A customer sends you the drawing of a military part. From that moment, the law applies to you, whether you manufacture the part or not.

The Controlled Goods Program (CGP) is not a certification. It is a mandatory registration. And it also reaches your managed service provider (MSP) if they can see your drawings.

A short reminder

The CGP comes from the Defence Production Act. Public Services and Procurement Canada (PSPC) runs it. It controls who may examine, possess or transfer military goods and technology in Canada.

You do not “pass” the CGP. You are registered, or you are in breach.

The cybersecurity certifications required in defence contracts (CPCSC and CMMC) are a separate question. I cover them in a separate article.

What a controlled good is

They are mostly defence articles, their components, and the technology that goes with them. The official list is the schedule to the Act. It includes, among other things, the munitions list (group 2 of the Export Control List), certain strategic goods (item 5504), missile technology (group 6), and U.S. defence articles covered by ITAR (the U.S. International Traffic in Arms Regulations).

The word almost everyone misses is “technology”. A drawing, a technical sketch or a specification for a military part is a controlled good. Receiving the file is enough.

The verb matters too. The law covers anyone who knowingly examines a controlled good. To examine is to look. A machinist who opens the drawing on a screen is examining a controlled good.

How to tell if you must register

A customer sends you drawings of parts meant for military use? A U.S. buyer tells you the documents are “ITAR”? A bid requires your CGP registration number before they will send you the documents? You need an export permit from Global Affairs Canada for a defence article?

One yes, and you must be registered before you receive anything. Not after.

If you are unsure, ask the customer for the classification. They are the ones who know the part.

Registration is free. Processing takes up to 32 business days when the file is complete, and registration is valid for five years at most. You name an authorized individual (usually the owner or a senior officer) and a designated official for each site. That official takes mandatory training. The authorized individual, each designated official, and each owner of 20% or more of the shares undergo a security assessment.

What changes inside your business

Registration is only the start.

Every employee who has access to controlled goods must have been assessed by your designated official. You send a report of those assessments every six months.

You need a written security plan for each workplace. Who has access, where the documents are, how they move, where the backups are. Any confirmed or suspected breach must be reported to PSPC, which carries out compliance inspections.

Under PSPC’s cloud guidance, controlled data should be hosted in Canada. Elsewhere, you have to check with Global Affairs Canada whether an export permit is required. The data must be encrypted in transit and at rest.

An offence under the Act can cost up to a $2 million fine and 10 years in prison, plus suspension or revocation of the registration.

The risk does not always come from outside. In 2016, the RCMP laid charges against four people, including a resident of Pierrefonds, for the sale to Chinese companies of a sensor technology developed at Teledyne DALSA, in Waterloo. According to the RCMP, former employees had taken the technology from their employer. The company itself had filed the complaint.

Personnel security assessments and the access list are aimed at exactly this scenario.

A note for MSP providers

Your registration covers your officers, your directors and your authorized employees (section 37(4) of the Act). It does not cover your MSP. That is another business.

The law also defines a transfer as disclosing the content in any way. Giving a technician who is not registered access to your drawings is a problem for them and for you.

An MSP that runs your IT environment often has everything needed to see your drawings. They have administrator accounts on the file server, on SharePoint and on the mailboxes. They take remote control of the workstations. They manage your backups. If they can examine that data in the normal course of their work, they must be registered in the CGP and assign only assessed staff to your account.

PSPC says this in plain language for cloud providers. An unregistered provider can break the law if their technical support or maintenance includes examining the data. The security plan template also requires that backups containing controlled goods be kept in a registered location. Are your backups in your MSP’s data centre? That place has to be registered too.

The other option is technical. You isolate the controlled data so your MSP cannot see it, for example in a separate environment run by your assessed employees, encrypted with keys that only you hold. It can be done. You also have to be able to prove it during an inspection.

Some Canadian MSPs are already registered in the CGP. Ask yours for their registration number.

Is this the door into defence work?

For an SMB that handles military parts or drawings, yes. It is the first step, and it is the only one you can take on your own, without a contract in hand.

Without registration, some buyers cannot even send you the bid. On the U.S. side, the Canadian ITAR exemption is reserved for businesses registered in the CGP.

It is not the only door. A contract that gives access to protected or classified information goes through the Contract Security Program. There, you must be sponsored during a bid or a contract. Allow up to four months for a designated organization screening, and six months or more for a facility security clearance.

If you already have ISO 27001

The CGP meets ISO 27001 on several points. Screening (Annex A control 6.1) lines up with personnel security assessments. Physical controls (theme 7) and information transfer (5.14) cover part of the security plan. Incident management (5.24 to 5.28) prepares breach reporting. Supplier relationships (5.19 to 5.22) cover your MSP.

Add controlled goods to your inventory and to your risk assessment. Do not build a second system beside the first one.

In practice

At a minimum, here is the order I would follow.

  1. Inventory what your customers send you: drawings, specifications, the words “ITAR” or “Controlled Goods”.
  2. Register in the CGP before you receive controlled documents. Allow more than six weeks.
  3. Limit who has access: one folder, one access group, one list of names. Fewer people means fewer assessments.
  4. Check where the data and the backups are hosted.
  5. Ask your MSP for their CGP registration number. If they do not have one, remove their access to the controlled data or change providers.
  6. Write your security plan from the PSPC template, including remote access and portable devices.

In short, the CGP starts the day a military drawing lands in your inbox, not the day you sign a contract. Do you know, today, who at your business and at your MSP can open the drawings your customers send you?

You receive drawings from your customers and you are not sure the law applies to you? Let’s talk.

References