Most integrators file CPCSC under “the client’s problem.” The defense supplier gets certified, the crew installs the cameras and card readers, and somebody in an office handles the paperwork.
That holds until you open the project folder.
What CPCSC is, in one paragraph
CPCSC is Canada’s cyber security certification for defense suppliers. It covers any organization whose systems store, process, or transmit Specified Information under a Department of National Defence contract. Specified Information is sensitive but unclassified data the contract says has to be protected. Level 1 has been in select contracts since the summer, and PSPC’s timeline puts Level 2 third-party assessments between April 2027 and March 2028. The requirement follows the data down the supply chain, and there’s no exemption for being 3 tiers below the prime.
3 ways integrators end up in scope
The project files
On a defense site, the drawings, the device schedule, the IP plan for the security network, and the door and camera layouts can all be Specified Information. Once they’re on your commissioning laptops, your project share, or the email thread with the GC, those systems are in scope. So are the backups.
Remote support
If your techs remote into a client’s VMS or access control server, that connection becomes part of the client’s assessment. The assessor will ask how you get in, who on your bench can reach it, and whether MFA is enforced on that path; 03.07.05 requires it for non-local maintenance.
The gear itself
CPCSC certifies organizations, not products, so there’s no such thing as a CPCSC-compliant camera. But a camera, NVR, or controller on the same network as the contract data is an endpoint someone can use to get in. It gets judged on how it’s configured.
What changes on the install side
Most of this is habit, and none of it needs new hardware.
- Treat project data for defense sites like an enclave, with encrypted laptops and one controlled project share
- Move drawings through a managed transfer path instead of email
- Keep a list of who on the crew had access to which project
- Purge project data at close, after checking the contract’s retention clause
- Put security devices on their own network segment, denied by default
- Change every default password before a device touches the network
- Give each technician a named account on the VMS and controllers, not a shared “admin”
- Route remote support through a jump host with MFA and session recording
That last one matters more than it looks. I’ve seen MSPs with a remote tool on every machine tell me “this is how we do it,” and that’s how whole fleets get wiped.
How to get ahead of it
Start with your own company
Run the CPCSC Level 1 self-assessment on your own systems. Primes evaluating subcontractors will ask, and Level 1 includes multi-factor authentication. That one catches integrators who’ve been running the shop on passwords.
Write down who does what
A short responsibility matrix in the service agreement says which controls you operate and what evidence you hand over, on what schedule. Assessors read it first.
Hand the client their evidence
The physical protection requirements in ITSP.10.171 cover who’s allowed in, monitoring who goes where, and controlling the doors. The evidence for all of it lives in systems you install: the access list export, the door event report for the server room, the held-open alarm settings, the camera coverage of the entry. An integrator who delivers that pack at commissioning, and again at each service visit, becomes part of the client’s readiness.
Why this is an opening
I’ve seen a prime contractor’s internal network requirements first-hand, and the gap between those and what reaches its small suppliers is wide. Integrators sit right in that gap, carrying the prime’s drawings around in a truck.
Most of the market hasn’t noticed yet… the firms that close that gap first are the ones primes will want back on the next bid.
The free CPCSC hub is at hans.study/cpcsc/, with a page for MSPs and integrators. Policy templates are at hans.study/cpcsc/templates/.
