By my estimate, a small shop with a contained network and current equipment needs about 6 months of part-time effort to get ready for Level 2. A flat network with shared admin accounts and no logging needs closer to 18 months, plus some capital. Those are my numbers from the work involved, not figures PSPC has published.
The reasoning
Level 2 assesses all 98 ITSP.10.171 requirements, through a certification body accredited by the Standards Council of Canada, with an annual affirmation between assessments. That is a long way from Level 1’s 13 requirements and a yearly self-attestation.
The time goes into governance more than technology. A firewall can be bought and installed in a week. Written policies that people follow, a system security plan that matches the running network, access reviews, log reviews, and one piece of evidence for every requirement take months to build and months more to prove through habit.
Scope sets the calendar. If Specified Information is confined to an enclave, you prepare the enclave. If it has spread across every laptop and mailbox, the same 98 requirements apply to the whole company. The scoping page covers the shrinking steps.
What PSPC has published
PSPC’s September 29, 2026 program overview says Levels 2 and 3 are under development and gives no dates. Its April 2026 announcement planned Level 2 for select contracts from spring 2027, and its earlier timeline page read April 2027 to March 2028. As of my last check in early October, the assessment methodology, the accredited certification body list, and the rules for gaps found at assessment were not published.
PSPC also says suppliers will first need to show they meet the new Level 1 controls. Level 1 comes first, then, and it is the opening step of any Level 2 plan I would draw.
A rough split of my 6-month case looks like this. The first 6 to 8 weeks go to scoping and the Level 1 foundation. The next stretch goes to policies and the system security plan, written to match what the network really does. The last stretch goes to collecting evidence, running your own rehearsal, and fixing what it finds. A flat network adds a rebuild phase in front of all that, and the rebuild is where the capital goes.
Edge cases
Open items at assessment are the biggest unknown. CMMC allows limited plans of action with a 180-day closeout, but no published Canadian position exists, so don’t assume the same here.
If your prime never asks for Level 2, you may not need it for years. The contract names the level, so read the clauses before you commit a budget.
What to do this week
- Confirm which contracts carry Specified Information clauses.
- Map where that data lives and draw a boundary.
- Run a gap check against the 98 requirements and note which are policy gaps and which are technical.
- Complete Level 1, since it is everyone’s first step.
The Level 2 page tracks PSPC’s timing changes as they happen, and CPCSC Bytes carries shorter notes.
If you want to size your own timeline, book a scoping call.