Canada’s New Cybersecurity Program Presents Exciting News for Organizations Seeking US DoD Business

The Canadian government recently announced plans for a new Cybersecurity Program that represents an exciting development for organizations in Canada looking to do business with the US Department of Defense (DoD).

The announcement also signals the DoD’s Cybersecurity Maturity Model Certification (CMMC) program is gaining traction globally.

Called the Canadian Program for Cyber Security Certification (CP-CSC), this new initiative aims to strengthen protection of unclassified federal defense information while ensuring Canadian suppliers can maintain access to the competitive US defense market. The CP-CSC is modeled closely after CMMC and therefore provides defense contractors a unique opportunity to satisfy both sets of requirements simultaneously. This “cyber reciprocity” between the two nations’ defense departments is also unique, if not unprecedented altogether.

The CMMC certification process is arduous but our CMMC 2.0 compliance roadmap can help.

Motivations for CP-CSC

Several factors led to the CP-CSC’s establishment, including:

• An increasingly sophisticated cyber threat environment, placing Canada’s domestic defense supply chain at greater risk
• The recent launch of CMMC 2.0 requirements by the US DoD, an evolution from CMMC 1.0, which Canadian suppliers will need to comply with to access US defense contracts
• Canada’s highly integrated Defense Industrial Base with the US, with 49% of exports destined for the US market
• Commitments to improving national cybersecurity under Canada’s Cyber Security Action Plan

With CP-CSC, the Canadian government aims to get ahead of emerging cybersecurity challenges and safeguard its national interests while leveraging an existing global certification model (CMMC).

CP-CSC Program Overview

The CP-CSC program will have three tiers of certification requirements mirroring CMMC 2.0, with Level 1 being basic cyber hygiene controls assessed through supplier self-assessment. Levels 2 and 3 will require external assessment by accredited third-party organizations and the Department of National Defense, respectively.

KEY TAKEAWAYS

KEY TAKEAWAYS

1. Canada’s CP-CSC Initiative:
   Canada’s new cybersecurity certification program for (CP-CSC) mirrors the US DoD’s CMMC program and enables Canadian defense contractors to meet both requirements simultaneously.
2. CP-CSC Motivations and Overview:
   CP-CSC addresses Canada’s cybersecurity challenges and integrates with the US DIB. It features three certification tiers, mirroring CMMC 2.0.
3. Reciprocity with CMMC:
   CP-CSC allows Canadian defense contractors to obtain both certifications simultaneously, providing certified contractors access to the US defense market.
4. Positive Implications and Global Influence:
   CP-CSC’s alignment with CMMC signals the regulation’s growing global influence as a cybersecurity benchmark. It also strengthens US-Canadian cooperation on cybersecurity.

The Communications Security Establishment is developing a new certification standard adapted from NIST standards like CMMC. Defense contracts will be identified for mandatory CP-CSC based on risk profiles determined through structured assessments. Certification requirements will be phased in starting in late 2024, focusing first on select high-priority defense procurement contracts. This provides a reasonable timeline for Canda’s defense industry to prepare.

Reciprocity With CMMC

A key feature of the CP-CSC is its reciprocity with CMMC. Ultimately any organization that obtains CP-CSC certification also obtains CMMC certification. CP-CSC Certification levels will mirror CMMC’s three levels of Low, Moderate, and High Risk profiles as well as the Assessment approach and responsible party for conducting the assessment. The required certification level for each RFP will be determined through a Department of National Defense-led Injury Test. With 49% of Canadian defense exports going to the US, CP-CSC certification—and by default CMMC certification—becomes vital.

Reciprocity was always a priority in the program’s collaborative development process where the Public Services and Procurement Canada is the federal lead for CP-CSC along with eight additional Canadian departments. Entering discussions with the US early on has proven to be a wise strategic move as reciprocity opens a very competitive and lucrative US defense market to Canadian defense contractors.

Even without reciprocity, CP-CSC’s alignment to NIST 800-171 and 172 based standards will ensure Canadian defense contractors develop strong cybersecurity programs and protocols.

Exciting Possibilities for Canadian Organizations

For Canadian defense contractors, the CP-CSC presents exciting possibilities. Organizations can get ahead of the curve now, using the forthcoming CP-CSC standard as a guide to improve cybersecurity posture, even before certification is mandatory as communicated by the DoD in 2024. This can reduce risk, avoid a last-minute rush, and turn cybersecurity into a competitive advantage.

Participating in CP-CSC also potentially opens doors to the US defense market based on reciprocal acceptance with CMMC. This provides Canadian defense contractors potentially billions of dollars in new business opportunities.

As CP-CSC matures, it may also expand beyond defense into other sectors, much like CMMC aims to scale across US critical infrastructure like telecommunications and banking. The CP-CSC ultimately builds cyber resilience at a time when cyber threats are growing; improving defenses now is imperative.

