Ottawa's new cybersecurity certification regime for defence suppliers is now landing in contracts, and the industrial base needs help getting ready. A new collaboration between Plurilock Security Inc. and ADGA Group Consultants Inc. aims to fill that gap while keeping preparation work separate from certification decisions.

Plurilock has signed a collaboration agreement with ADGA, a Canadian defence and security firm serving the defence, public safety, and critical infrastructure sectors. The two companies will support organizations pursuing certification under CPCSC, the federal government's new cybersecurity certification program for defence suppliers.

CPCSC requirements began appearing in select Government of Canada defence contracts this summer, and the program is built for interoperability with allied frameworks including the American CMMC regime.

The roles are split by design. Plurilock will provide CPCSC Level 2 readiness, gap assessment, evidence collection, and assessment reporting through its Critical Services division. ADGA intends to establish and operate an independent certification body for CPCSC Level 2, pending accreditation.

Plurilock will not make certification decisions or represent itself as a certification authority. The two firms will maintain information barriers consistent with ISO/IEC 17024 impartiality requirements, the international standard governing personnel certification bodies.

"Canada's government and its allies are raising the cybersecurity bar for every company that supplies them, and for the defence industrial base that deadline has arrived," said Ian L. Paterson, CEO of Plurilock. "We have served Canadian federal customers for decades, and securing the supply chain those customers depend on is a natural extension of that work."

"While CPCSC Level 2 is still ahead of us, the work of preparing industry for it starts now," said LGen Jean-Marc Lanthier (Ret'd), CEO of ADGA. "Our collaboration with Plurilock lets us put nearly 60 years of trust with Canada's defence and security community to work."

Plurilock launched a CPCSC readiness program in May, building on its experience with CMMC compliance work in the United States. The agreement with ADGA is meant to complement that readiness offering while keeping certification itself fully independent.

The deal builds on Plurilock's existing federal and defence footprint. Its Integra Networks subsidiary has served Canadian federal customers since 1985 and holds federal and NATO contracting vehicles. The company frames the ADGA agreement as an extension of that work, arguing that the government customers it already serves depend on a secure supplier base.