Roughly 8,000 Canadian companies operate within the defence supply chain and will eventually need to demonstrate compliance under the federal Cybersecurity Certification Program (CCP). Most lack an internal path to compliance. For Metro Vancouver’s managed security service providers, this gap represents a significant, immediate business opportunity.
The CCP, modelled on the U.S. Department of Defense’s CMMC 2.0 framework, creates a tiered structure for organizations supplying the Department of National Defence or handling sensitive federal contract data. Level 1 covers basic cyber hygiene across 17 practices. Level 2—the tier applicable to most suppliers—maps to 110 security requirements drawn from NIST SP 800-171. Level 3 is reserved for the most sensitive programs. While the Canadian Centre for Cyber Security is still finalizing mandatory phases, the direction is clear: certification will become a condition of contract award.
Unlike a one-time audit, CCP compliance requires a continuous state of security. Organizations must maintain and re-attest their posture on an ongoing basis. For managed security providers that achieve their own certification and offer that expertise to clients, the engagement becomes a retainer or a monitoring contract—the type of recurring, low-churn revenue that IT services firms have historically struggled to secure.
Vancouver’s geography offers a strategic advantage. Burnaby is home to Fortinet’s Canadian headquarters, a major cybersecurity vendor with deep federal procurement ties. The broader Metro Vancouver tech cluster includes a high concentration of defence-adjacent IT integrators and managed security service providers already fielding inquiries from clients navigating these new procurement requirements.
Public Services and Procurement Canada has progressively tightened cybersecurity expectations, and the CCP formalizes these into a standardized, auditable framework. For suppliers in aerospace, defence electronics, logistics, and professional services—all with meaningful B.C. representation—the question is no longer whether they need to comply, but when and with whose help.
The certification services market in Canada is nascent, presenting a first-mover opportunity. While the Canadian Association of Defence and Security Industries (CADSI) has been working with members on readiness, the gap between awareness and implementation remains wide.
For Vancouver’s IT services sector, the strategy is straightforward: achieve CCP certification first, then build a repeatable client delivery model around the process. The firms best positioned are those already operating in the federal IT space, possessing existing security operations centre capabilities and familiarity with federal procurement language.
Innovate BC’s federal procurement support programs offer a potential on-ramp for smaller providers looking to build the organizational capacity to pursue this market. The BC Tech Association’s cybersecurity cohort serves as another network for firms to navigate the landscape collectively.
Canada’s defence spending is rising and NATO commitments are tightening; the federal government has made supply chain security a priority. The CCP is not a bureaucratic exercise—it is a structural change to federal procurement. Companies that treat it as a compliance checkbox will gain little, but those that treat it as a service line will build something durable.
The certification window is open, and the supply of qualified shepherds is thin. In Vancouver, that math should be clear to anyone running a managed security practice.
