CPCSC Readiness Service for new mandatory cyber certification

The CPCSC is a new mandatory cyber security certification framework, jointly led by Public Services and Procurement Canada (PSPC) and the Department of National Defence (DND), in collaboration with the Canadian Centre for Cyber Security (CCCS). Modelled on the U.S. Department of Defense's CMMC programme, CPCSC establishes minimum cyber security requirements that contractors must meet in order to bid on, be awarded, and continue performing defence contracts involving sensitive, unclassified information.

With certification requirements appearing in DND solicitations this year, the timeline for suppliers to achieve compliance is narrowing. Organizations that fail to meet the required CPCSC level will be ineligible to retain existing defence contracts or bid on new projects, creating a significant risk to revenue and market position.

Unlocking access to Canada's defence market

CPCSC establishes minimum cyber security standards for any organization in the DND supply chain. PwC Canada's CPCSC Readiness and Advisory service enables businesses to:

• Confirm their CPCSC scope by identifying affected contracts, data flows, and business units.
• Commission a readiness assessment to benchmark current controls against CPCSC requirements.
• Develop a remediation and certification roadmap with clear ownership, budget, and timelines.
• Prepare for final certification by gathering evidence and validating controls.
• Strengthen supply chain trust and protect eligibility for future defence contracts.

Extending PwC's legacy of trust and sector expertise

PwC Canada's multidisciplinary teams bring together expertise in cybersecurity, defence, risk management, digital trust, internal controls, and regulatory insights. This blend of technical depth and assurance rigor, positions PwC Canada uniquely to help clients address both the opportunities and risks of the new defence procurement landscape.

PwC Canada's service is designed to support the government's objective of broadening the national defence industrial base, making it possible for more Canadian organizations, particularly small and medium-sized enterprises (SMEs), to meet cyber security requirements and participate in defence procurement.