OMN
Defense & aerospace / Ontario, Canada

Source shops by the certification you need.

Cybersecurity certification is becoming a condition of award on both sides of the border, and the supplier lists most buyers rely on don’t record it. OMN does. Filter Ontario machine shops, fabricators, and custom manufacturers by CPCSC, CMMC, NIST SP 800-171, AS9100, and Controlled Goods.

Browse by certificationSubmit an RFQ

Free for buyers. No commission on awarded work.

FIG.01 — Program status

Where the requirements stand

As of August 2026

  • CPCSCIn force

    The Canadian Program for Cyber Security Certification, run by Public Services and Procurement Canada with National Defence.

  • CMMCPhase 2 suspended

    The US Cybersecurity Maturity Model Certification. It reaches Canadian shops indirectly, through requirements a US defence contractor must pass on to its subcontractors.

  • NIST SP 800-171Still binding

    The control set underneath CMMC, and the requirement that did not pause when Phase 2 did.

Compliance landscape

Three programs, and only one of them paused.

Most guidance published this year still cites a November 2026 CMMC deadline that no longer stands. Here is where each program actually sits, checked in August 2026.

CPCSCIn force

The Canadian Program for Cyber Security Certification, run by Public Services and Procurement Canada with National Defence.

  • Level 1 became available to suppliers on April 1, 2026: 13 controls, an annual self-assessment, and an attestation. No third-party assessor.
  • It began appearing in select DND contracts in summer 2026. Attestation is due at contract award, not at bid, and there is no grace period.
  • Level 2 (98 controls, assessed by an accredited certification body) is expected in select contracts in spring 2027. Level 3 (200 controls) is DND-led and reserved for the highest-risk work.
CMMCPhase 2 suspended

The US Cybersecurity Maturity Model Certification. It reaches Canadian shops indirectly, through requirements a US defence contractor must pass on to its subcontractors.

  • On July 13, 2026 the DoD suspended CMMC Phase 2, which would have made Level 2 (C3PAO) a condition of award on November 10, 2026.
  • Requiring activities may currently designate only Level 1 (Self) or Level 2 (Self). Level 2 (C3PAO) and Level 3 (DIBCAC) designations are not permitted and no waivers are being granted.
  • A CMMC Reform Task Force is reviewing the program and reports to the CIO on or about September 13, 2026. Treat any deadline you read as provisional until it does.
NIST SP 800-171Still binding

The control set underneath CMMC, and the requirement that did not pause when Phase 2 did.

  • A current self-assessment posted in the Supplier Performance Risk System (SPRS), with annual senior-official affirmation, remains a condition of eligibility.
  • This is the practical question to ask a shop today: is there a live SPRS score, and when was it last affirmed?
  • Work done for 800-171 is not wasted if CMMC returns in a different shape. The controls are the same controls.

This page is a sourcing aid, not compliance advice. Confirm any requirement against the solicitation in front of you and the issuing department’s own guidance before you rely on it.

Shortlist by certification

Who in Ontario actually holds it.

Counts are live from the directory. CMMC is deliberately split between a self-assessment and a C3PAO assessment, because they are different procurement outcomes and a buyer should never have to guess which one a shop means.

Cybersecurity

Required to hold controlled unclassified information on a defense contract.

Quality and export control

The long-standing baseline for defense and aerospace work.

If you buy

Qualify the supply base before the clause lands.

  • Ask each existing sub for its current SPRS score and affirmation date, and for its CPCSC level if it takes DND work.
  • Record whether a CMMC claim is self-assessed or C3PAO-assessed. When a US contract passes the requirement down to you, the difference decides eligibility.
  • Build the alternates list now rather than when a solicitation is already open. Certification takes quarters, not weeks.
Send a certified-only RFQ
If you machine

Certifications you never listed cannot be found.

  • Claim your listing and record every certification you hold, including the level and whether it was self-assessed.
  • CPCSC Level 1 is a self-assessment against 13 controls. If you want DND work, it is the cheapest qualifying step available to you.
  • Buyers are searching for this now, ahead of the contracts. Being listed early is how you get the call.
Claim your listing
Ontario defense & aerospace

Find the shops, or be found by the buyers.

Browse the directory by certification, or submit one RFQ and let OMN route it to shops that meet the requirement. Read more on certifications and compliance.

Browse the directorySubmit an RFQ