Map your infrastructure to ITSP.10.171 controls. Generate tamper-evident, cryptographically verified records. Get audit-ready in weeks, not months.
Credit card required to activate. 365-day evidence retention during 2026.
CPCSC is the Canadian Program for Cyber Security Certification, administered by the Department of National Defence and Public Services and Procurement Canada. It becomes mandatory for new DND contracts in April 2026 (Phase 2, Level 1) with full Level 2 certification required for sub-tier suppliers from April 2027. The standard is ITSP.10.171, Canada's adaptation of NIST SP 800-171 Rev 3, covering 97 controls across 17 families. Level 1 is a 13-control self-assessment. Solymus produces audit-ready cryptographic evidence for every control, and verification is free and requires no account.
Three-phase mandatory compliance schedule for Canadian DND suppliers
Choose the level that matches your supplier tier and regulatory requirements
17 families covering 97 controls across all security domains
Self-assessment controls for immediate compliance. Mandatory April 2026 for all DND suppliers.
4 Level 1 controls
3 Level 1 controls
1 Level 1 control
2 Level 1 controls
1 Level 1 control
2 Level 1 controls
Map your existing infrastructure to ITSP.10.171 controls without rebuilding
Drag and drop policies, logs, screenshots, and configuration files. Solymus normalizes everything into evidence artifacts.
Machine learning maps artifacts to relevant CPCSC controls with confidence scoring. Assessors see exactly what proves compliance.
Every piece of evidence is SHA-256 hashed, KMS-signed, and Merkle-chained. Tamper-evident and independently verifiable.
Sync with M365, AWS, and endpoints. Evidence accumulates automatically. Assessors see a living, auditable chain of custody.
Generate evidence index, readiness report, control mapping, and cryptographic verification URLs in one click.
Share verification links with assessors. They validate the cryptographic proof without needing API keys or credentials.
Industrial-grade cryptography ensures your evidence cannot be altered or repudiated
Each artifact produces a unique, deterministic 256-bit fingerprint. Change a single byte and the hash becomes invalid.
AWS KMS (ECDSA_SHA_256) cryptographically signs the hash. Only our infrastructure can produce valid signatures.
Daily attestations link all evidence into an unbreakable chain. Backdating or tampering invalidates the entire chain.
Assessors verify the cryptographic proof independently, without accessing your infrastructure or credentials.
DynamoDB ledger captures every event: creation, verification, export. Immutable record of evidence history.
All cryptography runs on AWS KMS. Full compliance with Canadian data residency and government security standards.
Everything you need to know about CPCSC and Solymus
Start free with Level 1 today. Build your evidence chain, get audit-ready, and upgrade to Level 2 when you need third-party certification.
CPCSC is the Canadian Program for Cyber Security Certification, a mandatory framework administered by the Department of National Defence and PSPC for protecting Controlled Information in the Canadian defence supply chain. It is built on ITSP.10.171 (Canada's adaptation of NIST SP 800-171 Rev 3) and has three certification levels.
Phase 2 of CPCSC begins April 2026, making Level 1 self-assessment a requirement at contract award for new DND contracts. Phase 3 (April 2027 onward) extends Level 2 third-party certification to sub-tier suppliers.
CPCSC is the Canadian program (DND/PSPC, based on ITSP.10.171 / NIST SP 800-171 Rev 3). CMMC is the US program (DoD/DFARS, based on NIST SP 800-171 Rev 2). They are separate regulators with separate assessor bodies and slightly different control sets. Cross-border suppliers generally need both. See our CPCSC vs CMMC comparison.
13 controls across 6 ITSP.10.171 families (AC, IA, MP, PE, SC, SI). Level 1 is a self-assessment, not a third-party audit. See the full Level 1 checklist.
No. Public verification of Solymus cryptographic receipts is free and requires no account — auditors, primes, and assessors can verify any receipt or re-hash an original file on verify.html without signing up. Evidence creation (for suppliers) is the paid product.