Xorabyte
CPCSC Level 1 Checklist

The CPCSC Level 1 readiness checklist

A scannable checklist covering scoping, the 13 required controls by family, internal documentation, the self-assessment tool, and evidence retention, drawn from canada.ca's own guidance.

Before the controls

Scope it first

Canada.ca's Level 1 scoping guide treats this as a business decision, not a purely technical exercise.

1.
Identify the Specified Information named or implied in your contract
2.
Map where that information is received, created, stored, emailed, transferred, backed up, and destroyed
3.
List every system, device, and account that touches it anywhere in that flow
4.
Validate the resulting scope against the 13 Level 1 requirements below
The 13 controls

Level 1 requirements by family

Canada.ca groups the 13 controls under six families. All 13 apply; none are optional at Level 1.

Access control

1.
Manage user accounts
2.
Give people only the access they need
3.
Use only approved systems and devices
4.
Prevent sensitive information from being shared publicly

Identification and authentication

1.
Use individual accounts and strong passwords
2.
Approve devices before they connect
3.
Enable multifactor authentication

Media protection

1.
Wipe or destroy old devices before disposal

Physical protection

1.
Keep a list of who can access secure areas
2.
Control physical entry

Systems and communications protection

1.
Use basic network protections

System and information integrity

1.
Apply security updates
2.
Use antivirus and anti-malware software

Internal documentation to prepare

Canada.ca's guidance asks you to make a few internal rules for your organization before you assess.

Password requirements

Length, complexity, and rotation rules if you require them.

Approved systems and devices list

The systems and devices allowed to touch Specified Information.

User access request and approval procedure

How access is requested, approved, and recorded.

Device management rules

What happens when a device is issued, reassigned, or retired.

Assessment and attestation

Complete and record the self-assessment

1.
Complete the self-assessment at cyberpostureassessments.ops.cyber.gc.ca/cpcsc-pccc, against the scope defined above
2.
Print or save the results page, which shows an expiry date
3.
Post proof of your self-attestation and expiry date to your CanadaBuys profile
4.
Retain supporting evidence for the duration of your attestation cycle, or at least one year
5.
Calendar the expiry date and re-run scoping, gap closure, and the assessment annually

Frequently asked

Is this checklist a substitute for the government self-assessment tool?

No. This is a readiness checklist to work through before you open the self-assessment tool at cyberpostureassessments.ops.cyber.gc.ca/cpcsc-pccc, so you scope correctly and close gaps first.

Do all 13 Level 1 controls apply to every supplier?

Yes, for any supplier and system in scope. Level 1 has no optional controls; all 13 apply once an asset is scoped in.

How is this different from the Level 1 self-assessment walkthrough?

The walkthrough explains each step in narrative detail with the reasoning behind it. This page is the scannable version, meant for tracking progress against each requirement.

What happens if I am missing a control when I open the self-assessment tool?

Canada.ca does not describe a formal remediation grace period for Level 1. Close the gap before you complete the self-assessment rather than attesting to a control that is not actually in place.

See also: CPCSC readiness overview and the Level 1 walkthrough

Get CPCSC Level 1 ready