Mindsec Highlights Readiness Support for Canadian Defence Suppliers Facing CPCSC and CMMC Certification
Oct 28, 2026
Mindsec, a Quebec security compliance company founded in 2023, is highlighting readiness support for Canadian defence suppliers facing both the Canadian Program for Cyber Security Certification (CPCSC) and U.S. CMMC.
Pointe-Claire, Canada, October 28, 2026 -- With the planned November 10 switch to mandatory third-party CMMC assessments suspended and CPCSC Level 2 expected in select Canadian contracts from spring 2027, the Pointe-Claire company says suppliers should prepare for both from one set of evidence.
Mindsec, the Quebec security compliance company founded in 2023, is highlighting readiness support for Canadian defence suppliers facing two certification programs: the Canadian Program for Cyber Security Certification (CPCSC) and the U.S. Cybersecurity Maturity Model Certification (CMMC). The timing isn't accidental. November 10, 2026 was supposed to open CMMC Phase 2, when third-party Level 2 assessments would become the default requirement in applicable U.S. defence solicitations. That step is on hold, and the company says suppliers shouldn't mistake the pause for a reprieve.
What the U.S. pause actually covers
On July 13, 2026, the U.S. Department of War, as the Pentagon now calls itself, suspended the move to CMMC Phase 2 and put later milestones on hold. A CMMC Reform Task Force was given 60 days to review the program, and contracting officers were told to strip Level 2 third-party (C3PAO) and Level 3 requirements from active solicitations as soon as practicable. The review window closed on September 11, and as of late October the Department had published neither the task force's findings nor a new start date.
Far less changed than the headlines suggested. The CMMC program rule at 32 CFR Part 170 has been in force since December 16, 2024, and Phase 1 began when the DFARS acquisition rule took effect on November 10, 2025. Self-assessments still apply, as do the safeguarding and incident-reporting duties in DFARS 252.204-7012 and the NIST SP 800-171 Revision 2 controls expected of anyone handling controlled unclassified information (CUI). Scores still go into the Supplier Performance Risk System, and annual affirmations are still due.
The levels haven't moved either. CMMC Level 1 covers federal contract information (FCI) and the 15 safeguarding requirements in FAR 52.204-21, checked by an annual self-assessment. Level 2 rests on the 110 requirements of NIST SP 800-171 Revision 2 for companies handling CUI, and Phase 2 is when many such contracts would have begun requiring a C3PAO assessment every three years. Level 3 adds 24 requirements selected from NIST SP 800-172 and is assessed by the government's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).
Canada is running on its own clock
CPCSC is run by Public Services and Procurement Canada (PSPC) and built on ITSP.10.171, the Canadian Centre for Cyber Security's version of NIST SP 800-171. Level 1, launched in April 2026, is an annual self-assessment of 13 controls. It is being introduced into select defence contracts from summer 2026 and is required at contract award rather than at bid. Level 2 brings assessment by certification bodies accredited through the Standards Council of Canada. PSPC said in April that Level 2 would reach select defence contracts beginning in spring 2027; its current program overview lists the level as still under development. Level 3, aimed at the most sensitive work such as weapon systems, is assessed by National Defence.
Here's the catch for anyone selling on both sides of the border. PSPC's January 2026 evaluation of the program says the CMMC final program rule would not allow bilateral reciprocity between another country and the Pentagon, and it calls the failure to reach a reciprocity agreement unexpected. The evaluation also flags the risk of duplicated cost and effort for contractors who need both certifications, a burden it says would fall hardest on small and medium-sized enterprises. Recognition runs one way for now: Canada says it may accept a valid CMMC certification case by case, while the U.S. rule offers no route to recognize CPCSC.
The overlap is large but not exact. The Cyber Centre says there are no substantial technical changes between ITSP.10.171 and NIST SP 800-171, but the Canadian standard follows Revision 3 while CMMC Level 2 is still tied to Revision 2. PSPC lists 98 controls for CPCSC Level 2, against 110 at CMMC Level 2. Even the vocabulary shifts: Canada says "specified information" where the U.S. says CUI. Still, most of the underlying evidence describes the same controls.
One evidence base instead of two
That overlap is what Mindsec's CMMC certification and CPCSC certification support is built around. According to Mindsec, its platform maps controls across frameworks, so evidence gathered once, an access control policy, say, can count toward both NIST SP 800-171 and ITSP.10.171. The mapping also reaches ISO 27001, SOC 2 and NIST CSF. Centralized evidence collection and a policy library vetted by lawyers and auditors sit next to gap identification showing which requirements are met and which remain open.
The software comes with people. Mindsec's security and GRC specialists work alongside a supplier's staff, starting with what the company calls day-one scoping: working out exactly which systems handle FCI, CUI or Canadian specified information, so the compliance boundary is drawn before anyone starts collecting evidence. Mindsec does not perform assessments, issue certificates or act as a C3PAO. Its work comes before an assessor arrives.
Mindsec also pushes back on the idea that size sets the required level. In the U.S., the level follows the information a contract involves. Canada sets levels contract by contract, and Level 2 is meant for contracts involving controlled defence information or more complex cyber-sensitive work. A 20-person machine shop that receives controlled technical drawings can face a heavier requirement than a much larger firm supplying office services.
So why start while the U.S. requirement is on hold? The pause only touches how compliance gets checked; the controls are required today. Canada's Level 2 is still being built, and the company expects assessor time on both sides of the border to tighten once demand returns. Prime contractors can also set their own terms. Elbit Systems of America, for one, sent suppliers an open letter three days after the suspension urging them to keep maturing their programs.
