Canada Unveils Cutting-Edge Cyber Defense Standards to Fortify Infrastructure

Key points

• Introduction of New Standards: Canada has launched the Canadian Program for Cyber Security Certification, a new security standard for defence suppliers.
• Focus on Defence Supply Chains: The program covers companies that handle sensitive unclassified government information under defence contracts.
• Collaborative Approach: Government worked with industry to develop it.
• Global Implications: Canada’s approach could influence how allies certify their own suppliers.
• Key Players: The Canadian Centre for Cyber Security (CCCS) wrote the underlying standard, ITSP.10.171, used in the Canadian Program for Cyber Security Certification (CPCSC).

What Canada announced

Canada is raising the bar for the companies that supply its military. On March 12, 2025, the federal government announced the first phase of the Canadian Program for Cyber Security Certification. Threats keep getting more sophisticated, and Ottawa wants the businesses that handle its information to meet a common security baseline, so this piece looks at how the standard was built, what it requires and how it may play out at home and abroad.

Who the standard covers

The certification applies to defence suppliers that handle sensitive unclassified government information. The Canadian Program for Cyber Security Certification (CPCSC) treats those companies as part of the country’s security perimeter. A breach at a supplier can leak information just as surely as a breach inside government. Setting one standard for all of them is meant to close that gap.

Why supply chains are a target

Contractors can give attackers a back door into government information. Under the new standard, suppliers will need to show they have the required security controls in place before they handle that information.

Certification levels

Companies can certify at Level 1 through a self-assessment. Contracts that call for Level 2 will need an assessment by an accredited third party. Certification is tied to the contract award, so suppliers that want the work will have to meet ITSP.10.171.

Built with industry

The standard was not written by government alone. Industry gave input along the way. That reflects a basic point: protecting defence information depends on the companies that hold it as much as on the agencies that set the rules, and pooling that expertise should produce a framework that can keep pace as threats change.

Lessons for allies

The new standard is aimed at Canadian defence procurement, but its effects may reach further. Allies buy from the same pool of suppliers. A clear Canadian standard could make it easier for companies to work across borders and could encourage other countries to tighten their own supplier rules.

Key Players: CCCS and CPCSC

The Canadian Centre for Cyber Security (CCCS) published ITSP.10.171, the technical standard behind the program. The Canadian Program for Cyber Security Certification (CPCSC) turns that standard into contract requirements, with Public Services and Procurement Canada overseeing it.

What comes next for suppliers

The first phase is a starting point. Canada now expects its defence suppliers to show, not just claim, that they protect government information, and companies that want those contracts should start preparing for assessment now. Other countries will be watching how the rollout goes.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.