01
CRA Business Number
Canada Revenue Agency
Required before any federal registration. Confirm your BN plus program accounts (GST/HST, payroll) as needed.
Timeline
Ongoing
Cost: Free
When to act
Day 0
Readiness gates
Clear these before opportunity arrives
Founders who start these processes only when a tender appears are typically a year too late. The timelines below are published — plan from them, then add contingency.
02
SAP Business Network (CanadaBuys)
PSPC / CanadaBuys
Federal supplier registration spine. Complete questionnaire Q3–Q8 minimum; Q9 recommended; Q12 for defence.
Timeline
Days
Cost: Free
When to act
Week 1
03
Controlled Goods Program
PSPC
Clocks start only on complete applications. Requires a Designated Official and security assessments of key personnel.
Timeline
32 business days (complete application)
Cost: Free
When to act
Before touching controlled tech data
04
Designated Organization Screening
PSPC Contract Security Program
Sponsored by a live contractual requirement. Appoint a Company Security Officer.
Timeline
Up to 4 months
Cost: Free
When to act
When a solicitation requires PROTECTED information
05
Facility Security Clearance
PSPC Contract Security Program
Higher tier than DOS. Requires cleared personnel and secure facility zones.
Timeline
6 months or more
Cost: Free
When to act
When CLASSIFIED work is in play
06
CPCSC Level 1 (self-assessment)
Canadian Centre for Cyber Security
Level 1 self-assessment via the Cyber Centre portal; reflect in your supplier profile.
Timeline
Self-serve
Cost: Internal effort
When to act
Now — required in select defence contracts from summer 2026
07
CPCSC Level 2 (third-party)
Accredited assessors (from spring 2027)
Scope now if defence work involving protected information is on your roadmap.
Timeline
Multi-month
Cost: Assessor fees
When to act
When PROTECTED B work is plausible
Personnel screening is contract-triggered
You cannot pre-clear speculatively. Screening is sponsored by a live contractual requirement — appoint a Company Security Officer now, but initiate DOS/FSC only when justified by a real solicitation.