Can a Federal Contractor Use Coworking Space? SRCL Montreal

Executive Summary

Whether a federal contractor can use a coworking space in Montreal is a question about the contract, not the building. No source reviewed for this report states that coworking is categorically allowed or prohibited. Requisitions with a security requirement must carry an accompanying Security Requirements Check List (SRCL) ^[1], and organizations that need access to sensitive government information must be registered with the Contract Security Program (CSP) of Public Services and Procurement Canada (PSPC) ^[2]. That scheme is federal, so a Quebec address does not change it. The SRCL, the security clauses and the statement of work decide which approvals a workspace must support.

Four approvals are easy to confuse. Personnel screening covers individuals ^[3]. Organization screening, either a designated organization screening (DOS) or a facility security clearance (FSC), covers the company, and it only lets the company obtain personnel screenings for its employees ^[4]. A document safeguarding capability (DSC) covers a specific site and contract ^[5] and is needed when the contract requires storing sensitive government information and assets at a work site ^[6]. Information technology (IT) approval is a separate written CSP approval before protected information is accessed electronically ^[7]. A business address, a lockable room, private Wi-Fi or a provider security claim proves none of these on its own.

Physical details matter because the CSP inspects the actual site. Minimum Protected B paper storage is a locked cabinet in an operations zone ^[6], the operations zone is limited to appropriately screened personnel who work there and escorted visitors ^[8], and public corridors and elevator lobbies in multiple-occupancy buildings are public zone ^[9]. The inspection is free, but the organization pays for equipment or construction ^[6]. PSPC publishes estimated organization screening timelines ^[10]; this report does not estimate how long a site inspection would take.

In Montreal, published provider prices as of November 2026 include Regus coworking from $349 per person per month, with a minimum term that applies ^[11] and a WeWork two-person office from C$740 per month, subject to commitment length, taxes and fees ^[12]. None of the provider pages reviewed claims Canadian government clearance. The practical output is an evidence packet for the security authority: contract clauses, floor plan, access rights, visitor and maintenance access, storage, IT design and written provider answers, followed by a written question to the CSP before security spending or a long lease is committed. Subcontracting does not remove these duties, since federal policy requires security requirements to be extended to any other entity involved in fulfilling the contract ^[13].

Introduction and Background

Montreal freelancers, IT consultancies and two-to-twelve-person services teams increasingly bid on federal work and then ask a practical question: can the desk or private office a team is renting support the contract? Two mistakes recur. The first is treating a personal clearance as if it approved the room. The second is treating a secure-looking office as if it carried an approval. Federal guidance separates these ideas, and the separation drives the workspace decision.

This report is a workspace selection explainer, not a guide to winning government contracts. It works backward from the contract. Departments must document security requirements for supplier contracts in the SRCL or an equivalent document ^[13], and security clauses then flow into the contract. The Contract Security Manual, current edition effective August 13, 2020 ^[2], is the overarching framework, and standard clause sets require compliance with its latest edition. Page dates in this report are as printed on each source and were checked in November 2026.

Scope matters for how much weight a reader should place on what follows. First, the official pages reviewed do not mention coworking or shared offices, so every coworking-specific statement here is an inference from general rules and is labelled as such. Second, nothing here replaces a written answer from the CSP, and a procurement or security specialist should review any decision matrix before it is relied on. Third, the publisher of this report, 2727coworking.com, is a Montreal provider of desks, private offices, meeting rooms, virtual offices and business addresses, so it is a comparable option in this category. This report makes no claim that it, or any other provider, holds CSP approval, and no first-party page is used as evidence.

The CSP is the right escalation route. Its client service centre serves callers in French and English, Monday to Friday ^[14], and publishes an email address for questions. PSPC provides leadership, advice and guidance on contract security under the federal Policy on Government Security ^[15]. The sections below give the first questions to ask, vocabulary, a crosswalk from approvals to evidence, scenario matrices, a premises checklist, IT gates, a cost worksheet and a decision record.

The SRCL and the Contract: Four Questions Before Touring Space

Before comparing rooms, read the SRCL, the security clauses and the statement of work, and answer four questions. Each maps to one approval and to someone who can confirm it.

• Where will protected information be received, stored or processed? Standard clause sets distinguish a supplier that receives and stores protected information on its site or premises from one that only accesses it elsewhere. One sample federal solicitation says the contractor must not use its facilities to process, produce or store protected information until the CSP gives written approval ^[7].
• Which individuals need which screening level, and may unscreened staff work under escort? The SRCL records the answer, and unscreened personnel must be escorted by someone cleared to the required level ^[16].
• Is the legal entity screened at the right level? The CSP screens organizations that are active participants in a procurement ^[17], and contracting authorities must confirm and document compliance with security requirements before awarding a contract ^[13].
• Will any IT system touch protected information? If so, written CSP approval precedes electronic access ^[18], and the site must first satisfy physical requirements ^[19].

