How much do CPCSC Level 2 and Level 3 cost?

Nobody can quote an official price for CPCSC Level 2 or Level 3 yet. As of November 2026 the federal program overview lists both levels as under development, no fee schedule has been published, and Level 2 certification is not open, so no certification body has a public rate. What we can tell you is our own side of it: HuCortex readiness work typically runs from $2,500 to $90,000 CAD, depending on the size and complexity of the organization. For a figure specific to your firm, book a readiness call and we will work it out with you.

What do you pay for at Level 2?

Four things, and only one of them is the assessor.

Getting ready. A gap assessment against the 98 requirements in ITSP.10.171, then a System Security Plan that describes how you meet each one. This is mostly skilled time, yours or a consultant's.

Closing the gaps. Whatever the gap assessment finds: multi-factor authentication everywhere it is missing, central logging, configuration baselines, encryption, an incident response plan that has been tested. Some of it is licences and tooling, most of it is implementation effort.

The assessment. Public Services and Procurement Canada's supplier guidance says Level 2 will require an external assessment every three years, led by a certification body accredited by the Standards Council of Canada. This is the fee nobody can quote yet.

Staying certified. The same guidance requires an annual affirmation. Add the monitoring and record keeping that make it truthful, and the reassessment in year three.

For most firms starting from a Level 1 posture, the first two cost more than the assessment itself.

What about Level 3?

According to the supplier guidance, Level 3 will require 130-plus controls and an assessment every three years conducted by the Government of Canada, plus an annual affirmation. Because the government runs the assessment, there is no commercial assessor fee to estimate, and none has been announced.

The cost of Level 3 is the cost of building and running the controls. The control set is larger than Level 2, and the government has not yet published the detailed requirements. If you think a contract will put you there, the sensible move is to get Level 2 right first, since the higher level builds on it.

And Level 1?

Level 1 has no assessment fee. The government's Level 1 guidance describes it as an annual self-assessment against 13 controls, recorded in your CanadaBuys supplier profile, and says a prepared organization can finish the self-assessment in under an hour. The cost is internal time to review the controls, fix what is missing and keep the evidence, plus outside help if you want it. The preparation is the work. Our Level 1 walkthrough covers the steps.

What moves the number?

Two firms of the same size can land far apart. These are the things that decide it.

• Scope: the controls apply to whatever can reach specified information, so a bounded enclave costs less to secure and to assess than the whole company
• Starting posture: a firm with a real Level 1, written policies and central logging has far less to build
• Headcount and sites: more people, devices and locations mean more to configure, document and sample
• Existing tooling: many of the technical controls can be met with platforms you may already license, if they are configured for it
• Suppliers and service providers: every provider that touches the information sits inside your boundary and has to be accounted for
• Documentation debt: controls that work but are not written down still have to be written down before an assessor will pass them

How do you keep it down?

Scope first. An hour spent drawing the boundary properly saves more than any tool purchase, and our scoping guide shows how. Then reuse what you have: the 13 Level 1 controls are part of the 98, and if you already hold a CMMC certification the supplier guidance asks you to contact the CPCSC program about it. Finally, run a mock assessment before the real one. A failed assessment is the most expensive line item there is.

Timing matters too. The same guidance has Level 2 entering select defence contracts gradually between spring 2027 and spring 2028, and preparation takes three to six months in our experience. Work spread over that window costs less than the same work compressed into the weeks after a solicitation lands.

How do you get a real figure for your firm?

Ask us. HuCortex CPCSC readiness work typically runs from $2,500 to $90,000 CAD. The low end is a small firm tidying up a Level 1 posture, the high end is a larger, multi-site supplier preparing for Level 2, and an unusual environment can land below or above that. The range is indicative, it is our fee for the readiness work, and it does not include the certification body's assessment fee, which has not been published. Book a readiness call and we will give you a figure for your situation. If the picture is complicated, the next step is a two-week gap assessment against the 98 requirements, which ends with a prioritized plan you can cost line by line.

Not ready to talk yet? The 3-minute Level 1 self-check is free and shows how much of the foundation is already there.