Positive Implications for CMMC Globally

As one of the first international adoptions of CMMC, Canada’s CP-CSC signals the growing global influence of the CMMC model. The Canadian government’s choice to closely align with CMMC reflects confidence in the rigor of the CMMC framework.

CP-CSC provides a CMMC-compatible certification path for a key US ally. This boosts the credibility and maturity of CMMC as a cybersecurity benchmark. It also shows CMMC’s adaptability and value for allies with aligned interests in protecting the US Defense Industrial Base (DIB). With over 300,000 companies in the DIB supporting critical DoD missions and handling sensitive data, the risks of cyberattacks and breaches are immense. CMMC flips the script from pure self-attestation to mandatory third-party audits and certifications to validate and enforce security. This immense undertaking is vital for national security and maintaining America’s military advantage.

As conversations advance around reciprocity, the CP-CSC can strengthen strategic US-Canadian cooperation on cybersecurity. Shared standards build trust and interoperability. With other US partners and NATO allies possibly following Canada’s lead in the future, CP-CSC represents early progress toward broad alignment. This demonstrates CMMC’s promising scalability to better secure global defense supply chains.

Looking Ahead: CP-CSC Next Steps

The Canadian Program for Cyber Security Certification offers an exciting chance for Canadian organizations to gain a competitive edge with cybersecurity and US defense market access. It also bodes well for CMMC’s growing influence as a global security standard.

While timelines and details may evolve, the Canadian government’s plan charts a thoughtful course. For industries like defense with integrated global supply chains, improving cybersecurity is a collaborative effort requiring commitment, coordination, and trust with allies and partners.

With the threat landscape unlikely to ease anytime soon, the CP-CSC represents a proactive investment in cyber readiness and resilience. Overall, this innovative new program marks an encouraging step forward, both for Canada and abroad.

Kiteworks Helps Organizations Demonstrate Compliance With CMMC and Therefore CP-CSC

For contractors in the DIB, achieving CMMC certification is now an essential prerequisite for doing business with the DoD. This is a significant investment for contractors accustomed to self-certifying compliance. Kiteworks is uniquely qualified to help organizations demonstrate compliance with CMMC.

With granular access controls, robust encryption, comprehensive activity logging and reporting, and other advanced features, Kiteworks offers a force multiplier for organizations pursuing CMMC Level 2 certification.

Kiteworks’ existing FedRAMP Moderate Authorization maps to over 300 NIST controls, so contractors gain a strong foundation to build upon with additional steps like improved endpoint security, training, and formal processes. Kiteworks also helps centralize and normalize security policies, controls, and visibility across communication channels.

The road to CMMC certification may be long, but with cyber threats growing daily, there is no time to waste in securing America’s sensitive data and critical defense capabilities.

The Kiteworks Private Content Network, a FIPS 140-2 Level validated secure file sharing and file transfer platform, consolidates email, file sharing, web forms, SFTP and managed file transfer, so organizations control, protect, and track every file as it enters and exits the organization.

Kiteworks supports nearly 90% of CMMC 2.0 Level 2 requirements out of the box. As a result, DoD contractors and subcontractors can accelerate their CMMC 2.0 Level 2 accreditation process by ensuring they have the right sensitive content communications platform in place.

With Kiteworks, DoD contractors and subcontractors unify their sensitive content communications into a dedicated Private Content Network, leveraging automated policy controls and tracking and cybersecurity protocols that align with CMMC 2.0 practices.

Kiteworks enables rapid CMMC 2.0 compliance with core capabilities and features including:

• Certification with key US government compliance standards and requirements, including SSAE-16/SOC 2, NIST SP 800-171, and NIST SP 800-172
• FIPS 140-2 Level 1 validation
• FedRAMP Authorized for Moderate Impact Level CUI
• AES-256-bit encryption for data at rest, TLS 1.2 for data in transit, and sole encryption key ownership

Kiteworks deployment options include on-premises, hosted, private, hybrid, and FedRAMP virtual private cloud. With Kiteworks: control access to sensitive content; protect it when it’s shared externally using automated end-to-end encryption, multi-factor authentication, and security infrastructure integrations; see, track, and report all file activity, namely who sends what to whom, when, and how. Finally, demonstrate compliance with regulations and standards like GDPR, HIPAA, CMMC, Cyber Essentials Plus, IRAP, and many more.

To learn more about Kiteworks, schedule a custom demo today.

Additional Resources

• Blog Post Choosing Which CMMC Level Is Right for Your Business
• Blog Post If You Need to Comply With CMMC 2.0, Here Is Your Complete CMMC Compliance Checklist
• Blog Post A Roadmap for CMMC 2.0 Compliance for DoD Contractors
• Guide CMMC 2.0 Compliance Mapping for Sensitive Content Communications
• Blog Post 12 Things Defense Industrial Base Suppliers Need to Know When Preparing for CMMC 2.0 Compliance