Yes, it can. If a contract identifies your customer’s drawings as Specified Information and those drawings reach your computers, email, file shares, or backups, you are inside CPCSC. Building to print doesn’t exempt you, because the program reads where the data goes and ignores what you make.
The reasoning
PSPC’s Level 1 scoping guide defines Specified Information as government information that has to be protected when a non-government organization handles, processes, or stores it. A drawing package for a bracket, a housing, or a wire harness can fit that description when the contract says so. Making only the part and never designing anything doesn’t change where the PDF lands.
My test has three questions, in order. Is the work connected to a National Defence contract, directly or through a prime? Do the contract’s clauses or security requirements identify Specified Information? Does any of it touch your systems? Three yeses put you in. The full walkthrough is on the does it apply page.
Company size and tier never enter that test. A shop 3 tiers below the department is in scope the same way a prime is, as long as the data got to it.
Edge cases
Some shops find the answer is no. If you sell catalogue parts off a price list and never receive a customer’s technical data, there is nothing to protect. Re-run the test the day a customer sends you a drawing.
A prime’s certification probably won’t cover you. PSPC’s pages say nothing about subcontractors, and my reading is that the safeguarding requirement travels with the data to each supplier that holds it. Your contract’s security clauses decide, so read them and ask the prime in writing.
Controlled Goods registration is a separate matter. It governs who may examine or possess controlled technical data, while CPCSC governs how the systems holding contract data are secured. One doesn’t satisfy the other.
Then there is volume. The published material sets no threshold. One drawing on one laptop puts that laptop in the question, and volume only decides how big the scoping job is.
What to do this week
- Pull every contract and purchase order that mentions National Defence, and read the security and handling clauses.
- List who at your shop receives drawings, and by what route (portal, email, file transfer).
- Find every copy, including downloads folders, quoting files, CAM stations, and backups.
- Ask your prime in writing whether it expects a CPCSC Level 1 attestation from you, and by when.
Step 3 is where most shops learn how far the data has spread. The scoping page explains how to shrink that footprint before you buy anything, and Level 1 lists the 13 requirements you would attest to. Short, plain explainers on this are collected in CPCSC Bytes.
If you want a second pair of eyes on your contracts and data flow, book a scoping call.
