Cybersecurity, compliance readiness, digital sovereignty and technology integration for defence, aerospace and national-security organizations, and for the suppliers that support them.
Readiness, scoping, control implementation and assessment preparation.
Canadian defence supply-chain cybersecurity readiness and alignment.
Secure handling and architecture for export-controlled and controlled goods data.
Security control design and assessment for Canadian government environments.
Cloud security readiness and control alignment for U.S. federal requirements.
Third-party risk, sovereignty and cyber resilience across primes and suppliers.
Requirements differ by program and contract, and several are being phased in. Confirm applicability against the clauses in your current and anticipated contracts.
The U.S. Department of Defense's Cybersecurity Maturity Model Certification (CMMC) program sets cybersecurity requirements for contractors that handle Federal Contract Information or Controlled Unclassified Information. Requirements are applied through contract clauses, so the first question is which level your contracts require.
What you get
The Canadian Program for Cyber Security Certification (CPCSC) sets cybersecurity requirements for suppliers to Canada's defence procurement that handle sensitive unclassified information. C3SA helps Canadian suppliers determine likely requirements and prepare evidence, including suppliers who also face CMMC.
What you get
Access control, secure handling and system architecture for technical data subject to U.S. ITAR and Canada's Controlled Goods Program, so only authorized persons can reach it. Export-control legal determinations remain with your counsel and compliance officer.
What you get
Security control selection, implementation and assessment support based on the Canadian Centre for Cyber Security's ITSG-33 risk-management guidance for Government of Canada systems. C3SA supports readiness; authorization decisions rest with the responsible government authority.
What you get
Readiness and control alignment for cloud service providers pursuing U.S. federal authorization, including authorization-boundary definition, gap assessment and documentation support.
What you get
Third-party cyber risk, sovereignty and resilience across primes and their suppliers, answering one question for each critical component: who owns, operates, accesses, supports and can replace it?
What you get
Defence and national-security programs combine sensitive supply chains, mission-critical systems and contract-driven security requirements. C3SA brings security engineering, compliance readiness, exercises and sovereignty analysis together around the systems and suppliers the mission depends on.
For suppliers, that means one readiness program that addresses CMMC and CPCSC together where both apply, instead of two parallel compliance projects. For programs and primes, it means a defensible architecture, readiness evidence and exercised response plans.
It depends on your contracts. Suppliers to the U.S. Department of Defense may face CMMC requirements, and suppliers to Canada's defence procurement may face CPCSC requirements. Many Canadian suppliers face both. Requirements are phased in over time, so check the clauses in your current and anticipated contracts.
C3SA's role is readiness: scoping, gap assessment, remediation and evidence preparation. Certification decisions rest with the authorized assessors or government authority for each program.
With the CMMC & CPCSC Readiness Navigator for an initial view of scope and evidence priorities, then a scoped readiness assessment.
Defence and national-security buyers face sensitive supply chains, mission demands and procurement-driven security requirements.
C3SA brings security engineering, assurance, exercises and sovereignty analysis together around mission-critical systems and suppliers.
A mission-focused risk picture, defensible architecture, readiness evidence and exercised response plans.
Prepare Canadian defence suppliers for CMMC, CPCSC, controlled information and defence supply-chain security obligations.
