CPCSC Level 1 · closed beta
A CPCSC attestation you can defend.
Someone in your company signs the Level 1 self-attestation. The closed beta of RESTIV's Compliance Copilot gives them the evidence to sign with confidence — built to survive an audit or a breach, not just a checkbox.
Built in Canada · NRC-IRAP funded · Air-gapped edition available.
The manual way
- Spreadsheets nobody trusts and screenshots that go stale.
- Evidence owners chased by email, one file at a time.
- Consultant retainers and 200+ staff hours per cycle.
- A signature backed by good intentions.
Compliance Copilot
- Automated testing and evidence collection across all 13 controls.
- Evidence versioned, dated and refreshed continuously.
- Control status tied to the scan result, snapshot, log or procedure behind it.
- An attestation package that stays current.
Your attestation is only as good as the evidence behind it.
The deliverable
A trusted evidence package.
Not simply access to software. You leave with per-control evidence — scan results, configuration snapshots, logs and procedures — mapped to all 13 Level 1 requirements across six control families.
Every item is versioned and dated to show when the control was verified, assembled for the accountable signer and structured for external scrutiny.
Illustrative evidence register
Level 1 · 13 controls · current state
Conceptual illustration only. It does not claim to show a production product screen.
How the beta works.
- 01
Apply below
Two minutes. Tell us who is accountable, where you are in the contract cycle and how close the attestation is.
- 02
A short fit conversation
Devon Smibert, RESTIV’s founder, confirms the beta suits your environment and attestation timeline before committing a seat.
- 03
Onboard September 14
The founding cohort onboards September 14, 2026. Participation is free in exchange for structured feedback.
Who should apply
Canadian defence suppliers — primes or subcontractors handling specified information — facing a Level 1 attestation in the next 12 months.
Who should not
Organizations with no defence contract exposure, or teams looking for a consultant to do the attestation for them.
“We’re keeping this cohort small because I’d rather help 15 suppliers become genuinely audit-defensible than onboard 100 shallowly. The evidence has to hold up for the person whose name is on the attestation. What this cohort tells us will shape what the general-availability product becomes.”
Closed beta application
Apply for one of 15 seats.
Every application is reviewed by RESTIV. A seat is committed only after a short fit conversation confirms the environment and timeline.
Frequently asked questions.
Direct answers to the questions buyers, assessors, and executive teams ask most often.
- What is CPCSC Level 1 and who must comply?
- CPCSC Level 1 is an annual self-attestation covering 13 controls across six control families, aligned to ITSP.10.171 and NIST SP 800-171 revision 3. It applies when a DND solicitation or contract requires it, including flow-down to subcontractors handling specified information. The attestation is submitted through Canada Buys and is due at contract award, not at bid.
- What exactly is in the evidence package?
- A dated, versioned package of per-control evidence mapped to all 13 Level 1 requirements. Depending on the control, that can include scan results, configuration snapshots, logs and procedures, assembled for the accountable signer and structured for external scrutiny.
- What does the beta cost?
- The founding cohort is free for 15 Canadian defence suppliers. In exchange, participants provide structured product feedback throughout the beta.
- How much of our team's time does it take?
- The exact commitment depends on your environment, evidence owners and current control maturity. The fit conversation scopes the required participation before RESTIV commits a seat, so your team knows what will be expected before onboarding.
- Can it run in restricted or air-gapped environments?
- Yes. An air-gapped edition is available. Deployment constraints are reviewed during the fit conversation before onboarding.
- What happens after the beta?
- Founding participants leave with their trusted Level 1 evidence package. Their structured feedback shapes the general-availability product; any post-beta commercial terms will be discussed separately rather than assumed as part of the beta.
- Who sees our data?
- Data access and handling boundaries are confirmed before onboarding and matched to your environment, including restricted or air-gapped deployments. RESTIV documents the agreed access model before work begins rather than asking participants to accept an undefined beta arrangement.