Canada is spending more on defence than it has in a generation, and it is deliberately routing that spending toward Canadian industry. If you run an engineering firm here, you have probably already felt the effect: primes you have never spoken to are suddenly asking whether you do certified software, what your cyber posture is, and whether you are registered to handle controlled goods.

There is a policy machine behind those calls. Understanding it — what the prime is obligated to do, why your compliance status is worth points to them, and which walls you will hit — is the difference between being a beneficiary of this wave and being a bystander to it.

The machine: how ITB creates demand for you

The Industrial and Technological Benefits (ITB) policy obliges the winner of a major Canadian defence procurement to generate business activity in Canada equal to 100% of the contract's value. It applies to defence and Coast Guard procurements over $100 million (those between $25M and $100M are reviewed case by case), outside trade-agreement carve-outs or where the national security exception is invoked.

The part that matters to a supplier is the Value Proposition: bidders must submit an economic plan for Canada, and it is scored — a weighted, rated element of bid selection alongside technical merit and cost. Commitments to capable Canadian suppliers are worth points at bid time, and unmet obligations carry contractual consequences, monitored by ISED through annual reporting.

How Canada's Industrial and Technological Benefits policy creates demand for compliant Canadian SMEs: Canada awards a defence contract over $100M, the prime owes 100% of that value in Canadian business activity, the Value Proposition is scored at bid time alongside technical and cost criteria, and primes seek ready Canadian suppliers because compliant SMEs earn bid points Canada awards a defence contract over $100M Prime owes 100% of the contract value in Canadian business activity Value Proposition scored at bid time rated alongside technical and cost Primes seek ready Canadian suppliers compliant SMEs = bid points
The chain that ends at your door. The prime's obligation is contractual and scored — which is why capable Canadian suppliers are sought out rather than merely tolerated.

The three walls, and why they arrive together

Here is what the newly-courted supplier discovers, usually inside one RFP package: defence-aerospace work carries three distinct compliance regimes, from three different worlds, all gating the same bid.

Three compliance gates a Canadian SME's bid must pass through at once to enter defence-aerospace work: certification evidence (DO-178C, DO-326A, ARP4754A), cyber compliance (CPCSC, NIST 800-171), and data control (Controlled Goods, ITAR §126.5) — three different disciplines, not three alternative routes Certification evidence DO-178C · DO-326A · ARP4754A Cyber compliance CPCSC · NIST 800-171 Data control Controlled Goods · ITAR §126.5 your bid
Three gates, three disciplines, one bid. The mistake is treating them as one problem with one owner.
Regime What it governs Who imposes it The clock
Certification evidence (DO-178C, DO-326A, ARP4754A/4761) Whether your engineering artifacts can support an airworthiness approval The certification authority, through the applicant/prime Runs on programme time — evidence is built, not bought
CPCSC (Canada's counterpart to CMMC) How the unclassified government information on your systems is protected — aligned with NIST SP 800-171/172 Contract clauses; Standards Council of Canada accredits assessors Level 1 clauses appearing in contracts now; third-party Level 2 assessments from around April 2027
Controlled Goods Program / ITAR Who may examine, possess or transfer controlled technical data — including engineering data Defence Production Act; interlocks with ITAR §126.5 Gates the start: registration must exist before the data arrives
The three regimes at a glance. Dates and thresholds verified at time of writing — confirm current status before relying on them for a bid.

They arrive together because the prime's supplier questionnaire asks about all three at once — but they are not one problem. Certification evidence is an engineering discipline; CPCSC is an information-security management discipline; controlled goods is a legal-and-personnel discipline. Firms that assign all three to whoever answered the questionnaire discover the difference at audit time.

Where certification meets the ITB clock

The structural tension in all of this: ITB commitments are made at bid time, but certification capability is built on programme time. A prime scoring Value Proposition points against your participation is committing to your output before your DO-178C evidence exists. Three practical consequences:

  1. Your process maturity is part of their risk register. Expect diligence that looks like a mini SOI review — plans, standards, CM, problem reporting — before any authority sees your evidence. A supplier who has run our compliance checklist honestly is ahead of most of the field.
  2. First-programme economics apply. Much of a first DO-178C programme is capability-building the next programme inherits. Under an ITB umbrella that investment is likely to be reused — which changes how you should price it, and how you should negotiate who pays for what.
  3. Your evidence may be controlled data. On a defence platform, the requirements, design data and verification results you produce can themselves be controlled goods — constraining which consultants may review them, where they are hosted, and how a remote review is run. Sort this out at contract time; retrofitting an evidence-handling regime mid-programme is miserable.

What to do, in order

  1. Register for the Controlled Goods Program before you need it. Registration and personnel assessments take calendar time, and receiving controlled technical data before registration is the offence, not a formality missed.
  2. Self-assess against CPCSC Level 1 now. The control set is small and the clauses are already appearing; being able to answer the questionnaire cleanly this year matters more than a perfect posture in two years.
  3. Run a certification self-check before the prime does. Their diligence will sample your plans, traceability and CM exactly the way an SOI reviewer would. Find your own gaps first.
  4. Ask the prime what their Value Proposition committed. It is remarkable how few suppliers ask. Their commitments shape what they need from you, on what schedule, and what your participation is worth.
  5. Treat the three regimes as three workstreams with three owners — even in a fourteen-person company. The owners can be part-time; the separation cannot.

The honest caveat

Policy ambition and procurement execution are different things, and Canada's contracting pace has historically lagged its announcements. The spending direction is real and the ITB mechanism is real, but qualify pipelines, not headlines: a prime's interest becomes revenue when a contract is awarded and its Value Proposition commitments come due, not when a policy paper is published. Plan capability-building against the regimes with dates attached — CPCSC's clock is running regardless of any particular programme's fate.

Frequently asked questions

Does ITB apply to my company directly?

Not usually. The obligation sits on the prime contractor who won the procurement. It reaches you as opportunity — primes seeking Canadian suppliers to satisfy commitments they have already priced and promised — rather than as a compliance burden of your own.

What is the difference between ITB and the old IRB policy?

ITB is the successor to the Industrial and Regional Benefits regime, with the Value Proposition — rated at bid time — as its defining addition. If your contacts learned the file under IRB, the headline change is that economic commitments now help win the bid, not just follow it.

Do we need CPCSC certification before bidding?

It depends on the contract's clauses. Level 1 self-identification requirements are appearing in select contracts now, with third-party Level 2 assessments expected in contracts from around April 2027. Check the specific solicitation — and assume the direction of travel is toward more, not less.

Is our DO-178C evidence really a controlled good?

On a defence platform it can be — technical data about items on the controlled goods list is itself controlled. Whether yours is depends on the platform and the data. The safe posture is to ask the question at contract time and put the answer in writing before any data moves.

We are strong engineers with none of this in place. How long to become a credible defence supplier?

The honest answer is that the three regimes have different clocks: controlled-goods registration is measured in weeks to months, a CPCSC Level 1 posture in months, and a first certification capability in a programme's worth of time. Start all three, in that order, and be straight with primes about where you are — they plan around known timelines far better than around optimistic ones.

If a prime has come calling and the questionnaire is sitting on your desk, that is precisely the conversation we exist for — certification capability, the compliance perimeter, and what your participation is actually worth. In either official language. Get in touch.