Mindsec has also published two plain-language guides, "CPCSC: Canada's Cyber Security Certification for Defence Suppliers" and "CPCSC vs CMMC Certification: Comparing Canada and the U.S." The company says its approach can cut compliance overhead by up to 70% and get a supplier to CPCSC Level 1 self-assessment readiness in weeks, not months. Level 2 timelines depend on where a supplier starts and how much sensitive contract information it holds.
About Mindsec
Mindsec is a security compliance company founded in Quebec, Canada in 2023. The company combines compliance automation software with hands-on expert guidance to help organizations simplify risk management, data privacy and information security programs. Mindsec supports companies working toward frameworks and standards including SOC 2, ISO 27001, ISO 9001, ISO 42001, PCI DSS, HIPAA, GDPR, NIST, CMMC, CPCSC and Quebec Law 25, and says its approach can help organizations reach certification readiness in as little as six weeks while reducing compliance overhead by up to 70%.
Media Contact
Organization: Mindsec
Email: [email protected]
Phone: 514-887-6463
Location: Pointe-Claire, Quebec, Canada
Website: https://mindsec.io/
Contact Info:
Name: George
Email: Send Email
Organization: Mindsec
Phone: 514-887-6463
Website: https://mindsec.io/
Release ID: 89207652
In case of identifying any errors, concerns, or inconsistencies within the content shared in this press release that necessitate action or if you require assistance with a press release takedown, we strongly urge you to notify us promptly by contacting [email protected] (it is important to note that this email is the authorized channel for such matters, sending multiple emails to multiple addresses does not necessarily help expedite your request). Our expert team is committed to addressing your concerns within 8 hours by taking necessary actions diligently to rectify any identified issues or supporting you with the removal process. Delivering accurate and reliable information remains our top priority.
More News
U.S. Restricts Trade With Chinese Genomics Company
The move will block shipments from BGI, a major Chinese firm that U.S. officials allege is associated with forced labor and the abuse of minority groups.
Hegseth pitches US-Asean defence framework but will it be a hard sell?
US Defence Secretary Pete Hegseth on Wednesday proposed a new US-Asean defence framework to guide cooperation over what he called “critically important years” ahead, but offered few details on what it would entail. The proposal faces questions over whether members of the Association of Southeast Asian Nations will embrace a bloc-wide initiative, with analysts suggesting they would prefer bilateral arrangements that preserve their flexibility as they navigate ties with Washington and...
‘Not to find scapegoats’: Singapore ministers summon bosses of 10 firms over haze
In a rare move, Singapore on Wednesday summoned top executives from 10 locally registered companies potentially linked to haze-causing fires in Indonesia to a meeting with three ministers. The executives all agreed to cooperate fully in an investigation by the city state into the regional environmental crisis that has caused air quality to dip to “very unhealthy” levels earlier this month. Deputy Prime Minister Gan Kim Yong, Senior Minister K Shanmugam and Minister for Sustainability and the...
Will Pakistan Fight in Saudi Arabia’s Wars?
Questions have been raised over the strength of Pakistan’s security commitment to Saudi Arabia ever since the SMDA’s inception in September 2025.
Jio’s Blockbuster I.P.O. Gives India’s Investors a Lift
Jio Platforms shares surged on their first day of trading, even as questions mount about the telecom firm’s growth prospects and a new generation takes charge.
Kyrgyzstan Temporarily Bans Imports of Apples (and More)
The EU – which is the top exporter of apples to Kyrgyzstan – urged Bishkek against the ban, noting that WTO rules require “exceptional circumstances” to justify such measures.
Why Are Russia and China Cooperating on ‘Patriotic Education’?
China has decades of experience in “patriotic education.” What it can learn from Russia is how to use education to support a war effort.
Unitree reports 70% surge in quarterly revenue, though AI investment weighs on net profit
Leading Chinese robotics company Unitree Robotics on Wednesday reported a 69.93 per cent year-on-year increase in quarterly revenue to 665 million yuan (US$99.7 million), though net profits excluding non-recurring items fell 17.42 per cent to 105 million yuan, as the company released its first earnings since going public. The results for the three months ending September 30 showed a continued surge in research and development spending by the Hangzhou-based company, which jumped 249.58 per cent...
Elon Musk, Jensen Huang have opposing outlooks on AI neoclouds. Who is likely correct?
As investor anxiety over an artificial intelligence bubble mounts, SpaceX’s Elon Musk and Nvidia chief Jensen Huang have offered starkly divergent outlooks on whether the specialist cloud providers powering the boom can survive their mounting debts. While Musk has warned of impending collapses and consolidation among the more than 200 dedicated graphics processing unit (GPU) rental ventures known as “neoclouds”, Huang remains bullish, insisting that robust market demand will unlock the capital...
China Wants Its AI to Go Global, on Its Own Terms
Beijing also wants tailored control over what technology leaves, who acquires it, and what remains in the hands of the Chinese government.
Cruise ship suspends global voyage in Cambodia over fuel prices, hundreds disembark
Hundreds of people permanently living aboard a touring cruise ship were forced to disembark in Cambodia this week after the vessel’s operator said fuel price increases from the Iran war had made operations prohibitively expensive. The Villa Vie Odyssey had been cruising the world for at least 755 days as one of only a handful of ships that offered passengers the opportunity to rent or buy long-term or even permanent residences on board. On Tuesday, the ship’s owner, Villa Vie Residences,...
Toward a New ‘Normal’: The Recalibration of the Japan-US Alliance
Since the Cold War, Japan and the U.S. have both been seeking normalcy, but they define the term very differently.
YOUR NEWS, OUR NETWORK.
Do you have Great News you want to tell the world?
Be it updates about your business or your community, you can make sure that it’s heard by submitting your story to our network reaching hundreds of news sites across 6 verticals.