Full engagement
Full consultation
Discuss your complete cloud and security strategy with the principal consultant. For comprehensive transformations and multi-quarter engagements.
The 3-Week CPCSC Readiness Pilot
CPCSC and CMMC readiness, without the guessing.
A fixed-scope pilot for Canadian defence suppliers that need to understand control gaps, evidence needs, and the next practical steps before spending months on a full program.
3
Weeks
A short sprint from fit call to executive readout.
Fixed
Scope and quote
The pilot scope and price are written before work begins.
Signed
Acceptance criteria
Both sides know what success looks like before the first session.
Pilot scope packet
What the pilot covers, on paper.
- Built for
- Canadian defence suppliers preparing for CPCSC, CMMC, NIST 800-171, or a prime contractor security review.
- Outcome
- Understand your current gaps, evidence needs, and priority sequence before funding a full compliance program.
- Deliverables
- Gap map, evidence plan, scope boundary memo, executive readout, and a 90-day readiness sequence.
- Risk
- The Pilot Promise applies to the signed scope and acceptance criteria.
Who this is for
Built for one situation, not for everyone.
This is not a general security audit. It is for defence suppliers that need clarity on CPCSC readiness before they commit budget, timelines, and internal credibility.
Good fit
- You sell to defence, aerospace, public-sector, or prime contractor customers.
- You have been asked about CPCSC, CMMC, NIST 800-171, or supplier security evidence.
- You want a practical readiness path before hiring a full compliance team.
- You want executive-ready findings, not a raw spreadsheet dump.
Not a fit
- You expect formal certification, attestation, or legal counsel from this pilot.
- You are shopping for a check-box audit with no implementation context.
- You cannot share enough current-state detail to produce useful findings.
- You need a full security program built before any readiness review.
Why this matters now
Beginning summer 2026, the timing tightens.
Canada.ca says that beginning in summer 2026, suppliers bidding on defence contracts may need CPCSC Level 1 certification when the contract requires it. Level 1 became available in April 2026. Suppliers without a readiness sequence in place tend to discover gaps too late to fix calmly.
The downside of waiting is not theoretical. Unplanned remediation crowds out other engineering work, gets expensive fast, and arrives just when the contract clock is shortest. A planned remediation, sequenced by this pilot, lets the right work happen in the right order.
What you get
Everything needed to make the next decision.
The pilot replaces uncertainty with a written, usable path. Continue with us, take the plan internal, or use it to scope the next vendor conversation. You keep the deliverables either way.
-
Readiness gap map
A prioritised view of current gaps against the control areas that matter for your target customer and readiness stage.
-
Evidence plan
A list of evidence you already have, evidence you still need, and the owners likely required to gather or produce it.
-
Scope boundary memo
A plain-English boundary document that separates what is in scope now from what belongs in a later program phase.
-
90-day readiness sequence
A practical order of operations for the first three months, including quick wins and work that needs more planning.
-
Executive readout
A concise summary for leadership that explains risks, tradeoffs, and recommended next steps without control-jargon noise.
-
30-day handover support
A short support window for follow-up questions after delivery, so the findings do not stall after the final call.
How it works
A short sprint with visible checkpoints.
- Fit decision
Readiness fit call
We confirm the deadline you are working against, your current evidence state, target standard, constraints, and whether this pilot is the right first step.
- Signed scope
Written scope and fixed quote
You receive the pilot scope, timeline, responsibilities, acceptance criteria, and a fixed quote before signing.
- Initial map
Current-state review
We review the systems, policies, evidence, customer requirements, and known gaps that affect readiness.
- Gap summary
Gap map and evidence plan
We turn the review into a prioritised map with evidence needs, likely owners, and near-term actions.
- Decision packet
Executive readout and handover
You receive the final deliverables, a leadership-ready summary, and a 90-day sequence for the next phase.
Our promise for this pilot
The Pilot Promise.
If we do not deliver the outcomes listed in the signed pilot scope, you do not pay the final invoice. You keep the completed documentation and findings produced during the pilot.
The signed scope defines deliverables, timeline, responsibilities, and acceptance criteria before work begins. Pilotcore provides readiness support only; assessment and certification outcomes stay with the applicable assessor or program body.
Nelson Ford Founder, Pilotcore
Investment
Fixed quote before any commitment.
The readiness fit call confirms scope and fit. If the pilot makes sense for your situation, you receive a written fixed-fee quote before any work begins. The fee is fixed in the signed scope and varies with organisation size, current evidence state, and target standard. If it is not the right first step, we say so on the call.
Frequently asked
Useful answers before the call.
-
Is this a certification?
No. This is a readiness pilot. It helps you understand gaps, evidence needs, and next steps. Formal certification, attestation, and legal counsel are separate paths from separate providers.
-
What do we need to prepare?
Bring the contract clause or customer requirement, target standard if known, current policies or system notes, and the internal owner who understands your technical environment.
-
Can this lead to implementation?
Yes, but it does not have to. The pilot is designed so you can continue with Pilotcore, use the findings internally, or take the scope to another provider.
-
What if CPCSC does not apply to us?
Then we should not sell you this pilot. We will say that on the fit call and point you at a better next step. The same pilot pattern is used for cloud and AI work with different outcomes.
-
How does CMMC fit in?
CMMC mirroring is secondary on this pilot. Canada.ca says a valid CMMC certification may be accepted case-by-case for CPCSC Level 1 after Canada confirms scope. We can map the overlap, but CMMC reciprocity is not automatic.
Next step
Find out if this is the right pilot.
Book a 30-minute readiness fit call. We confirm fit, identify the right scope, and tell you if another pilot or no engagement is the better next move.