ITSP.10.171 Security Controls

All 17 control families mapped to CPCSC Level 1 and Level 2 requirements. Canada's adaptation of NIST SP 800-171 Rev 3.

17

Control Families

97+

Total Controls

13

Level 1 Controls

Apr 2026

Mandatory Deadline

AC

Access Control

22 controls
03.01.01
Account Management
L1
03.01.02
Access Enforcement
L1
03.01.03
Information Flow Enforcement
03.01.04
Separation of Duties
03.01.05
Least Privilege
03.01.06
Unsuccessful Logon Attempts
03.01.07
System Use Notification
03.01.08
Session Termination
03.01.09
Session Lock
03.01.10
Device Lock
03.01.11
Remote Access
03.01.12
Wireless Access
03.01.13
Access Control for Mobile Devices
03.01.14
Use of Privileged Accounts
03.01.15
Privileged Access to Systems
03.01.16
Wireless Access Points
03.01.17
Privileged Commands from Remote Access
03.01.18
Controlled Access Points
03.01.19
Encrypt Remote Access Sessions
03.01.20
Use of External Systems
L1
03.01.21
Portable Storage Devices
03.01.22
Publicly Accessible Content
L1
AT

Awareness and Training

3 controls
03.02.01
Literacy Training and Awareness
03.02.02
Role-Based Training
03.02.03
Insider Threat Awareness
AU

Audit and Accountability

9 controls
03.03.01
Event Logging
03.03.02
Audit Record Content
03.03.03
Audit Record Generation
03.03.04
Audit Log Failure Response
03.03.05
Audit Record Review, Analysis, and Reporting
03.03.06
Audit Record Reduction and Report Generation
03.03.07
Time Stamps
03.03.08
Protection of Audit Information
03.03.09
Audit Record Retention
CA

Security Assessment and Monitoring

4 controls
03.04.01
Assessment of Security Controls
03.04.02
Plan of Action and Milestones
03.04.03
Continuous Monitoring
03.04.04
System Connection Authorizations
IA

Identification and Authentication

11 controls
03.05.01
User Identification, Authentication, and Re-authentication
L1
03.05.02
Device Identification and Authentication
L1
03.05.03
Multi-factor Authentication
L1
03.05.04
Replay-Resistant Authentication
03.05.05
Identifier Management
03.05.06
Authenticator Management
03.05.07
Authenticator Feedback
03.05.08
Cryptographic Module Authentication
03.05.09
Identification and Authentication for Non-Organizational Users
03.05.10
Adaptive Identification and Authentication
03.05.11
Identity Proofing
CM

Configuration Management

9 controls
03.06.01
Baseline Configuration
03.06.02
Configuration Change Control
03.06.03
Security Impact Analysis
03.06.04
Access Restrictions for Change
03.06.05
Minimum Functionality
03.06.06
Deny by Exception
03.06.07
System Component Inventory
03.06.08
Configuration Settings
03.06.09
Configuration Management Plan
IR

Incident Response

8 controls
03.07.01
Incident Handling
03.07.02
Incident Monitoring and Reporting
03.07.03
Incident Response Testing
03.07.04
Incident Response Plan
03.07.05
Incident Response Training
03.07.06
Incident Response Assistance
03.07.07
Incident Containment
03.07.08
Incident Recovery
MP

Media Protection

4 controls
03.08.01
Media Storage
03.08.02
Media Access
03.08.03
Media Sanitization
L1
03.08.04
Media Marking
MA

Maintenance

6 controls
03.09.01
System Maintenance
03.09.02
Maintenance Tools
03.09.03
Nonlocal Maintenance
03.09.04
Maintenance Personnel
03.09.05
Timely Maintenance
03.09.06
Maintenance Monitoring
PE

Physical Protection

7 controls
03.10.01
Physical Access Authorizations
L1
03.10.02
Physical Access Monitoring
03.10.03
Visitor Management
03.10.04
Emergency Lighting
03.10.05
Alternate Work Site
03.10.06
Delivery and Removal
03.10.07
Physical Access Control
L1
PS

Personnel Security

5 controls
03.11.01
Personnel Screening
03.11.02
Personnel Termination
03.11.03
Personnel Transfer
03.11.04
Access Agreements
03.11.05
External Personnel Security
PL

Planning

2 controls
03.12.01
System Security Plan
03.12.02
Rules of Behaviour
SC

System and Communications Protection

16 controls
03.13.01
Boundary Protection
L1
03.13.02
Information in Shared System Resources
03.13.03
Network Communication by Exception
03.13.04
Cryptographic Protection
03.13.05
Session Authenticity
03.13.06
Network Disconnect
03.13.07
Cryptographic Key Management
03.13.08
CUI on Public Systems
03.13.09
Communication Authenticity
03.13.10
Network Segmentation
03.13.11
CUI Encryption
03.13.12
Collaborative Device Configuration
03.13.13
Mobile Code
03.13.14
Voice over Internet Protocol
03.13.15
DNS and Route Protection
03.13.16
Transmission and Preparation Integrity
SI

System and Information Integrity

7 controls
03.14.01
Flaw Remediation
L1
03.14.02
Malicious Code Protection
L1
03.14.03
Security Alerts and Advisories
03.14.04
System Monitoring
03.14.05
Information Input Validation
03.14.06
Error Handling
03.14.07
Memory Protection
RA

Risk Assessment

3 controls
03.15.01
Risk Assessment
03.15.02
Vulnerability Monitoring and Scanning
03.15.03
Risk Response
SA

System and Services Acquisition

5 controls
03.16.01
Security Engineering Principles
03.16.02
Unsupported System Components
03.16.03
External System Services
03.16.04
Development Process and Standards
03.16.05
Acquisition Strategies and Practices
SR

Supply Chain Risk Management

3 controls
03.17.01
Supply Chain Risk Management Plan
03.17.02
Acquisition Strategies
03.17.03
Supply Chain Requirements and Processes

Ready to Achieve CPCSC Compliance?

Start your CPCSC readiness assessment with Solymus and get on the path to certification.

Start Your Free Assessment