New guide maps CAN/DGSI 104 to CPCSC Level 1, helping organizations build on existing cybersecurity investments and prepare for defence supply-chain requirements
OTTAWA, September 22, 2026 — As cybersecurity becomes an increasingly important requirement for participation in defence and critical infrastructure supply chains, the Digital Governance Council (DGC) today released a new Practical Guide to Using CAN/DGSI 104 to Support CPCSC Level 1 Readiness, designed to help Canadian companies understand how different cybersecurity requirements relate and prepare for defence supply-chain opportunities.
The guide provides a comprehensive crosswalk between CAN/DGSI 104, a National Standard of Canada for baseline cybersecurity, and Level 1 of the Canadian Program for Cyber Security Certification (CPCSC). It shows organizations where existing controls may support CPCSC Level 1 requirements, where greater specificity or evidence may be needed, and where additional requirements need to be addressed.
CPCSC is the Government of Canada’s cybersecurity certification program for defence suppliers. The program is managed by Public Services and Procurement Canada (PSPC) and led with National Defence, with the Standards Council of Canada (SCC) serving as the accreditation body and the Canadian Centre for Cyber Security providing cybersecurity technical expertise. CPCSC Level 1 became available in April 2026 and has been introduced in select defence contracts over the summer 2026.
“Cybersecurity is increasingly a condition of participating in strategic supply chains, […] For Canadian companies, particularly SMEs, the opportunity is to build on the cybersecurity work they have already done. This guide gives organizations a clearer view of what may already be in place, what may need to be strengthened and what still needs to be done.” – said Keith Jansa, CEO of the Digital Governance Council
The guide comes as Canadian suppliers increasingly operate across domestic and international markets with different cybersecurity expectations. CPCSC, CAN/DGSI 104 and the U.S. Cybersecurity Maturity Model Certification (CMMC) differ in structure and purpose, but share an objective of improving cyber hygiene, managing cyber risk and protecting sensitive information.
The crosswalk examines 17 control areas, including authentication, access control, patch management, malware protection, network security, external systems, portable media, logging, risk management and physical security. By mapping these requirements, organizations can identify where existing cybersecurity controls and evidence can be carried forward and where further action may be required. In many areas, organizations implementing CAN/DGSI 104 may already have foundational practices relevant to CPCSC Level 1.
Connecting Standards, Certification and Readiness
CAN/DGSI 104 provides a common foundation for baseline cybersecurity, establishing practical requirements for small and medium-sized organizations across areas such as governance, risk management, access control, patching, incident response and secure configuration.
That foundation supports different forms of assurance. CyberSecure Canada is an SCC conformity assessment program under which the SCC accredits conformity assessment bodies to certify organizations to CAN/DGSI 104. DGC CyberReady, by comparison, is a validation and verification program focused on implementation and readiness, providing an independent assessment of how cybersecurity requirements have been put into practice and where further attention may be needed.
For organizations preparing to participate in defence supply chains, DGC’s CyberDefence Ready Validation & Verification Program applies that readiness approach specifically to CPCSC Level 1. Participating organizations receive an independent review of their cybersecurity practices against CPCSC Level 1 requirements and a Statement of Verification that may support internal readiness, supply-chain due diligence, partner discussions and preparation of evidence for certification or procurement processes.
“Different standards and assurance programs serve different purposes,” Jansa added. “Certification provides formal recognition against defined requirements. Verification provides independent evidence of implementation and readiness. Making those relationships clearer can make it easier for Canadian companies to demonstrate trusted cybersecurity across customers, markets and supply chains.”
The guide does not establish equivalency between CAN/DGSI 104 and CPCSC Level 1. CyberReady or CyberDefence Ready verification does not replace CPCSC self-assessment, certification, contractual submissions or Government of Canada acceptance requirements.
Download the Practical Guide to Using CAN/DGSI 104 to Support CPCSC Level 1 Readiness from DGC and use the comprehensive crosswalk to identify where your current cybersecurity program supports CPCSC Level 1 and where further action may be required.