Honourable senators, it is lovely to be back here and to see everybody again. Senator Moreau, congratulations on your new appointment.

The Government of Canada is implementing the Canadian Program for Cyber Security Certification, or CPCSC, which will become increasingly mandatory for all organizations participating in defence contracts, starting in 2026. The lead time and cost required for Canadian small- and medium-sized enterprises, or SMEs, to achieve compliance with this important standard is between 9 and 12 months and over $200,000. In light of massively increasing defence spending and in the absence of targeted mechanisms to support SME compliance, there is a significant risk of further entrenchment of U.S.-made solutions instead of supporting domestic innovation, dual-use technology and sovereign capacity. What plans does the government have to fill the resource gap to enable Canadian SMEs to meet CPCSC standards, thereby safeguarding built-in-Canada innovation, job creation and economic benefit?

Thank you, Senator Moreau. A similar challenge exists in the United States with the Cybersecurity Maturity Model Certification, and nearly half of our defence contractors are part of the U.S. supply chain. What worries me is that if we don’t have a firm model in place — and I think there’s ambition to do so — we may miss out. One option we could consider is to use industrial technology benefits, which are often left unused and are then disqualified. Is that a consideration?