CPCSC vs CMMC: same DNA, separate machinery

// 01 · TWO HISTORIES

How did each program get here?

CMMC is the older program by 6 years, and CPCSC is openly modelled on it. Watching the American rollout, including its false starts, is part of why Canada's version launched with 3 levels instead of 5 and leaned on an existing standard rather than inventing one.

// 02 · WHERE THEY'RE THE SAME

What do CPCSC and CMMC have in common?

• The same control set. ITSP.10.171 is a deliberate Canadian adaptation of NIST SP 800-171 Revision 3 with no substantive technical changes; the document says so itself. It carries 98 requirements across 17 families, with the identifiers NIST withdrew in Revision 3 kept as not allocated so numbering lines up across the border, and it uses organization-defined parameters, the bracketed values a supplier sets and records in its system security plan unless a contract specifies them. Work done implementing 800-171 controls transfers technically in both directions.
• The same target data class. Both programs protect sensitive but unclassified government information on supplier systems. Canada calls it Specified Information; the US calls it Controlled Unclassified Information. In both cases the contract identifies data that needs safeguarding once it leaves government networks.
• Certification as a condition of award. Both programs enforce through procurement: certification is a gate on contract eligibility, named per solicitation, flowed down to subcontractors handling the protected data.
• A 3-level structure with self-assessment at the bottom. Both start with an annual self-assessment and attestation for basic safeguarding, move to third-party assessment in the middle tier, and reserve government-led assessment for the most sensitive work.
• Signed attestations with teeth. Both rely on an accountable signature. In the US that's the affirming official filing in SPRS, with False Claims Act exposure behind it, and a September 2026 settlement of about $2 million over 800-171 failures shows the exposure is priced. In Canada, misrepresenting compliance in a federal contract context carries its own legal exposure.
• Five Eyes convergence as the point. Both governments frame their program as raising the defense industrial base's floor while keeping suppliers interoperable with allied procurement.

// 03 · WHERE THEY DIVERGE

Where do CPCSC and CMMC differ?

• No mutual recognition. The one everyone asks about first. A CMMC certificate doesn't satisfy a CPCSC clause, and a CPCSC certification doesn't satisfy DFARS 252.204-7021. Cross-border suppliers run both processes and pay both assessment costs. The technical overlap shrinks the implementation work and leaves the administrative load untouched.
• Different legal machinery. CMMC lives in US federal rulemaking: 32 CFR Part 170 for the program, the 48 CFR acquisition rule and DFARS clauses for contracts. CPCSC lives in Canadian procurement policy under PSPC, with requirements articulated in RFPs and contract clauses.
• Different assessor structures. CMMC third-party assessments run through C3PAOs accredited under the Cyber AB structure. CPCSC Level 2 assessments run through certification bodies accredited by the Standards Council of Canada. Separate accreditations, separate assessor markets, separate scheduling queues.
• Different level arithmetic. CMMC Level 1 is 15 requirements; CPCSC Level 1 is 13. CMMC Level 2 is the full 110 controls of NIST SP 800-171; CPCSC Level 2 assesses 98 controls under ITSP.10.171. CMMC Level 3 adds 24 enhanced requirements from NIST SP 800-172; CPCSC Level 3 is 130-plus controls assessed by National Defence. The sets are close cousins, and scoping against the wrong document still wastes real hours.
• Different middle tiers. CMMC Level 2 splits into self-assessment for some contracts and C3PAO certification for others, decided by the solicitation. CPCSC Level 2 as published is a third-party assessment, full stop, every 3 years with annual affirmations.
• Different rollout positions. CMMC has been enforceable in contracts since November 2025, with its Phase 2 expansion suspended since July 2026 pending review. CPCSC Level 1 entered contracts in summer 2026, with Level 2 still ahead. One program is mid-course-correction and the other is early in its rollout; both are contractually real today.
• Data residency and sovereignty pressure. Canadian contracts bring Canadian data governance: TBS policy, PIPEDA, and, contract by contract, expectations about where Specified Information can live and who can touch it. US-cloud-first architectures that sailed through a CMMC scope can need rework under Canadian clauses.

// 04 · THE MATRIX

The full comparison matrix

Control counts reflect each program's published documents; both governments describe the underlying technical requirements as aligned. Numbers shift as standards revise, which is exactly why this page carries a verification date.

// 05 · WHAT TRANSFERS

If you've done one, what carries to the other?

Carries well: the implemented controls themselves. Access control, MFA, logging, configuration baselines, media handling, incident response; an environment built to 800-171 is substantially built for ITSP.10.171, and the reverse. Your system security plan structure carries too, along with the scoping discipline of confining protected data to a defined enclave. So does the organizational muscle: evidence habits, change control, and someone who owns the program.

Carries poorly: everything administrative. Attestations, portals, assessment contracts, affirmation calendars, and certificates are program-specific. Scope can also shift under Canadian data governance requirements, so an enclave design accepted in a CMMC assessment isn't automatically the enclave a Canadian contract accepts. Terminology needs translating in your documentation; an assessor reading your SSP shouldn't have to guess whether "CUI" means Specified Information here.

// 06 · CURRENT STATUS, BOTH SIDES

What's operative right now?

The defensible read on both programs in September 2026 is the same: keep implementing against the 800-171 control family and keep your attestations current; the phase schedules can move without you having to.

// 07 · FAQ

Frequently asked questions

// 08 · SOURCES

Both programs move. Where this page and an official publication disagree, the official publication wins; corrections welcome at contact@hans.study.

1. PSPC, CPCSC Program Overview and Level 1 backgrounder (canada.ca)
2. PSPC, Evaluation of the Canadian Program for Cyber Security Certification: Final Report (canada.ca)
3. Canadian Centre for Cyber Security, ITSP.10.171
4. 32 CFR Part 170, CMMC Program rule
5. 48 CFR CMMC acquisition rule; DFARS 252.204-7012, -7021, -7025
6. DoD CIO CMMC program materials, including the July 13, 2026 Phase 2 suspension memo