The CPCSC Assessment Tool That Works Where Specified Information Lives
A single HTML file that replaces cloud GRC platforms for Canada’s defence supply chain. 100% offline. Air-gap ready. Deploys in seconds. Purpose-built for ITSP.10.171 and SCC 3PAO assessment.
97
375
17
3
Sources: DND CPCSC Programme • ITSP.10.171 • PSPC Defence Procurement
⚠ Spring 2026: CPCSC certification is now mandatory for new DND contracts. New RFPs require certification before your bid is read. Contact us today →
THE PROBLEM
Canada’s Defence Supply Chain Has a Compliance Crisis
CPCSC is now mandatory. Every DND supplier handling Specified Information must certify. The supply chain isn’t ready.
10,000+
DND Suppliers
Canada’s defence supply chain includes thousands of companies — most are SMBs with limited compliance resources and no formal cybersecurity programme.
97
Controls Required
ITSP.10.171 mandates 97 security controls across 17 domains — with 375 individual determination statements to evaluate, document, and evidence.
Limited
Upcoming 3PAOs Available
SCC-accredited third-party assessor organisations are still ramping up. The assessment backlog will grow as RFP enforcement begins.
Zero
Offline Tools Available
Every competitor is cloud-based — sending your Specified Information to someone else’s server. Air-gapped and restricted DND environments have no options.
BACKGROUND
What is CPCSC?
The Canadian Programme for Cyber Security Certification (CPCSC) is the Government of Canada’s mandatory cybersecurity framework for the defence supply chain — jointly administered by DND and PSPC, based on ITSP.10.171.
🏛 Regulatory Basis
- Developed by the Canadian Centre for Cyber Security (CCCS)
- Based on ITSP.10.171 — Canada’s adaptation of NIST SP 800-171
- Mandated by DND / PSPC for defence supply chain suppliers
- Applies to any organization handling Specified Information under DND contracts
⚖ Who Must Comply
- Direct DND suppliers (Tier 1)
- Subcontractors to DND primes (Tier 2 / Tier 3)
- Manufacturers, R&D labs, testing facilities with DND contracts
- IT/software companies supporting DND programmes
- Cross-border operators with both U.S. DoD (CMMC) and Canadian DND obligations
📋 What Must Be Demonstrated
- 97 security controls across 17 domains (ITSP.10.171)
- 375 determination statements evaluated per control
- Documented System Security Plan (SSP)
- Evidence per control; POA&Ms for gaps
- Level 2: triennial 3PAO assessment + annual affirmation
🔗 CPCSC & CMMC Relationship
- CPCSC is structurally aligned with CMMC 2.0
- Both derive from NIST SP 800-171 / ITSP.10.171
- Cyber Risk Service is one of very few firms offering both CMMC + CPCSC advisory
CERTIFICATION TIERS
Three Certification Levels
CPCSC defines three progressive levels based on the sensitivity of Specified Information and the nature of the DND contract.
Level 1 — Basic Cyber Hygiene
ANNUAL SELF-ASSESSMENT
Assessment type: Annual self-assessment; annual affirmation to DND/PSPC
Who needs it: Suppliers handling low-sensitivity Specified Information
Controls: Subset of 97 — foundational hygiene requirements
Scoring: Binary MET / NOT MET per control
Tool support: Full L1 assessment mode with export
Level 2— Advanced Cyber Hygiene
TRIENNIAL 3PAO + ANNUAL AFFIRMATION
Assessment type: SCC-accredited Third-Party Assessor Organisation (3PAO), every 3 years
Who needs it: Suppliers handling sensitive Specified Information
Controls: All 97 ITSP.10.171 controls — full weighted scoring
Scoring: Weighted compliance score; SPRS-style methodology
Tool support: Full L2 mode; OSCAL export for 3PAO portal
Level 3— Expert Cyber Hygiene
GOVERNMENT-LED (DND) ASSESSMENT
Assessment type: Conducted directly by the Department of National Defence
Who needs it: Highest-risk DND contracts; critical programme suppliers
Controls: All 97 + enhanced controls from NIST SP 800-172
Scoring: Full government-administered assessment process
Tool support: Tool provides foundation; Cyber Risk Service provides advisory
THE SOLUTION
One File. Every Feature. Zero Infrastructure.
A single HTML file that does what entire GRC platforms charge $100K/year to do — without a single network request.
97
CONTROLS
375
STATEMENTS
94
EDITABLE ODPS
7
EXPORT FORMATS
6
CRYPTO LAYERS
71
TOTAL FEATURES
⚡
97 ITSP.10.171 Controls
Complete Level 1 and Level 2 assessment with all 17 security domains. Every control mapped to its official ITSP.10.171 requirement.
