Why defence contractors need CGP, ITAR and security clearance

Defence manufacturing looks a lot like any other precision work: drawings, materials, tolerances, inspection. The difference is the information. Drawings and technical data for military goods are controlled by law, and the companies that touch them have to prove they can protect them.

In Canada, that comes down to four programs.

1. The Controlled Goods Program (CGP)

The Controlled Goods Program is run by Public Services and Procurement Canada (PSPC) under the Defence Production Act. Any person or business in Canada that needs to examine, possess or transfer controlled goods or controlled technology must register. That includes receiving bid documents that contain controlled technical data.

• Registration is free, and lasts up to five years.
• The business appoints a designated official, who passes a security assessment and mandatory training. Owners of 20% or more, and employees who handle controlled goods, are assessed too.
• Penalties for breaking the rules include fines of up to $2,000,000 and up to 10 years in prison.

2. ITAR

The International Traffic in Arms Regulations (ITAR) are US rules administered by the State Department. They cover defence items and technical data on the US Munitions List. Much of the defence work in North America involves US-origin designs, so Canadian shops run into ITAR often.

Canada and the US have a special arrangement: under the ITAR’s Canadian exemption, US companies can send certain unclassified, less sensitive defence items and data to Canadian companies registered in the CGP without an export licence. That is a big part of why CGP registration matters: it is what lets a Canadian shop receive US defence drawings without the delay of a licence for every job. More sensitive items still need one.

3. Security clearance (the Contract Security Program)

When a contract involves protected or classified government information, PSPC’s Contract Security Program screens the company. A company can’t apply on its own; it is sponsored through a government contract or bid. The main levels are:

• Designated Organization Screening: staff screened to Reliability status, for access to protected information and sites.
• Facility Security Clearance: for classified work, at Confidential, Secret, Top Secret or NATO levels.
• Document Safeguarding Capability: permission to store protected or classified material at your own site, for a specific contract.

Individual employees are screened too, at Reliability, Secret or Top Secret, depending on what they need to see.

4. Cyber security: CPCSC

The newest requirement is the Canadian Program for Cyber Security Certification (CPCSC), which checks that defence suppliers protect sensitive information on their computer systems.

• Level 1: an annual self-assessment against 13 security controls. Launched in April 2026.
• Level 2: certification by an accredited body against 98 controls (in development).
• Level 3: assessment by National Defence against more than 130 controls (in development).

How it fits together

A defence buyer wants to know three things: who you are (your NCAGE code), whether you are allowed to see the data (CGP and security clearance), and whether your systems keep it safe (CPCSC). Only then does the conversation turn to whether you can make the part.

At JointWerks we are working toward CPCSC Level 1 and ISO 27001; see our certifications. Have a defence part to make? See our aerospace and defence work.