What are the 13 security controls in CPCSC Level 1?

Answer

CPCSC Level 1 requires 13 security controls from ITSP.10.171 covering access control, authentication, media protection, physical security, network protection, and system integrity.

These controls represent fundamental cybersecurity hygiene that every organization handling Specified Information should maintain. Understanding these controls in business terms helps executives appreciate both the effort required and the value delivered.

Access Control Family (4 Controls)

Control 1 - Manage User Accounts

Maintain a current list of all user accounts showing who can access what systems. Add accounts when people join, disable them immediately when they leave or change roles, avoid shared accounts, and review all accounts quarterly.

This control prevents unauthorized access through orphaned accounts or excessive permissions lingering after job changes. Implementation typically involves a spreadsheet or database tracking names, roles, access levels, and status changes, coordinated with HR onboarding and offboarding processes.

Control 2 - Give People Only the Access They Need

Apply the principle of "least privilege" by granting the minimum access required for each person's job on a need-to-know basis. Avoid giving administrator rights broadly, review folder permissions regularly, and organize access by role groups rather than individuals.

This minimizes damage from compromised accounts or insider threats by limiting what any single user can access or damage.

Control 3 - Use Only Approved Systems and Devices

Maintain a list of systems approved for handling Specified Information. Prohibit personal email, cloud storage, or devices for government work.

Evaluate cloud vendors for security features including data location, foreign access, multifactor authentication, encryption, and VPN support. This prevents information leakage through unsecured consumer services and ensures all systems meet minimum security standards.

Control 4 - Prevent Sensitive Information from Being Shared Publicly

Train staff to recognize Specified Information and review all public-facing content (website updates, news releases, publications, social media) before publishing to prevent accidental disclosure. Periodically audit public content for inadvertent exposure.

This addresses the insider threat of well-meaning employees accidentally posting sensitive information without realizing the implications.

Identification and Authentication Family (3 Controls)

Control 5 - Use Individual Accounts and Strong Passwords

Require each user to have their own unique login credentials, not shared accounts. Enforce strong password policies and automatic screen locks after inactivity (15 minutes for laptops, 5 minutes for phones).

Password managers help users handle multiple complex passwords without resorting to unsafe practices like writing them down or reusing passwords.

Control 6 - Approve Devices Before They Connect

Maintain an inventory of devices allowed on your network and use technical controls to block unauthorized devices from connecting via network, WiFi, or USB.

This prevents rogue devices, contractor laptops, or employees' personal devices from introducing malware or providing unauthorized access paths.

Control 7 - Enable Multifactor Authentication

Implement MFA for privileged accounts and systems storing Specified Information. This adds a second verification factor beyond passwords—typically an authenticator app or SMS code—dramatically reducing risk from stolen or guessed passwords.

Include clear procedures for what to do if someone loses their authentication device.

Media Protection Family (1 Control)

Control 8 - Wipe or Destroy Old Devices

Before disposing of any storage media (hard drives, USB keys, phones, printers with memory), securely wipe them using software that prevents data recovery, or physically destroy them.

Maintain logs documenting what was disposed, how it was sanitized, and when. This prevents data breaches from discarded equipment ending up in the wrong hands.

Physical Protection Family (2 Controls)

Control 9 - Keep a List of Who Can Access Secure Areas

Track who has keys, badges, or codes to areas containing Specified Information. Remove access promptly when people leave or change roles. Set expiry dates for temporary access.

This creates accountability and prevents unauthorized physical access through old credentials.

Control 10 - Control Physical Entry

Use locks, keycards, or biometric systems to control physical access. Maintain visitor logs, escort all visitors in sensitive areas, and store printed Specified Information in locked cabinets. Don't leave classified printouts unattended.

Physical security complements technical controls since having physical access to equipment can bypass many software protections.

Systems and Communications Protection Family (1 Control)

Control 11 - Use Basic Network Protections

Install firewalls to control traffic, block unnecessary inbound connections, and separate public-facing systems from internal ones handling Specified Information. Keep firewall settings current and document changes.

This creates network segmentation preventing attackers who breach public systems from easily reaching sensitive internal systems.

System and Information Integrity Family (2 Controls)

Control 12 - Apply Security Updates

Install operating system, browser, and software updates promptly, especially critical security patches. Enable automatic updates where possible and maintain logs of major updates.

Vulnerabilities in outdated software are among the most common attack vectors, making timely patching critical.

Control 13 - Use Antivirus and Anti-Malware Software

Deploy reputable antivirus with automatic updates and real-time scanning. Respond promptly when threats are detected and document incidents.

Built-in tools like Microsoft Defender are acceptable; business solutions offer additional features. This provides baseline defense against malware, ransomware, and other malicious software.

The Collective Value

These 13 controls work together as a system, not just a checklist. Access controls limit who can reach information, authentication verifies identity, logging creates accountability, physical protections address non-digital threats, network controls contain breaches, and regular updates close vulnerabilities.

Organizations implementing these controls thoroughly will find they've built a security foundation that protects against most common threats, not just satisfying contract requirements.

Learn More

Additional information about meeting Level 1 certification requirements is available from official government sources.

• How to Meet Level 1 Cyber Security Certification Requirements - Canada.ca