CPCSC Level 2 controls: all 98 requirements by family

CPCSC Level 2 covers 98 security requirements, grouped into 17 families, taken from the Cyber Centre's ITSP.10.171. Under the federal supplier guidance, an accredited certification body assesses all 98 every three years, and you affirm them yourself in the years between. Thirteen of the 98 are the Level 1 controls, so a supplier that has done Level 1 properly has 85 left to implement, document and prove.

One caveat before the list. As of November 2026 the government describes Level 2 as under development and has not published a Level 2 criteria page the way it has for Level 1. What it has said, in the program overview, is that Level 2 will consist of 98 controls, and ITSP.10.171 contains exactly 98 requirements. The family names and counts below are taken from that publication.

What are the 98 CPCSC Level 2 controls?

They are the security requirements in section 3 of ITSP.10.171, numbered 03.01.01 through 03.17.03. The numbering has gaps on purpose: more than thirty identifiers are marked not allocated, because NIST withdrew or merged those requirements when it wrote Revision 3 and the Canadian version kept the numbering. Here is each family with its count and what it asks of you.

• Access control (16): who gets an account, what each account can reach, least privilege, remote and wireless access, mobile devices, external systems
• Awareness and training (2): security literacy training for everyone, role-based training for people with security duties
• Audit and accountability (8): what you log, what each record contains, how logs are reviewed, protected and time-stamped
• Configuration management (10): baseline configurations, change control, least functionality, an inventory of components, knowing where the information lives
• Identification and authentication (8): unique identities for users and devices, multi-factor authentication, password and authenticator management
• Incident response (5): handling, reporting, testing, training and a written incident response plan
• Maintenance (3): control over maintenance tools, remote maintenance and the people who do the work
• Media protection (7): storage, access, marking, transport, sanitization, removable media use and encrypted backups
• Personnel security (2): screening before access, and what happens to access when someone leaves or changes role
• Physical protection (5): who is allowed in, monitoring of physical access, alternate work sites, protection of cabling and transmission lines
• Risk assessment (3): a documented risk assessment, vulnerability scanning, and a response to what the scans find
• Security assessment and monitoring (4): assessing your own controls, a plan of action and milestones, continuous monitoring, agreements for information exchange
• System and communications protection (10): boundary protection, deny by default, encryption in transit and at rest, key management, session protection
• System and information integrity (6): patching, malicious code protection, security alerts, system monitoring, information retention, a dedicated administration workstation
• Planning (3): policies and procedures, the System Security Plan, rules of behaviour
• System and services acquisition (3): security engineering principles, unsupported components, external service providers
• Supply chain risk management (3): a supply chain risk management plan, acquisition strategies, supply chain requirements and processes

How is that different from NIST SP 800-171?

Barely, and that is the point. ITSP.10.171 describes itself as the Canadian version of NIST SP 800-171 Revision 3 with no substantial technical changes. The edits reflect Canadian law, policy and terminology, most visibly the term specified information in place of controlled unclassified information.

The one difference in the count is worth knowing. NIST SP 800-171 Revision 3 has 97 requirements. The Canadian publication has 98, because the system and information integrity family includes 03.14.09, a dedicated administration workstation, which has no counterpart in the NIST list. If you are mapping an existing 800-171 program across, that is the requirement to add.

If your reference point is CMMC, be careful with the numbers. CMMC Level 2 is currently assessed against Revision 2 of 800-171, which has 110 requirements in 14 families. Much of the substance overlaps, but the numbering and the three newer families (planning, system and services acquisition, supply chain risk management) do not line up one to one. Our CPCSC vs CMMC comparison covers what carries over.

Which of the 98 did you already meet at Level 1?

Thirteen, listed on the government's Level 1 criteria page. Level 1 is a subset of the same publication, so nothing done for Level 1 is wasted. The difference is the standard of proof: at Level 1 you declare them yourself, and at Level 2 an assessor tests them.

• Access control: 03.01.01, 03.01.02, 03.01.20, 03.01.22
• Identification and authentication: 03.05.01, 03.05.02, 03.05.03
• Media protection: 03.08.03
• Physical protection: 03.10.01, 03.10.07
• System and communications protection: 03.13.01
• System and information integrity: 03.14.01, 03.14.02

What does an assessor expect beyond the controls themselves?

A System Security Plan. Requirement 03.15.02 makes the SSP a control in its own right. It describes your boundary, each requirement, how you meet it, who owns it and what evidence shows it. The CPCSC program has its own SSP guidance, which the supplier guidance says is available on request from the CPCSC Client Service Team.

Evidence against assessment objectives. The program overview points to a Canadian version of NIST SP 800-171A Revision 3, the companion that breaks each requirement into objectives an assessor can test. A requirement is met when every objective under it is met, so a control that works but is not written down tends to fail.

Your own parameters. Many Revision 3 requirements leave values for the organization to define, such as how often accounts are reviewed or how long logs are kept. You have to set those values, write them down and then follow them.

A defined scope. All of this applies to the systems, people and facilities that can reach specified information. The smaller and cleaner that boundary, the fewer places each of the 98 has to be proven. Our scoping guide walks through how to draw it.

Where do suppliers usually fall short?

In HuCortex's own assessments, most suppliers are partway to Level 1 and have significant gaps at Level 2. The same four turn up most often: no formal System Security Plan, access control that works in practice but is not documented, an incomplete supply chain risk management process, and no formal configuration management.

Notice what those have in common. They are mostly documentation and process, not technology. Firms that have bought good tools still fail on the families that ask for a plan, a baseline or a record, which is why the SSP and the mock assessment take up so much of a realistic Level 2 timeline.

Where to start

Start with the 13 you are supposed to have already. The 3-minute Level 1 self-check scores you against them and shows which ones need work. Then map the other 85 in a gap assessment, which at HuCortex takes two weeks and produces a prioritized plan. If you want a sense of the budget first, read what Level 2 and Level 3 cost.