access to administrative privileges. The group deployed a custom…