Selling to the US Department of Defense from Canada: CCC, DPSA and CMMC for marketing teams

The Defence Production Sharing Agreement has been in effect since October 1, 1956. CCC describes itself as the US Department of War's designated contracting authority for acquisitions from Canada, and says the DPSA generally covers contracts above the Simplified Acquisition Threshold of USD $350,000. Under it, Canadian suppliers can compete for US defence contracts on equal terms, and the US waives Buy American preferences and import duties for eligible Canadian defence goods. CCC also warns that some solicitations may still include Buy American provisions, so each one needs checking.

CCC's April 2026 exporter brochure lists the process: identify the program and your solution, confirm you meet requirements, submit a proposal to the US buyer with a copy to CCC, negotiate with CCC and the buyer, complete due diligence on integrity, technical, managerial, financial and security grounds, then deliver directly to the buyer while CCC administers the contract.

The process is formal, but the first two steps are mostly marketing and business development. Here is how we split the work.

The US Department of Defense's CMMC 2.0 page states that the 48 CFR rule took effect on November 10, 2025, the start of Phase 1, when contracting officers began adding CMMC Level 1 and Level 2 to new contracts. The rollout runs over three years, and by the fourth year every contractor must be fully compliant.

Canada's own program is aligned. PSPC says the standard behind the Canadian Program for Cyber Security Certification matches the 172 controls in NIST SP 800-171 and 800-172 that underpin CMMC. If you sell to both governments, explain your status under each program clearly and separately. Buyers and primes will ask, and a precise answer shortens supplier onboarding.

Before examining, possessing or transferring controlled goods in Canada, organizations must register with the Controlled Goods Program run by PSPC. CCC's knowledge base notes that registration is also required before receiving bid solicitations that contain controlled goods. Registration involves a Designated Official, security assessments for key people and a security plan.

For marketing, the same rule applies as in Canadian defence work: describe capability and outcomes publicly, and route anything technical through the Designated Official. Many US solicitations involve technical data you cannot share in open content, so plan briefings and gated discussions instead of downloadable specifications.

US defence buying is concentrated, and the people who matter are identifiable: program managers, engineering leads, small business and supplier diversity offices at primes, and supply chain security teams. We build these as named account lists and reach them with LinkedIn company list targeting, programmatic display on account lists and short technical content.

Measure the program by accounts engaged, briefings held and solicitations you were invited to or positioned for, not by lead volume. A single qualified conversation with the right program office is worth more than thousands of impressions.

1. List the 20 to 40 US programs and primes where your capability fits, using public program information and your partners.
2. Map roles in each: program, engineering, supplier development, security.
3. Publish a US-facing readiness page with CMMC status, DPSA eligibility through CCC and controlled goods registration.
4. Run account-based campaigns to those roles with capability content and briefing offers.
5. Contact CCC early so the contracting route is clear before a solicitation lands.

US program offices and prime supplier teams screen vendors quickly, often before any conversation. These are the items we make sure a Canadian supplier publishes in plain language.

• A one-paragraph capability summary in US terms: the mission problem, the platform or system it supports, and the outcome.
• How you contract: through CCC under the DPSA for eligible work, with a named business development contact.
• Cyber status under CMMC and, separately, under Canada's CPCSC, with dates.
• Controlled goods registration status and a statement that technical data is shared only through approved channels.
• Quality systems, manufacturing or delivery capacity, and where work is performed.
• Two or three references from defence or adjacent regulated buyers you are permitted to name.

Keep the same facts in your capability statement, proposals and LinkedIn company page. Due diligence teams compare them, and inconsistencies slow a review that is already long.

CanExport SMEs can support international market development, but its 2026-27 rules say a project targeting the US cannot include any other market, the program prioritizes non-US markets this year, and defence projects must include "Defence" in the project title. The program page says the 2026-27 intake is closed, so check for future intakes before planning on it. Our guide to what CanExport SMEs covers for marketing explains which costs qualify.

We work with clients in Ottawa and across Canada on account programs that sell into the United States, and with US teams from our Montreal office on Eastern Time. Our ABM for US enterprise teams page explains how we segment large territories by region, vertical and tier.

For the Canadian side of the same work, our guide to defence and cybersecurity marketing in Canada covers CPCSC and the Defence Industrial Strategy.

To plan US defence accounts, talk to our team.