Since summer 2026, some National Defence contracts require a cybersecurity attestation. If your organization is certified to ISO 27001, the first question is simple: does it count?
No. Not automatically. You do start well ahead, if you know where the gaps are.
A short reminder
CPCSC (Canadian Program for Cyber Security Certification) is the certification required in some Canadian defence contracts. Public Services and Procurement Canada (PSPC) administers it. I gathered the framework and the references on the CPCSC page.
CMMC (Cybersecurity Maturity Model Certification) is the U.S. equivalent. The U.S. Department of Defense requires it all the way down to subcontractors.
ISO 27001 certifies your information security management system (ISMS). It is voluntary.
If you receive military plans or technical data, another obligation applies: the Controlled Goods Program. It is not a certification. I cover it in a separate article.
CPCSC in three levels
Level 1 has been available since April 1, 2026, and required in some contracts since the summer. It is an annual self-assessment of 13 basic measures. The tool is online and the result goes into your CanadaBuys profile (AchatsCanada). You keep your evidence for at least one year.
Level 2 requires an assessment every three years by a body accredited by the Standards Council of Canada. It arrives in some contracts in spring 2027. It is based on ITSP.10.171 from the Canadian Centre for Cyber Security, the equivalent of the 110 requirements in NIST SP 800-171.
Level 3 is assessed by National Defence. It targets the most sensitive work.
Take note: moving from 13 requirements to 110 is not an upgrade. It is another project.
CMMC, paused but not gone
CMMC applies to you if you are a subcontractor, even an indirect one, of a Pentagon supplier and you receive controlled unclassified information (CUI).
Phase 1, in effect since November 10, 2025, requires self-assessments. Phase 2 was supposed to require third-party assessments on November 10, 2026. It was suspended on July 13, 2026, while a working group reviews the program. The baseline obligations remain in force, including DFARS clause 252.204-7012 and NIST SP 800-171.
Canada may accept a valid CMMC certification in place of CPCSC, case by case. That is not automatic.
Why ISO 27001 is not enough
The difference is in the logic. ISO 27001 asks you to assess your risks and choose your measures. You justify exclusions in the statement of applicability. CPCSC and CMMC do the opposite. The list is imposed, and nothing is excluded.
The second gap is scope. Your ISO certificate covers a precise scope, written on it. If the plant or the engineering office that will receive the defence data is outside that scope, your certificate says nothing about them.
The third gap is the assessor. For level 2, the body must be accredited for CPCSC. Not every ISO certification body is.
What your ISMS already covers
For level 1, the mapping is fairly direct. Here is how I connect the 13 measures to the Annex A controls of ISO 27001:2022.
| Level 1 measure | ISO 27001 Annex A |
|---|---|
| 1. Manage user accounts | 5.16 Identity management, 5.18 Access rights |
| 2. Grant only the access that is needed | 5.15 Access control, 8.2 Privileged access rights |
| 3. Use only approved systems and devices | 5.10 Acceptable use of information, 8.1 User endpoint devices |
| 4. Prevent public disclosure of sensitive information | 5.10 Acceptable use of information, 5.14 Information transfer |
| 5. Individual accounts and strong passwords | 5.16 Identity management, 5.17 Authentication information |
| 6. Approve devices before they connect | 8.1 User endpoint devices, 8.20 Networks security |
| 7. Turn on two-factor authentication | 8.5 Secure authentication |
| 8. Erase or destroy old devices | 7.10 Storage media, 7.14 Secure disposal of equipment |
| 9. Keep the list of people allowed in secure areas | 7.2 Physical entry |
| 10. Control entry to the premises | 7.1 Physical security perimeters, 7.2 Physical entry |
| 11. Basic network protections | 8.20 Networks security, 8.22 Segregation of networks |
| 12. Apply security updates | 8.8 Management of technical vulnerabilities |
| 13. Antivirus and anti-malware | 8.7 Protection against malware |
If your statement of applicability includes these measures and your evidence is current, the level 1 self-assessment should be quick.
Level 2 is another story. NIST SP 800-171 is much more prescriptive. One example: encryption that protects the information must use FIPS-validated cryptographic modules. ISO 27001 asks you for a cryptography policy, not a validated module. That is the kind of gap the analysis has to find, requirement by requirement.
In practice
At a minimum, here is what I would do.
- Check the scope of your ISO 27001 certificate. The systems and the sites that will receive defence information have to be in it.
- Do the level 1 self-assessment now, even without a contract. It is free.
- Gather your evidence for the 13 measures in one folder, updated at least once a year.
- Ask your U.S. customers whether they send you CUI. If they do, CMMC applies to you, paused or not.
- If you are aiming at level 2, do a gap analysis against ITSP.10.171 before spring 2027. Not after you have won the contract.
- Fold the CPCSC requirements into your ISMS. Do not build a second system beside it. The enemy of security is complexity.
In short, ISO 27001 does not give you CPCSC. It gives you the management discipline that CPCSC assumes. Does your certificate cover the sites that will receive the defence data?
You are certified to ISO 27001 and you are pursuing defence contracts? Let’s talk.