How to use the CPCSC self-assessment tool

The CPCSC self-assessment tool is the government's free online questionnaire for the 13 Level 1 controls. You answer for each control, save your progress if you need to stop, and finish on a results page that shows an expiry date. You then record that result in your CanadaBuys supplier profile. The government's Level 1 guidance says a prepared organization can complete it in under an hour, and that using the tool is encouraged but not mandatory.

The tool is the easy part. What takes time is knowing your answers before you open it, so that is where this guide starts.

What should you have ready before you open it?

The under-an-hour figure assumes you have already reviewed the standard and your own policies. In practice that means three things.

• Your boundary: which systems, devices, people and locations can reach specified information, written down
• The 13 Level 1 criteria, read through once, so no question is a surprise
• Evidence for each answer: the multi-factor authentication settings, the list of who is allowed into the workspace, the patching report, the media disposal record

How do you use the tool, step by step?

1. Open it from the official page. The tool lives at cyberpostureassessments.ops.cyber.gc.ca/cpcsc-pccc, on the Cyber Centre's domain, and is linked from the government's page on meeting Level 1 requirements. Go in through that page so you know you are on the real one. The federal guidance does not list a sign-in for the tool itself. The account you do need is CanadaBuys, for the recording step at the end.

2. Work through the 13 controls. Answer as you are today, not as you plan to be. You are making a declaration to the Government of Canada, and a contracting authority can ask to see what is behind it.

3. Save and come back if you hit a gap. If a control is not in place yet, the tool lets you save your progress and return once you have implemented it. That is the right move. Fix the gap first, then finish.

4. Print or save the results page. It shows your result and an expiry date. This page is your proof, and keeping it is your responsibility, so store it where your bid team can find it.

5. Record it in CanadaBuys. In your organizational supplier profile questionnaire, confirm the result and the expiry date. You provide the proof again when you submit a bid for a contract that requires Level 1. Our CanadaBuys walkthrough covers this step in detail.

6. Keep the evidence and set a reminder. The Level 1 guidance asks you to keep supporting evidence for the attestation cycle or at least one year. The self-assessment is annual, so put the renewal in the calendar well ahead of the expiry date.

What if the tool says access denied?

First, the honest part: the government has not published any troubleshooting guidance for the tool, so nobody outside the program can tell you the cause for certain. Here is what we can say.

The tool's server refuses some connections outright. When we sent an automated request to the address on November 13, 2026, it answered with HTTP 403 Forbidden, the response a browser shows as access denied. That points to a filter in front of the tool reacting to how or where you are connecting from. It is not a CanadaBuys problem, because the tool is separate from your CanadaBuys account.

These are the things worth trying, in order. They are our suggestions, not official steps.

• Turn off any VPN, and if you are on a corporate network with a web proxy or security gateway, try from a home connection or a phone hotspot
• If you are outside Canada, try from a Canadian connection
• Use a current version of a mainstream browser with ad blockers and privacy extensions switched off, or a private window
• Check the address is complete, including /cpcsc-pccc at the end, and reach it through the link on the government's Level 1 page
• If it still refuses, contact the CPCSC program through its contact page and tell them the time, your network and the exact message

Can you attest without the tool?

Yes. If the tool stays out of reach and a deadline is close, you are not stuck. The Level 1 guidance says suppliers can attest to the 13 Level 1 controls without it. Assess yourself against the published Level 1 criteria, keep a dated record of each answer and the evidence behind it, and record the result and expiry date in your CanadaBuys profile as you would otherwise.

If the access denied message appears inside CanadaBuys when you try to edit the organizational profile, that is a different problem. It is about who in your organization has permission on the CanadaBuys account, and it is one for the CanadaBuys service desk.

Not sure what your answers will be?

Find out before you make a declaration. Our 3-minute Level 1 self-check scores you against the same 13 controls and shows which ones need work, with nothing recorded with the government. If the gaps look bigger than a few days of effort, book a readiness call and we will go through them with you.