CPCSC Level 1 for Canadian defence suppliers: do you need it, what it requires and how to prove your controls

Define which account types are allowed, who is authorized to use them, what privileges each account receives, and how accounts are created, changed, monitored, disabled and removed.

Keep a current account inventory, assign named owners, document role and group membership, remove former users promptly, disable stale accounts and define when users must sign out.

Account exports, approved-user lists, role or group reports, offboarding records, disabled-account reports, review notes and relevant sign-in or audit records.

Assuming the directory is accurate without a dated review or leaving shared, dormant and former-user accounts unexplained.

Enforce approved logical access to specified information and the systems that hold it according to documented authorization and access-control rules.

Match permissions to job duties, restrict sensitive folders and systems, separate ordinary and administrator access, and review exceptions instead of letting access accumulate forever.

Permission reports, approved access requests, role assignments, shared-drive or application access exports, configuration settings and periodic access reviews.

Having a policy that says “least privilege” while broad groups or inherited permissions still provide access to people who do not need it.

Prohibit external systems unless specifically authorized, define the security conditions they must meet, verify those conditions and retain appropriate connection or processing agreements.

Decide whether personal devices, home computers, cloud applications, partner systems and portable storage may handle specified information, then enforce the decision.

Approved-system lists, BYOD or remote-work rules, provider agreements, security requirements, device-compliance reports, remote-access settings and portable-media restrictions.

Treating Microsoft 365, a subcontractor portal or an employee’s personal device as “outside the scope” even though it stores, processes or transmits specified information.

Train authorized publishers, review public content for specified information and remove protected information when it is discovered on a public system.

Control who can publish to websites and social accounts, use a review step before posting, and document how accidental disclosure is removed and escalated.

Publisher lists, approval records, training records, website-content reviews, public-system audit logs and records showing removal or response to exposed information.

Checking the public website once while ignoring shared links, document portals, social media, job postings and cloud files made public by link.

Uniquely identify and authenticate users and processes acting for users, and define circumstances that require users to authenticate again.

Use individual accounts, eliminate avoidable shared identities, connect automated processes to accountable owners, and require re-authentication for sensitive or higher-risk actions.

User directories, identity settings, authentication policies, account lists, re-authentication settings, application configuration and sign-in records.

Relying on a shared shop-floor or office account that makes it impossible to determine who accessed or changed protected information.

Define which devices must be uniquely identified and authenticated before they establish a connection to the protected environment.

Maintain a device inventory and use enrolment, certificates, managed-device rules or equivalent controls so unknown equipment cannot quietly join the environment.

Device inventories, management-platform exports, enrolment records, certificates, connection reports, conditional-access settings and approved-device lists.

Knowing which laptops were purchased but not knowing which computers and phones can currently connect to the systems in scope.

Implement strong multi-factor authentication for both privileged and non-privileged account access.

Cover administrators and ordinary users, including remote and cloud access, and identify legacy paths or service accounts that bypass the normal sign-in policy.

MFA policy and configuration exports, conditional-access rules, authentication-method reports, administrator settings, sign-in reports and documented exceptions.

Showing that some employees enrolled in MFA while break-glass accounts, administrators, legacy protocols or another application remain outside the policy.

Sanitize media containing specified information before disposal, release outside organizational control or release for reuse.

Define approved wiping or destruction methods for computers, drives, phones, removable media, printers and other devices that can retain information.

Sanitization procedures, wipe logs, disposal or destruction certificates, asset-return records, chain-of-custody records and disposition approvals.

Deleting files, resetting a device or trusting a recycler without retaining evidence that the media was sanitized appropriately.

Develop, approve and maintain a list of people authorized to enter facilities where in-scope systems reside, issue credentials, review the list and remove access when no longer required.

Identify protected rooms and workspaces, define who may enter them, review keys or badges on a schedule and promptly remove departed staff and expired access.

Authorized-person lists, approval records, badge or key assignments, periodic review records, access-removal records and facility procedures.

Assuming a locked exterior door proves authorization when keys, codes and badge lists have not been reviewed or tied to named people.

Verify and enforce physical access at entry and exit points, maintain access logs, control and escort visitors, secure keys and combinations, and protect output devices.

Use locks, badges, controlled reception or equivalent safeguards; log visitors; protect printed output; and control server, network and document-storage areas.

Visitor and entry logs, key or badge inventories, access-control configurations, escort procedures, lock-change records, photos or diagrams and review records.

Protecting the server room while printers, paper files, loading areas or an unattended reception desk expose the same specified information.

Monitor and control communications at managed external and key internal interfaces, separate publicly accessible components, and route external connections through managed boundary protections.

Know where internet, cloud, remote-access and internal trust boundaries exist; manage firewalls and gateways; and avoid unmanaged paths around the protected environment.

Network diagrams, firewall or gateway configurations, remote-access rules, approved-connection lists, network logs, segmentation settings and security architecture notes.

Providing a firewall screenshot without showing that all relevant external connections pass through it or that public systems are separated from internal systems.

Identify, report and correct system flaws and define how quickly security-relevant software and firmware updates must be installed.

Assign ownership for updates, define target timelines, track exceptions, include network and firmware updates, and verify that failed or deferred updates are corrected.

Patch reports, vulnerability records, update policies, remediation tickets, change records, firmware inventories, exception approvals and recent correction logs.

Relying on automatic updates without reviewing failures, unsupported devices, firmware, third-party applications or systems that were offline.

Deploy malicious-code protection at appropriate locations, keep it updated, scan systems and external files, and block, quarantine or otherwise respond to detections.

Cover endpoints and relevant gateways, keep protection current, enable real-time scanning, review unhealthy devices and document the response to detections and false positives.

Endpoint-protection status reports, configuration exports, update records, scan results, detection and quarantine logs, alert tickets and exception records.

Paying for endpoint protection but leaving devices inactive, unmanaged, out of date or excluded without a documented reason and compensating safeguard.