Securing Canada's Defence Industrial Base as SMEs Scale Up

In September 2026, the Canadian Chamber of Commerce's Business Data Lab published Deepening Our Defence, a report on expanding Canada's defence industrial base. Canadian Defence Review described the report as a warning that procurement barriers could limit Canada's $1 trillion defence opportunity. The federal Defence Industrial Strategy (DIS) 2026 commits to speeding up those clearances, addressing an important barrier to SME participation in defence programs. As more organizations join defence supply chains, communications security becomes an additional consideration alongside personnel and facility clearances. Every new supplier relationship introduces information-sharing pathways that may require controls beyond the clearance process.

Prime contractors hold the direct procurement relationship with the Department of National Defence and will carry much of the early work, with SMEs joining their supply chains. That structure makes primes a logical point for establishing communications security requirements across participating suppliers.

SMEs Have an Important Role in Expanding Canada's Defence Industrial Base

Canada's defence industrial base is relatively small and concentrated. According to the report, core defence spending is projected to rise from $64B in 2025 to about $160B by 2035, with more than $1T in cumulative spending expected over the next decade. Yet the core sector includes only 538 firms, and the largest 50 account for about 80 percent of sales. SMEs make up 92 percent of firms but receive about 30 percent of revenue. DIS 2026 aims to increase the share of revenue going to Canadian firms to 70 percent by 2035.

The report lists four structural barriers for SMEs:

1. Security clearances. SMEs cannot bid on or execute most defence contracts until both the organization and its personnel are cleared through the Public Services and Procurement Canada (PSPC) Contract Security Program. The report says this routinely takes months and requires physically secured facilities. DIS 2026 commits to accelerate clearance for defence-sector personnel and the report does not publish a target clearance time.

2. Access to capital. SMEs may face challenges securing the working capital required to support multi-year procurement cycles.

3. Procurement complexity. SMEs may have fewer dedicated procurement resources than larger prime contractors, making complex procurement processes more challenging to navigate.

4. Forward purchase visibility. Limited visibility into future government demand can make it more difficult for SMEs to make long-term investment and capacity decisions.

For many SMEs, the report adds, joining a prime contractor's supply chain will be the most practical first step.

Defence Expansion Connects More Organizations and Communications Channels

As more SMEs enter the defence industrial base, they will exchange sensitive information with prime contractors, public agencies, and critical infrastructure operators. The report identifies near-term opportunities involving bases, shipyards, airfields, ports, ranges, and energy resilience, including projects across the North and Arctic. These projects will connect new defence suppliers with critical infrastructure operators, expanding the number of organizations and communications channels involved.

• Operations. More partners across more regions means more coordination during incidents. If public mobile networks are unavailable or degraded, organizations may face coordination challenges that can affect operational responsiveness.

• Security. Firms new to defence work may rely on communications tools that were not designed for defence, critical infrastructure, or highly regulated operational environments. Depending on their design and configuration, communications platforms may also expose metadata, including who communicated, when the communication occurred, and where participants were located.

• Procurement. Organizations may need to assess security claims from unfamiliar suppliers while procurement and onboarding timelines accelerate.

• Compliance. Organizations may need records showing how information was shared and with whom. Some communications platforms may not provide the governance, audit, or oversight capabilities required for regulated environments.

A Larger Supplier Base Expands Communications Risk

A larger supplier base creates more paths for sensitive information to travel. If security controls vary significantly across suppliers, organizations may face increased risk when sharing sensitive information across extended supply chains.

Clearances Protect People and Facilities

According to the report, clearance applies to organizations and personnel and requires physically secured facilities. These controls protect people and places. The report does not say whether the program also governs the everyday messages, calls, and file sharing exchanged between prime contractors and subcontractors. That distinction matters because communications practices and technologies may require evaluation separately from personnel and facility security requirements.

Communications Risks Remain After Clearance

Cybersecurity threats can exploit weaknesses in identity management, compromised devices, and exposed metadata, so encryption in transit is only one consideration when evaluating communications security. The report emphasizes the importance of Canadian control over intellectual property, production, and other strategically important capabilities. Similar considerations can inform how organizations evaluate the communications systems used to exchange sensitive information, including who controls encryption keys and how access is governed.

Five Capabilities to Consider When Evaluating Secure Communications

Organizations evaluating secure communications solutions should consider five capabilities and verify supporting evidence through documentation, certifications, and testing.

1. Sovereignty. Understand where infrastructure is hosted and who controls encryption keys, identities, devices, and access to sensitive information.

2. Independent certification. Look for validation by independent bodies, such as Common Criteria, NIAP Protection Profiles, NATO Security Accreditation and NSA CSfC. Ask to see the certificate, its scope, and the product version it covers.

3. Identity validation. Every participant is verified before joining a conversation.

4. Out-of-band resilience. Out-of-band means using a communications path that does not depend on your primary network. Confirm that the service continues to work when public networks are degraded and that it can be deployed in cloud, hybrid, on-premises, or air-gapped environments. Air-gapped environments are physically isolated from external networks.

5. Accountability records. Governance controls and audit trails let you reconstruct events after an incident.

BlackBerry^® Secure Communications is designed to support these types of requirements and holds NIAP and NATO Restricted certifications. Organizations should evaluate BlackBerry and other vendors against their own operational, regulatory, and security requirements using objective evidence and testing.

How Organizations Can Strengthen Supplier Communications This Quarter

• Inventory. List every tool your primes and SME suppliers use to exchange program information, by name.

• Pair the requirements. Add a communications security check to supplier onboarding, next to clearance status.

• Write the clause. Cover identity validation, key control, audit records, and certification evidence in your next solicitation.

• Ask vendors five questions. Who holds the encryption keys? Which certifications apply to which product version? Does the service work when public mobile networks are degraded? Can we export audit records for an investigation? Where is metadata stored and who can see it?

• Test the fallback. Run an exercise with public networks unavailable and record how partners coordinate.

• Confirm obligations. Separate binding legal requirements from recommended frameworks and review the result with your legal and compliance advisers.

As Canada's defence industrial base grows, organizations may benefit from considering communications security alongside personnel and facility security requirements. Defining communications security expectations, validating supplier capabilities, and establishing appropriate governance can help support secure collaboration as supply chains expand.