How can the Canadian Centre for Cyber Security support my compliance efforts?

Answer

Cyber Centre provides ITSP.10.171 standards, technical guidance, advisory services, threat intelligence, and incident response support for CPCSC compliance.

Cyber Centre Overview

The Canadian Centre for Cyber Security operates within Communications Security Establishment (CSE) as Canada's national cybersecurity authority. Mandate includes providing cybersecurity advice and guidance to government, critical infrastructure, and Canadian businesses; coordinating Canada's response to cyber events; and managing IT security for Government of Canada systems.

Cyber Centre developed ITSP.10.171 standard that underpins CPCSC and maintains numerous related publications. Services are provided to help organizations improve cybersecurity regardless of whether pursuing CPCSC—compliance support is part of broader mission to strengthen Canadian cybersecurity.

Most Cyber Centre resources are publicly available at no cost through website cyber.gc.ca. Organizations implementing CPCSC should view Cyber Centre as authoritative technical resource for interpreting and implementing requirements.

ITSP.10.171 Standard and Supporting Publications

Cyber Centre publishes and maintains foundational CPCSC documentation. ITSP.10.171 (Protecting Specified Information in non-Government of Canada systems and organizations) is the official standard defining security requirements for CPCSC Level 2 (98 controls) and Level 3 (200 controls planned).

ITSP.10.033 (Security and privacy controls and assurance activities catalogue) provides comprehensive control catalogue from which ITSP.10.171 is derived, offering additional context and implementation guidance.

ITSP series publications address specific security domains like authentication (ITSP.30.031), privileged access (ITSP.10.094), insider threats (ITSP.10.003), network security (ITSP.80.022), and others—these provide detailed implementation guidance for specific ITSP.10.171 control families.

ITSAP series publications provide cyber security advice on practical topics like incident response planning (ITSAP.40.003), security awareness training (ITSAP.10.093), and network monitoring (ITSAP.80.085).

Organizations should systematically review Cyber Centre publications relevant to their CPCSC implementation—they provide authoritative guidance on government expectations for control implementation.

Cyber Security Advice Service

Cyber Centre offers direct advisory services to Canadian organizations:

• Advice by email at contact@cyber.gc.ca with responses typically within business days
• Advice by phone at 1-833-CYBER-88 (1-833-292-3788) for immediate questions
• Questions can cover interpreting ITSP.10.171 requirements, clarifying control implementation approaches, understanding organization-defined parameters, selecting appropriate technical solutions, addressing specific security challenges, or navigating related Cyber Centre guidance

While Cyber Centre doesn't provide detailed implementation consulting (they can't configure your systems), they can provide authoritative interpretations of requirements and implementation approaches. Organizations should leverage this free service for technical questions about CPCSC requirements rather than relying solely on consultant or vendor interpretations.

Documenting Cyber Centre advice can support compliance demonstrations if implementation approaches are questioned during assessments.

Alerts and Advisories

Cyber Centre publishes threat intelligence and security alerts relevant to CPCSC compliance:

• Security bulletins warn about active threats, vulnerabilities, and attacks affecting Canadian organizations
• Technical advisories provide detailed technical information about specific threats, vulnerabilities, or attack techniques
• Mitigation guidance recommends protective actions organizations should take in response to threats
• Industry-specific alerts target sectors like defense, critical infrastructure, or specific technologies

Organizations should subscribe to Cyber Centre alerts (available via website and email subscription) to receive timely threat intelligence. Alerts inform risk assessments, vulnerability management prioritization, and security monitoring focus—CPCSC requires organizations to maintain awareness of current threats and adapt security measures accordingly.

Cyber Centre alerts provide authoritative Canadian government perspective on threat landscape.

Incident Response Support

Cyber Centre provides assistance to organizations experiencing cyber security incidents:

• Incident reporting through contact@cyber.gc.ca or 1-833-CYBER-88 for organizations facing cyber attacks or breaches
• Technical advice on incident response, containment, and recovery
• Threat analysis helping organizations understand attacker techniques and intentions
• Indicators of compromise sharing information about threats observed in other incidents to help organizations determine if they're affected
• Coordination with law enforcement when incidents warrant criminal investigation

While Cyber Centre doesn't replace organization's incident response capabilities or provide hands-on incident response services, they provide expert government perspective and can facilitate coordination.

Organizations handling specified information should maintain relationship with Cyber Centre and understand how to engage them during incidents—their involvement may be expected by government customers if incidents affect specified information.