📊
Weighted SPRS-Style Scoring
Calculates your compliance score using weighted methodology — 1, 3, or 5 points per control by risk significance. N/A controls excluded automatically.
🛡️
Auto POA&M Enforcement
Kanban board + Gantt timeline for remediation tracking. Due-date alerts, cost estimator, and priority-sorted gap analysis built in.
📤
OSCAL 1.1.2 Export
Machine-readable JSON assessment results for direct SCC 3PAO handoff. Compatible with OSCAL-based GRC tools and assessment workflows.
🔒
AES-256-GCM Encryption
Six independent cryptographic layers with PBKDF2 750,000 iterations. FIDO2 WebAuthn passkeys. Your data never leaves your device.
🌐
100% Offline Operation
Zero network requests. No cloud. No CDN. No telemetry. Runs on air-gapped machines and restricted DND facilities. Single HTML file.
FEATURE DEEP DIVE
71 Features Across 8 Modules
Every module maps directly to ITSP.10.171 requirements and SCC 3PAO expectations.
📋Assessment Core
- 97 ITSP.10.171 native controls across all 17 security families
- 375 Determination Statements — granular objectives per control
- 94 Organizational-Defined Parameters (ODPs) — editable to your environment
- Level 1 / Level 2 toggle — switch mode without losing data
- Weighted scoring — 1, 3, or 5 points per control by risk significance
- SPRS-style compliance score — adapted for CPCSC
- 5 status options: Not Assessed / Met / Not Met / Partially Met / N/A
- Dynamic maximum score — N/A controls excluded automatically
- Demo mode — “Maple Defence Inc.” pre-loaded for training
🔭 Scoping & Level Finder
- CCSRA Worksheet (7 questions) — determines required certification level
- Scoping Wizard (7-step guided workflow) — defines system boundary
- Scoping Statement generator — exportable boundary documentation
- System boundary mapping — environment of operation documentation
- CCSRA Report export (.txt) — level determination output
🔒Evidence Vault
- Per-control evidence attachment — files, URLs, documentation
- Evidence sufficiency scoring — structured checklist of required types
- AES-256-GCM encryption at rest — evidence encrypted with device key
- Evidence included in encrypted backup — full package preserved
- Auto-populated evidence checklists — required types pre-listed
📄SSP Builder
- 10-section SSP structure — complete System Security Plan scaffolding
- Narrative editor per section — free-text with formatting
- SSP HTML export — single-file SSP document for 3PAO submission
- Control implementation status integrated — auto-reflects assessment
- Version history — maintain SSP versions across cycles
📊CAP / POA&M Management
- Kanban board — visual workflow (To Do / In Progress / Complete)
- Gantt timeline view — project-style timeline with due dates
- Due-date alerts — flags overdue and upcoming tasks
- Cost estimator per item — budget remediation by control gap
- Priority-sorted gap analysis — gaps ranked by weight and risk
- POA&M PDF export — formatted plan for management and 3PAO
- Risk Heatmap — visual heat map by domain and risk level
🤖AI-Assisted Drafting
- Claude Sonnet generates remediation narratives per control
- Save / edit / regenerate — full control over AI content
- 60–80% faster documentation drafting vs. manual writing
- Structured remediation guidance for Not Met controls
- AI Assisted Gap Narrative — one-click drafting per control
📤3PAO Assessor Prep
- SCC-3PAO Assessor Prep — evidence packages in assessor-ready format
- Gap Analysis report — all gaps with weights and priorities
- Client Comparison dashboard — scores across clients side by side
- Assessor Prep export — structured handoff for SCC-accredited 3PAO
- ISO 27001:2022 cross-reference — maps to ISO and SOC 2
👥Multi-User RBAC
- Admin role — full access: users, clients, all settings
- Reviewer role — view findings, approve assessments, trigger exports
- Assessor role — assess assigned domains only; scoped access
- WebAuthn FIDO2 passkeys — Face ID, Touch ID, Windows Hello
- PBKDF2-SHA-256 PIN hashing — 200,000 iterations
- Approval workflow — Reviewer sign-off before 3PAO export
- 500-entry rolling audit log — every action timestamped
- Multi-client workspace — manage multiple organizations
HOW WE COMPARE
Why Offline Beats Cloud for Defence Compliance
Your CPCSC assessment handles Specified Information — data that should never leave your facility.
SECURITY ARCHITECTURE
6 Cryptographic Layers
Six independent cryptographic protections ensure complete data sovereignty from assessment start to 3PAO submission.
