Military & Defence IT
IT and cybersecurity for military and defence suppliers
Companies that make parts, provide services or handle information for Canada’s defence sector are expected to protect that information properly, and contracts increasingly ask for proof. We help GTA defence suppliers put strong security controls in place, keep them running and document them clearly.
- Help preparing for CPCSC Level 1
- Sensitive contract information kept under control
- Multi-factor sign-in and strict access control
- Patching, monitoring and tested backups
- Documentation ready for your self-assessment
What’s changing
Defence contracts now come with cybersecurity requirements
The Government of Canada has introduced the Canadian Program for Cyber Security Certification (CPCSC) for defence suppliers. Level 1, which applies to select defence contracts, is an annual self-assessment of 13 security controls drawn from the Canadian Centre for Cyber Security’s ITSP.10.171 standard.
The program protects what the government calls specified information: sensitive, non-classified information such as controlled goods information and contract details that aren’t meant for the public. If that information lives on your laptops, email or file shares, your IT has to be set up to protect it, and you need to be able to show how.
- Needed at contract award: certification is checked when a contract that requires it is awarded, not during bidding, so preparing early matters
- Renewed every year: Level 1 self-assessments expire and have to be completed again
- More to come: Level 1 is the first of three planned certification levels
- Where sensitive contract information is storedData
- Who can reach it, and from which devicesAccess
- Whether every account uses multi-factor sign-inIdentity
- How quickly security updates are installedPatching
How we help
Security and support for defence suppliers
Gap assessment
We compare your current setup with the Level 1 controls and give you a plain-language list of what’s missing and what to fix first.
Access control and MFA
Individual accounts, multi-factor sign-in and permissions limited to the people who need them, so sensitive files stay with the right team.
Endpoint protection
Managed protection on every computer and server, with managed detection and response for round-the-clock threat monitoring.
Patching and updates
Operating systems, firmware and applications kept current on a schedule, with a record of what was installed and when.
Network separation
Firewalls and separate network segments keep guest, shop-floor and office devices away from systems that hold contract information.
Documentation and evidence
Clear records of your systems, settings and policies, so completing your self-assessment is straightforward.
Technical safeguards we help put in place
We aren’t a certification body, and your organization completes its own self-assessment. What we do is put the technical controls in place, keep them running and help you gather the evidence.
- A unique account for every user, with no shared logins
- Multi-factor authentication on email and remote access
- Access to sensitive files limited by role
- Up-to-date anti-malware on every device
- Security updates installed promptly and tracked
- Firewall rules that block traffic you don’t need
- Drives securely wiped before devices are retired
- Encrypted, tested backups
How we get you ready
- 01
Assess
We review your devices, accounts, network and where contract information lives.
- 02
Prioritize
You get a clear list of gaps, ordered by risk and effort, with a quote for the work.
- 03
Fix
We put the missing controls in place and schedule disruptive work outside business hours.
- 04
Maintain
Ongoing monitoring, patching and a yearly review keep you ready when your next self-assessment is due.
Bidding on defence work?
A free IT assessment shows where you stand today and what it would take to be ready before a contract is awarded.
Frequently asked questions
What is the CPCSC?
The Canadian Program for Cyber Security Certification is the Government of Canada’s cybersecurity certification for defence suppliers. Level 1 is an annual self-assessment of 13 security controls from the ITSP.10.171 standard, and it applies to select defence contracts. It is the first of three planned levels.
Can you certify us?
No. Level 1 is a self-assessment your organization completes for itself. We help you meet the controls and organize the evidence so you can complete it with confidence. Always confirm the requirements of a specific contract with your contracting authority.
We already hold a US CMMC certification. Does that count?
It may. The Government of Canada says it may accept a valid CMMC certification on a case-by-case basis, after confirming the assessment covers the required scope. Check with your contracting authority. Either way, we can help you keep those controls in place.
Do you work with companies registered in the Controlled Goods Program?
Yes. Registration and the security assessment of your people remain your company’s responsibility under the program, but we help secure the systems where controlled goods information is stored, with tight access controls, logging and encryption. If your contract sets requirements for outside IT providers, tell us early so we can plan around them.
We’re a small supplier. Is this realistic for us?
Yes. Many defence suppliers are small machine shops, engineering firms and service companies. We scale the controls to the size of your business, so meeting the requirements is realistic for a company your size.
Related services
Cybersecurity
Layered, fully managed protection for your people, devices, email and data, watched around the clock.
Learn moreVulnerability & Risk Assessments
Find and fix the weak spots in your network, devices, cloud accounts and policies before attackers do.
Learn moreManufacturing
IT and cybersecurity that protect production uptime, from the ERP in the office to the PCs on the shop floor.
Learn moreLet’s make IT the part of your business you stop worrying about.
Talk to a local, Canadian team that has been keeping GTA businesses running since 1996. Your first assessment is free, with no obligation.