Guidance for Small and Medium Organizations

Recognizing SMB cybersecurity challenges, Cyber Centre provides tailored resources:

• Small business cyber security section provides simplified guidance appropriate for SMB resources and technical expertise
• Baseline security controls focus on essential protections most organizations should implement
• Top cyber security actions provide prioritized recommendations for resource-constrained organizations
• Free resources including tools, templates, and training materials
• Risk assessment approaches scaled for SMB complexity

Organizations implementing CPCSC on limited budgets should start with Cyber Centre SMB guidance as foundation—it provides pragmatic approaches to implementing security controls without assuming enterprise resources. Even large organizations can benefit from simplified guidance for lower-risk systems or business units.

Training and Awareness Resources

Cyber Centre provides materials supporting security awareness and training requirements:

• Security awareness content including posters, newsletters, and campaign materials organizations can use for employee awareness programs
• Training presentations and modules covering various security topics
• Videos explaining cybersecurity concepts and best practices
• Tabletop exercise scenarios for incident response training
• Social engineering and phishing guidance helping organizations train personnel to recognize attacks

Organizations implementing ITSP.10.171 training requirements can leverage these free resources rather than developing content from scratch or purchasing expensive commercial programs. Cyber Centre materials have advantage of reflecting Canadian government perspectives and priorities relevant to organizations handling specified information.

Threat Intelligence and Analysis

Beyond alerts, Cyber Centre publishes regular threat assessments and analysis:

• National Cyber Threat Assessments provide annual or periodic strategic-level analysis of cyber threats facing Canada
• Sector-specific threat reports analyze threats to particular industries including defense
• Technical reports examine specific threat actors, malware families, or attack techniques
• Campaign analysis describes coordinated attack campaigns targeting Canadian organizations
• Trend analysis identifies evolving threat patterns and emerging risks

Organizations should incorporate Cyber Centre threat intelligence into risk assessments and security planning—understanding threat landscape helps prioritize security investments and monitoring focus.

For defense contractors, understanding nation-state threats targeting defense industry is particularly relevant to risk management and security architecture decisions.

Coordination with Program Authorities

While Cyber Centre is technical authority for CPCSC standards, program administration involves multiple organizations:

• Public Services and Procurement Canada leads overall CPCSC program and coordinates with National Defence for defence procurement integration
• Standards Council of Canada manages third-party assessor accreditation
• Cyber Centre focuses on technical standard development, security guidance, and cyber threat intelligence

Organizations may need to engage different authorities for different purposes—Cyber Centre for technical security questions, PSPC for program requirements and processes, and SCC for assessor questions. Cyber Centre can provide referrals to appropriate authorities when questions fall outside their scope.

Engagement for CPCSC Program Development

As CPCSC evolves, Cyber Centre seeks industry input:

• Public consultations on standard updates, new guidance, or program changes
• Industry forums and working groups discussing implementation challenges and best practices
• Feedback mechanisms for organizations to share experiences with ITSP.10.171 implementation

Organizations should participate in consultation opportunities—industry feedback influences how requirements evolve and how guidance is developed. Active engagement helps ensure requirements remain practical and implementable while achieving security objectives.

Cyber Centre Limitations

Understanding what Cyber Centre doesn't provide helps set appropriate expectations:

• Implementation services—Cyber Centre doesn't configure systems, deploy security tools, or develop organization-specific documentation
• Assessment services—Cyber Centre doesn't assess compliance or provide certification (accredited third-party assessors do this)
• Legal or procurement advice—Cyber Centre provides technical security guidance, not legal interpretations or procurement process guidance (PAC provides procurement support)
• Vendor recommendations—Cyber Centre maintains vendor neutrality and doesn't endorse specific products
• Commercial consulting—Cyber Centre provides general guidance, not detailed organization-specific consulting

Organizations should combine Cyber Centre authoritative guidance with hands-on implementation support from consultants, managed service providers, or internal teams.

Best Practices for Engaging Cyber Centre

Organizations can maximize value from Cyber Centre resources:

• Subscribe to alerts and publications to receive updates automatically
• Review relevant guidance systematically rather than ad-hoc—for example, review all ITSP.10.171 related publications during planning phase
• Prepare specific questions when seeking advice rather than general requests for information
• Document interactions with Cyber Centre for reference and compliance evidence
• Reference Cyber Centre publications in security documentation demonstrating alignment with government guidance
• Participate in consultations and industry forums when opportunities arise
• Establish relationship before needing crisis support—don't wait until experiencing incident to first contact Cyber Centre

For organizations implementing CPCSC, systematic engagement with Cyber Centre resources throughout implementation cycle ensures alignment with government expectations and leverages authoritative expertise.

Learn More

Additional resources on Cyber Centre support:

• Canadian Centre for Cyber Security
• Protecting Specified Information (ITSP.10.171)
• Cyber Security Advice and Support