With the planned November 10 switch to mandatory third-party CMMC assessments suspended and CPCSC Level 2 expected in select Canadian contracts from spring 2027, the Pointe-Claire company says suppliers should prepare for both from one set of evidence.
Mindsec, the Quebec security compliance company founded in 2023, is highlighting readiness support for Canadian defence suppliers facing two certification programs: the Canadian Program for Cyber Security Certification (CPCSC) and the U.S. Cybersecurity Maturity Model Certification (CMMC). The timing isn't accidental. November 10, 2026 was supposed to open CMMC Phase 2, when third-party Level 2 assessments would become the default requirement in applicable U.S. defence solicitations. That step is on hold, and the company says suppliers shouldn't mistake the pause for a reprieve.
What the U.S. pause actually covers
On July 13, 2026, the U.S. Department of War, as the Pentagon now calls itself, suspended the move to CMMC Phase 2 and put later milestones on hold. A CMMC Reform Task Force was given 60 days to review the program, and contracting officers were told to strip Level 2 third-party (C3PAO) and Level 3 requirements from active solicitations as soon as practicable. The review window closed on September 11, and as of late October the Department had published neither the task force's findings nor a new start date.
Far less changed than the headlines suggested. The CMMC program rule at 32 CFR Part 170 has been in force since December 16, 2024, and Phase 1 began when the DFARS acquisition rule took effect on November 10, 2025. Self-assessments still apply, as do the safeguarding and incident-reporting duties in DFARS 252.204-7012 and the NIST SP 800-171 Revision 2 controls expected of anyone handling controlled unclassified information (CUI). Scores still go into the Supplier Performance Risk System, and annual affirmations are still due.
The levels haven't moved either. CMMC Level 1 covers federal contract information (FCI) and the 15 safeguarding requirements in FAR 52.204-21, checked by an annual self-assessment. Level 2 rests on the 110 requirements of NIST SP 800-171 Revision 2 for companies handling CUI, and Phase 2 is when many such contracts would have begun requiring a C3PAO assessment every three years. Level 3 adds 24 requirements selected from NIST SP 800-172 and is assessed by the government's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).
Canada is running on its own clock
CPCSC is run by Public Services and Procurement Canada (PSPC) and built on ITSP.10.171, the Canadian Centre for Cyber Security's version of NIST SP 800-171. Level 1, launched in April 2026, is an annual self-assessment of 13 controls. It is being introduced into select defence contracts from summer 2026 and is required at contract award rather than at bid. Level 2 brings assessment by certification bodies accredited through the Standards Council of Canada. PSPC said in April that Level 2 would reach select defence contracts beginning in spring 2027; its current program overview lists the level as still under development. Level 3, aimed at the most sensitive work such as weapon systems, is assessed by National Defence.
Here's the catch for anyone selling on both sides of the border. PSPC's January 2026 evaluation of the program says the CMMC final program rule would not allow bilateral reciprocity between another country and the Pentagon, and it calls the failure to reach a reciprocity agreement unexpected. The evaluation also flags the risk of duplicated cost and effort for contractors who need both certifications, a burden it says would fall hardest on small and medium-sized enterprises. Recognition runs one way for now: Canada says it may accept a valid CMMC certification case by case, while the U.S. rule offers no route to recognize CPCSC.
The overlap is large but not exact. The Cyber Centre says there are no substantial technical changes between ITSP.10.171 and NIST SP 800-171, but the Canadian standard follows Revision 3 while CMMC Level 2 is still tied to Revision 2. PSPC lists 98 controls for CPCSC Level 2, against 110 at CMMC Level 2. Even the vocabulary shifts: Canada says "specified information" where the U.S. says CUI. Still, most of the underlying evidence describes the same controls.
One evidence base instead of two
That overlap is what Mindsec's CMMC certification and CPCSC certification support is built around. According to Mindsec, its platform maps controls across frameworks, so evidence gathered once, an access control policy, say, can count toward both NIST SP 800-171 and ITSP.10.171. The mapping also reaches ISO 27001, SOC 2 and NIST CSF. Centralized evidence collection and a policy library vetted by lawyers and auditors sit next to gap identification showing which requirements are met and which remain open.
The software comes with people. Mindsec's security and GRC specialists work alongside a supplier's staff, starting with what the company calls day-one scoping: working out exactly which systems handle FCI, CUI or Canadian specified information, so the compliance boundary is drawn before anyone starts collecting evidence. Mindsec does not perform assessments, issue certificates or act as a C3PAO. Its work comes before an assessor arrives.
Mindsec also pushes back on the idea that size sets the required level. In the U.S., the level follows the information a contract involves. Canada sets levels contract by contract, and Level 2 is meant for contracts involving controlled defence information or more complex cyber-sensitive work. A 20-person machine shop that receives controlled technical drawings can face a heavier requirement than a much larger firm supplying office services.
So why start while the U.S. requirement is on hold? The pause only touches how compliance gets checked; the controls are required today. Canada's Level 2 is still being built, and the company expects assessor time on both sides of the border to tighten once demand returns. Prime contractors can also set their own terms. Elbit Systems of America, for one, sent suppliers an open letter three days after the suspension urging them to keep maturing their programs.
Mindsec has also published two plain-language guides, "CPCSC: Canada's Cyber Security Certification for Defence Suppliers" and "CPCSC vs CMMC Certification: Comparing Canada and the U.S." The company says its approach can cut compliance overhead by up to 70% and get a supplier to CPCSC Level 1 self-assessment readiness in weeks, not months. Level 2 timelines depend on where a supplier starts and how much sensitive contract information it holds.
About Mindsec
Mindsec is a security compliance company founded in Quebec, Canada in 2023. The company combines compliance automation software with hands-on expert guidance to help organizations simplify risk management, data privacy and information security programs. Mindsec supports companies working toward frameworks and standards including SOC 2, ISO 27001, ISO 9001, ISO 42001, PCI DSS, HIPAA, GDPR, NIST, CMMC, CPCSC and Quebec Law 25, and says its approach can help organizations reach certification readiness in as little as six weeks while reducing compliance overhead by up to 70%.