Evidence at Rest
AES-256-GCM + Device Key
All evidence and assessment data encrypted in browser IndexedDB
FIPS 197 / NIST 800-38D
Encrypted Backups
AES-256-GCM + PBKDF2 (750K iter)
Full backup archives including evidence files (.enc)
NIST 800-132
User Passwords
PBKDF2-SHA-256 + Salt (200K iter)
All user credentials — no plaintext ever stored
NIST 800-63B
License Keys
AES-256-GCM + HMAC
Per-organization license key integrity and tamper detection
FIPS 198
Authentication
FIDO2 WebAuthn Passkeys
Face ID, Touch ID, Windows Hello — passwordless sign-in
FIDO2 / W3C WebAuthn
Brute-Force Protection
5-Attempt Lockout + 500-entry Log
Account protection + full action accountability trail
NIST 800-53 AC-7
WHO IT’S FOR
Built for the Entire CPCSC Ecosystem
From individual consultants to restricted DND facilities — one tool serves every stakeholder in Canada’s defence supply chain.
🍁
DND Suppliers
Direct suppliers and subcontractors at every tier of the defence supply chain
10,000+ organizations
🔍
SCC-Accredited 3PAOs
Third-party assessor organisations conducting CPCSC Level 2 certifications
Growing assessor pool
🛡️
Restricted Facilities
Air-gapped DND environments, Protected B facilities, and ITAR-restricted sites
Offline only option
📋
Consultants & MSPs
Cybersecurity consultants and managed service providers serving the defence sector
Multi-client workspace
AIR-GAP READY
The Only Tool Built for Restricted DND Networks
Other CPCSC tools are cloud-based and prohibited in restricted environments. Ours works where Specified Information actually lives.
🛡️
Restricted Environment Ready
DND Secure Facilities • Protected B
Air-Gapped Networks • ITAR Environments
SIPR Equivalent • Intelligence Community
Premium tier includes deployment validation documentation and dedicated support.
OUTPUTS
7 Export Formats
Everything your SCC-accredited 3PAO needs — plus management reporting, OSCAL machine-readable data, and secure backup.
🖨 Print Report (PDF)
Executive summary + full assessment report for management
📋 POA&M Report (PDF)
Formatted remediation plan — all gaps, priorities, timelines, costs
⚙️ OSCAL JSON (v1.1.2)
Machine-readable assessment data for 3PAO portal submission
📄 SSP HTML
Complete System Security Plan — 3PAO-ready single-file document
🔐Encrypted Backup (.enc)
Full assessment + evidence — AES-256-GCM + PBKDF2 (750K iter)
📝 CCSRA Report (.txt)
Level determination worksheet — level finder results and rationale
🗺 Scoping Statement (.txt)
System boundary documentation — environment and information scope
PROCESS
11-Step Assessment Workflow
From first login to 3PAO submission — a structured, tool-guided process.
1
Create Admin account and accept EULA
2
Create Client profile and set contract scope
3
Run CCSRA Worksheet → determine required Level
4
Run Scoping Wizard → define system boundary
5
Select Assessment Mode (L1 / L2)
6
Assess controls across all 17 domains
7
Attach evidence + verify sufficiency per control
8
Create POA&Ms for Not Met / Partially Met
9
Build SSP using SSP Builder (10 sections)
10
Run Gap Analysis + Assessor Prep package
11
Export OSCAL + SSP + backup → submit to 3PAO
CONSULTING
Consulting Service — 4-Phase Program
End-to-end CPCSC advisory from gap assessment through 3PAO submission.
Phase 1 — Gap Assessment
- Current posture vs. all 97 controls
- 375 determination statements reviewed
- CUI/Specified Information scope definition
- Risk-prioritized remediation roadmap
- Written Gap Assessment Report
Phase 2 — Remediation Support
- System Security Plan (SSP) development
- Policy library (15+ documents)
- Technical control implementation support
- Staff awareness training delivery
- MFA, endpoint, segmentation guidance
Phase 3 — 3PAO Preparation
- Full internal mock assessment (97 controls)
- Evidence package development
- Determination statement review
- 3PAO selection and scheduling support
- OSCAL export and portal submission prep
Phase 4 — Ongoing Retainer
- Annual policy review and update cycle
- Continuous monitoring advisory
- Change management for system changes
- Re-assessment readiness (triennial 3PAO)
- Annual affirmation support
PRICING
Annual Subscriptions — All Tiers
From individual contractors to classified facilities. Updates, support, and new features included.
Starter
Contact us
per year • up to 3 clients
Small subcontractors getting started with CPCSC readiness
Professional
Contact us
per year • up to 15 clients
Mid-size defense contractors handling multiple contracts
Consultant (POPULAR)
Contact Us
per year • unlimited clients
CCPs, RPs, and consultants serving multiple organizations
Enterprise
Contact us
per year • unlimited clients
3PAOs, prime contractors, and large assessment teams
Classified
Contact us
per year • air-gap certified
SCIFs, Top Secret facilities with deployment validation and SLA
