Topic starter
10/07/2026 9:11 pm
TL;DR: Canada’s CPCSC framework pushes defence suppliers beyond perimeter VPNs toward identity-driven, continuously verified access, and Appgate maps its ZTNA approach to AC, IA, SC, AU, CM, IR, and SI controls under ITSP.10.171. For practitioners, the shift is less about replacing remote access and more about producing audit-ready proof that access is explicit, segmented, monitored, and revocable.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “How Zero Trust Network Access Helps Canadian Defense Suppliers Meet CPCSC Requirements”.
By the numbers:
- CPCSC is built on ITSP.10.171, which defines 97 controls across 17 families.
Key questions
Q: Where does CPCSC-style zero trust fail in practice?
A: It fails when organisations keep treating remote access as a network connection instead of a controllable, auditable identity decision.
Q: Why do broad VPN access models create CPCSC evidence gaps?
A: Broad VPN access creates evidence gaps because it hides the real entitlement boundary.
Q: What are the signs that a Zero Trust programme is not being enforced consistently?
A: A Zero Trust programme is likely failing when access still depends on trust by location, broad entitlements, or one-time authentication.
Practitioner guidance
- Map CPCSC control families to access evidence Build an access-to-evidence matrix that ties identity, segmentation, logging, and revocation controls to specific CPCSC assessment needs, especially AC, IA, SC, AU, IR, and SI.
- Replace broad VPN trust zones Reduce network reachability to named resources and explicit entitlements so the access layer can prove why each session exists.
- Validate session termination paths Test whether policy, posture, or role changes actually terminate active sessions instead of leaving access alive until logout or timeout.
Bottom line: CPCSC makes access control a verifiable evidence problem, so identity and logging have to be designed together.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:34 pm
Control evidence is now part of the access control itself: CPCSC turns zero trust access into a proof problem, not just a policy problem. If a defence supplier cannot demonstrate who was allowed in, what they could reach, and when the session ended, the control objective has not been met. Practitioners should treat evidence quality as a first-class part of access design, not a separate audit exercise.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should defence suppliers do first when CPCSC access evidence is weak?
A: Start by mapping each remote access path to a named resource, a specific identity source, and a revocation mechanism. Then verify that logging captures the decision, not just the connection. That sequence reveals whether the programme can actually prove control, which is what CPCSC assessment will test.
👉 Read our full editorial: CPCSC makes zero trust access a control evidence problem