Canada's new cyber-security certification program is live. Suppliers must complete a Level 1 self-assessment and attest it on CanadaBuys at contract award. Elpista takes you from zero to a complete, evidenced, renewable Level 1 assessment — built for teams with no compliance staff.
CPCSC Level 1 is required at contract award, and the clauses are phasing into Department of National Defence solicitations now. If you can't show a completed Level 1 self-assessment on your CanadaBuys profile, you can't win the work. The time to prepare is before the clause lands in a bid you want.
Level 1 is the foundational tier of Canada's program (based on ITSP.10.171 / NIST SP 800-171). It's a self-assessment — but most small suppliers have no one on staff to run it.
Scope first, then each control one at a time — what it's asking, why it matters, what good looks like, and an example of what satisfies it. No NIST jargon without a translation.
Upload a file, paste a link, or write a short note — stored per control on a tamper-evident audit trail, with Canadian data residency.
See exactly what's met-and-evidenced versus outstanding. Nothing is marked done without evidence — so the score reflects your real state.
Self-attestation report, scope definition, gap/fix plan (POA&M), a CanadaBuys-ready summary, and a per-control evidence pack — branded and ready.
Level 1 is annual. Elpista tracks your expiry, reminds you, and carries last year's answers and evidence forward — flagging what's gone stale.
The same crosswalked engine advances SOC 2, ISO 27001 and NIST — so evidence you gather for CPCSC counts toward the rest.
Only Level 1 is a self-assessment. We show the whole path so you can plan ahead.
Self-assess, evidence, attest on CanadaBuys, and renew yearly. This is what Elpista does for you today.
An external, accredited assessment plus an annual affirmation. Not self-attestable — under development.
A government-led assessment plus an annual affirmation. Not self-attestable — under development.
CPCSC Level 1 is a self-assessment: there is no third-party assessor at this level. Elpista is not an accredited assessor (C3PAO) and does not certify compliance. It's where you prepare, evidence and maintain the assessment you attest — and because it's one crosswalked engine, the same work also advances your SOC 2 / ISO 27001 / NIST programs.
Based on ITSP.10.171 / NIST SP 800-171 Rev 3. Official CPCSC source (PSPC / Canadian Centre for Cyber Security) →
Canadian-built, by Shield AI Software Inc. We don't just sell the tool — we use it.
Shield AI runs its SOC 2 program on Elpista with real, automatically-collected evidence and a real auditor pack. The honesty you see in the product is the honesty we hold ourselves to.
Your evidence stays in Canada, on a tamper-evident, hash-chained audit trail — the record you'd want behind a government submission.
Plain language, guided steps, and the exact outputs the program expects — designed for suppliers without a compliance department.
Walk through your scope and the 13 controls with us, and leave with a clear picture of where you stand and what to fix — before the clause lands in a bid you want.
Book a readiness session →The Level 1 control set shown here is indicative until PSPC/CSE publishes the official Level 1 criteria; confirm against the official source before relying on it for a submission. Elpista does not certify compliance and is not an accredited assessor.