Expect two kinds of request. The first is proof that you attested, which is the results page and the expiry date confirmed in your CanadaBuys supplier profile. The second is whatever supports the 13 answers, which at Level 1 you keep yourself and show on request.
The reasoning
Level 1 is an annual self-assessment against 13 of the 98 ITSP.10.171 requirements. PSPC’s Level 1 page tells suppliers to keep evidence for the duration of the attestation cycle, or at least one year, and lists examples such as account and device lists, access review notes, security policies, training records, patch and sanitization logs, visitor logs, firewall settings, and screenshots of MFA configuration.
PSPC also says you must provide proof of self-attestation and its expiry date in CanadaBuys, and again with a bid on a contract that requires Level 1. That proof is the part nobody can skip. The rest sits in your files until someone asks.
What a prime is likely to ask
PSPC doesn’t set a prime’s questionnaire, so this part is my expectation. Primes already send supplier assurance questions about insurance and quality, and cyber status is a natural addition. I would expect these, roughly in this order:
- Your results page with its expiry date
- Which contracts, and which systems, your boundary covers
- A named person who signed the attestation
- Evidence for the requirements a prime cares about most, usually MFA, patching, and who has access
- A statement of what happens when your environment changes
None of that is a published prime checklist. Read your contract’s clauses and ask the prime what form it wants.
Edge cases
The attestation is a signed representation in a federal procurement setting, so an answer you can’t back up is a risk to you rather than a formality. If a requirement isn’t met yet, fix it before you attest. Level 1 gaps are usually cheap to close.
Your boundary matters here too. Evidence only has to cover the systems where Specified Information lives, so a tight scope means fewer artifacts. The scoping page covers how to draw it.
What to do this week
- Make a folder per requirement identifier, 13 in all.
- Put one dated artifact in each, such as a screenshot, an export, or a signed policy.
- Save the PSPC results page next to a note of the expiry date, and calendar the renewal a month early.
- Draw the boundary on one page and date it.
The Level 1 page lists the 13 requirements in plain language, and the Level 1 checklist pairs each with the evidence an assessor’s methods would reach for. More short explainers live in CPCSC Bytes.
To go through your own evidence folder with someone who reads these requirements daily, book a scoping call.