IT Compliance for Manufacturing in Ontario, Starting With the Rules That Actually Apply to Your Plant

Fewer than most owners fear, but more than “we have antivirus” covers. Privacy and record-keeping rules apply to every plant; customer, insurance and defence requirements depend on who you sell to.

Sources: the Office of the Privacy Commissioner on breach reporting and records, the Canada Revenue Agency on record retention, and Public Services and Procurement Canada on Controlled Goods security plans. This is a plain-language map, not legal advice: your lawyer or contract officer confirms what applies to you.

Both programs ask suppliers to prove their cyber security before or at contract award. Canada’s CPCSC follows the Canadian standard ITSP.10.171; the US CMMC follows NIST SP 800-171 at Level 2.

• CPCSC. Level 1, a self-assessment against ITSP.10.171, was introduced in April 2026. Public Services and Procurement Canada says requirements may be identified in select defence contracts as early as summer 2026, with Levels 2 and 3 phasing in after that. It applies where a contract identifies specified information, not to every defence bid.
• CMMC. The US Department of Defense rule took effect November 10, 2025, starting with self-assessments, and the requirements flow down to subcontractors. Phase 2, scheduled from November 10, 2026, is when third-party Level 2 assessments against the 110 requirements of NIST SP 800-171 are expected in many contracts (summary of the final rule).
• Controlled goods. Registered companies need a security plan for each work site where controlled goods are examined, possessed or transferred, including procedures for reporting and investigating security breaches.

The practical step is the same for all three: find out exactly which clause applies, then compare it with what your systems do today. Much of what these programs ask for, such as MFA, access control, patching and logging, is also what a customer questionnaire asks. One set of well-documented controls usually serves several requests.

Inside the scope, even when nobody has written them down. Questionnaires usually ask about every system, and the PC beside a machine, a shared floor login or a vendor’s remote access tool all count.

• Old PCs at machines. Windows 10 reached end of support on October 14, 2025 (Microsoft lifecycle). If a machine controller needs it, isolate that PC and record why, rather than leaving it unexplained.
• Shared logins. One password for the whole floor makes it impossible to say who did what. Named accounts, or a documented exception, close the gap.
• Vendor remote access. Equipment and ERP vendors often have standing access. List who they are, how they connect and who approves each session.
• Flat networks. Office, ERP and machines on one network let a single infected laptop reach everything. Segmentation is both a security fix and an easy answer on a questionnaire.

Why plants get targeted in the first place is covered in why ransomware targets manufacturers in Canada. The ERP side of the floor is on our ERP support for manufacturing page.

Things nobody knew were happening. For a 35-person contractor that came to ACT360 about a failing server, identity monitoring flagged account access from three countries within weeks of going live.

The client is a commercial painting contractor, not a manufacturer, but the lesson carries straight over to compliance. A questionnaire asks whether you monitor accounts and would know about suspicious access. Before the engagement, the honest answer was no. One incident was serious enough that the affected account was isolated automatically. None of it had been visible before endpoint detection, identity threat detection and a managed firewall went in as standard. The full story, including how the server quote went from $60,000 to $25,000, is in the painting contractor case study.

The controls and documentation sit inside an ACT360 Managed IT agreement, priced per user. Certification fees, legal advice and auditor time are separate and paid to those providers.

ACT360 isn’t a certification body or a law firm. We put the technical controls in place, keep the evidence current, and work alongside your auditor, assessor or lawyer. For the per-user side by plant size, see what managed IT costs a manufacturing business in Ontario. ACT360 Managed IT agreements include a 90-day exit clause. If you want to see what a security review looks at before you commit, read what a cybersecurity assessment actually covers.