Customers increasingly ask suppliers to prove their security. Three frameworks come up often.

SOC 2

A report from an independent auditor on how a service organization manages data security and related criteria (security, availability, confidentiality, processing integrity, and privacy).

– Common for: software, cloud, and managed service providers selling to North American customers

– Output: an audit report (Type I at a point in time, Type II over a period)

ISO/IEC 27001

An international standard for an information security management system (ISMS), certified by an accredited body.

– Common for: organizations serving international customers or those wanting a recognized, systematic approach

– Output: a certificate, with surveillance audits each year

CPCSC (Canadian Program for Cyber Security Certification)

A mandatory certification for suppliers in selected Canadian defence contracts.

– Level 1 was formally introduced on April 14, 2026, based on an annual self-assessment

– Level 2 requires an external assessment by an accredited certification body, repeated every three years

– It is built on the Canadian Centre for Cyber Security’s industrial standard, which draws on the same controls as the U.S. NIST SP 800-171 behind CMMC

– Level 1 requirements are being added to selected defence contracts starting in summer 2026

– Common for: Canadian companies supplying National Defence, directly or as subcontractors

Which do you need?

Your situation	Likely fit
IT or software provider asked for assurance by customers	SOC 2, ISO 27001, or both
International customers expect a standard	ISO 27001
Supplying Canadian defence contracts	CPCSC
Small firm with no formal requirement	Start with essential controls and a risk assessment

How to decide

1. Ask what your customers and contracts require

2. Consider cost, effort, and renewal cycles

3. Start with a readiness assessment

4. Build controls that satisfy several frameworks at once. They overlap heavily.

Don’t pursue certification just for decoration

Certification takes ongoing effort. Pursue it when it supports real business needs.

DBR Soft can run a readiness assessment to show where you stand. Contact us for more information.