Know what a contract requires before you sign it.
Suretly reads an RFP or contract, pulls out every security obligation it carries — including CPCSC Level 1 — and checks each one against what your business already has in place. You get a plain-language gap report. Your first contract is free.
No account. Upload a PDF or Word file, get the report back by email — usually within two business days.
The Contractor must, at all times during performance of the Contract, hold a valid Designated Organization Screening (DOS) issued by the Canadian Industrial Security Directorate, and safeguard information to the PROTECTED B category per the Contract Security Manual. CPCSC Level 1 attestation is required at contract award.
CPCSC Level 1 is live. Here's what that actually means.
On April 14, 2026, Public Services and Procurement Canada and National Defence — with the Canadian Centre for Cyber Security — opened CPCSC Level 1 on the CanadaBuys supplier portal. It sets 13 baseline security controls, drawn from Canada's ITSP.10.171 standard.
- Self-assessed
- You assess your own organization and attest. There is no third-party audit at Level 1 — but the evidence behind your attestation has to hold up if a prime contractor or assessor asks to see it.
- Due at award
- A Level 1 attestation is required when a contract is awarded, not to submit a bid. If you're preparing now, there is real runway.
- One profile
- The attestation is filed once, to your company's CanadaBuys profile, and kept current — not redone for every contract.
This is preparation, not a scramble. The work is knowing where you stand and closing the distance before it lands on a signature.
Sources: PSPC — Cyber security certification for defence suppliers; Canadian Centre for Cyber Security — ITSP.10.171. A second certification level, assessed by an accredited third party, is expected later. Suretly is not affiliated with PSPC or the Government of Canada.
From a 40-page PDF to a gap list you can act on.
The free gap check covers the first three steps. The full platform adds the rest and keeps them current as your systems change.
Upload the document as issued
Send the RFP or contract exactly as it landed in your inbox — PDF or Word. No tagging, no prep, no waiting on legal to flag the security section.
Suretly extracts the obligations
It finds the security requirements the document carries: SRCL-derived clearance and safeguarding terms, Controlled Goods Program clauses, export-control certifications, and CPCSC references — with the level and control set they name.
Each obligation is checked against your business
A short set of questions about how you operate turns each obligation into a clear status — met, partial, or gap — in plain language, next to the clause it came from.
Remediation for every gap
For each gap, the platform drafts the missing policy or evidence and estimates the time to close it, so you can price it into a bid or plan the work.
Platform · rolling out through 2026Continuous monitoring
Once you're covered, Suretly watches your connected systems and flags drift — traced back to the exact contract clause it puts at risk, not just "your posture changed."
Platform · rolling out through 2026Suretly automates the checking, not the compliance. Closing a gap still takes real decisions and, often, a written policy. The platform drafts and tracks that work — it doesn't rubber-stamp it.
Every obligation Suretly extracts is evidence-graded and reviewed by a person before it reaches you. You're attesting to the government; the report should be something you can stand behind.
Canada is spending on defence at a scale it hasn't in decades.
Budget 2025 committed more than $81 billion in new defence funding over five years, with spending trending toward 5% of GDP under Canada's NATO commitments. More contracts, more suppliers brought into the supply chain — and security terms written into more of those contracts.
For a supplier, the opportunity and the obligation arrive together. The ones who can show where they stand move faster when a contract is on the table.
Sources: Government of Canada — Budget 2025; Canada's NATO defence investment commitments.
The 13 controls, in plain terms.
What Level 1 asks for, without the standard's language. Suretly maps each obligation in your contract to the controls below.
Access control
Every account is tied to a specific person, created and removed through a defined process, and reviewed regularly.
Access rights match what someone's job actually requires — not broad "just in case" access.
Only IT-vetted tools touch sensitive information — no personal email, personal cloud storage, or unmanaged devices.
External communications are checked before publishing so protected government information doesn't leak out.
Identification & authentication
Everyone signs in with their own credentials, uses a strong password, and sessions lock after inactivity.
Only known, approved devices can connect to systems that handle sensitive information.
A second step beyond a password is required to sign in — especially for admin accounts and systems holding sensitive information.
Media protection
Drives that held sensitive information are properly erased or destroyed before disposal, resale, or reuse.
Physical protection
You know exactly who holds keys, badges, or codes to spaces where sensitive systems or files live, and access is removed when it's no longer needed.
Doors to sensitive areas are actually controlled, visitors are signed in and escorted, and printed sensitive documents aren't left out.
System & communications protection
A firewall controls what reaches your network, and systems holding sensitive information are kept separate from general or public-facing ones.
System & information integrity
Known software and firmware vulnerabilities get patched promptly, with a record showing it actually happened.
Endpoints run active anti-malware that updates itself and scans regularly, and detections are tracked to resolution.
Control text condensed from the Suretly Level 1 control library, decomposed from ITSP.10.171 (Canadian Centre for Cyber Security) and PSPC's CPCSC Level 1 criteria.
Early, and honest about it.
Suretly is being built with a small group of Canadian defence suppliers as design partners. We don't have a case study to show you yet — when we do, it will be a named company with real numbers, not a stock quote.
- Design partner
- company name
- The contract
- value at stake
- What Suretly found
- obligations extracted, gaps identified
- Result
- gaps closed, outcome at award
- Every extracted obligation is evidence-graded and human-reviewed before it reaches you.
- Every regulatory claim traces to canada.ca or PSPC — not a secondary blog or press article.
- Documents you upload for a gap check are used to produce your report and to follow up about it. Nothing else.
Run your first contract through Suretly.
Upload an RFP or contract. Suretly extracts its security obligations, checks them against a few questions about your business, and emails you the gap report — usually within two business days.
- FreeNo charge for your first contract, and no account to create.
- PlainEach obligation in plain language, next to the clause it came from.
- YoursThe report is yours to take into a bid, a board meeting, or a call with a prime.
Prefer to talk it through first?
Book a 20-minute call — no pitch deck, just your situation and whether Suretly is a fit. Or send a note and we'll reply.