Asking these first avoids signing a lease and then learning that the contract needed something the room cannot provide. Pre-contract negotiations involving protected or classified information also cannot start before the organization has been screened through the CSP, unless the contracting authority specifies otherwise.

Definitions and Taxonomy: The Four Approvals

Glossary of English and French terms

English terms follow PSPC wording. French equivalents come from the official French manual where it uses them; where it does not, that is stated.

• Contract Security Program (CSP), in French Programme de sécurité des contrats (PSC).
• Designated organization screening (DOS) and facility security clearance (FSC), in French vérification d'organisation désignée and attestation de sécurité d'installation ^[20].
• Document safeguarding capability (DSC): the French manual uses autorisation de détenir des renseignements ^[20]. The literal phrase "capacité de protection des documents" was not found on the French manual page read for this report, so it should be treated as a search phrase rather than the official term.
• Security Requirements Check List (SRCL), in French liste de vérification des exigences relatives à la sécurité.
• Company security officer (CSO): the organization's official contact with the CSP on security issues.

What each approval covers

Personnel screening asks whether an individual can be trusted with protected or classified information, assets or work sites ^[13]. Departments must security screen individuals who need access to sensitive information, assets or sites to do their work ^[13]. Individuals cannot start their own screening ^[21]; the CSO requests it, and the CSO must justify each personnel clearance ^[22].

Organization screening asks whether the company meets the contract's security requirements. A DOS is required to access Protected A or B information ^[7]. Size is no exemption: a single-person consulting firm must be screened like a large corporation ^[23]. The CSP generally screens organizations that are active participants in a procurement ^[17]. Contracting authorities can allow offerors until the contract award date to obtain the required clearance ^[24].

The DSC asks whether a specific site may hold protected or classified material. The manual describes it as allowing an organization to view, possess and store such information at its site ^[4], and law-firm commentary describes it as site-specific and required for organizations that handle government information or assets at their facilities ^[5].

IT approval asks whether the organization's systems may handle that information electronically. Requirements are specific to each contract, and the organization must first hold a valid DOS or FSC and a DSC ^[7].

Approval crosswalk

Table 1 below connects each approval to its trigger, authority, evidence and the question that usually remains open when a workspace is being chosen. The final column is a prompt for questions to put to the CSP, not a finding.

The crosswalk shows that three of the four approvals attach to individuals or the legal entity, and only the DSC is physically tied to premises. The IT approval is contract specific as well, but it depends on the DSC being in place, so a weak premises answer blocks the IT answer too.

Walking Each Approval Against a Shared Workspace

Organization screening and the legal entity

A coworking provider's own status does not transfer to its members. Law-firm commentary summarising the manual states that security clearances cannot be extended, transferred or assigned between organizations ^[5]. A subsidiary is a separate legal entity needing its own DOS or FSC. For a small team, the contracting entity named in the bid must be the screened entity, whichever room it occupies.

Eligibility also touches the address. Organizations must be formed or incorporated in Canada, physically located and registered to do business in Canada, and the manual says a post office box will not be recognized as an organization's address ^[4]. These rules do not say whether a staffed virtual-office address is acceptable, so that is a written question for the CSP rather than an assumption.

Work-site approval (DSC) and what the inspector examines

A federal buyers' portal says the CSP ensures that inspections are undertaken and regularly renewed at suppliers' facilities where required ^[25]. For competitive solicitations it is completed during bid evaluation for all confirmed bidders ^[6], and commentary reported that organizations must implement any DSC requirements before contract award ^[19]. The field officer requests a detailed floor plan to perform the inspection ^[6], and organizations must implement the CSP's recommendations to qualify for the DSC.

Federal policy expects departments to verify physical security controls in facilities used to store or produce sensitive information or assets ^[13], and clients must verify that the contractor and its personnel maintain valid security statuses throughout the contract ^[27].

Two points are decisive for shared space. First, the zone model: RCMP guidance defines five zones, public, reception, operations, security and high security ^[9], the public zone being an area where the public has unimpeded access ^[8]. Public corridors and elevator lobbies in multiple-occupancy buildings are examples of public zone ^[9], and the manual says public and reception zones are not considered secure for safeguarding protected or classified information ^[4].

Second, the operations zone is limited to appropriately security screened personnel who work there and to escorted visitors ^[8], and it must be indicated by a recognizable perimeter and requires periodic monitoring ^[9]. A coworking floor shared with unscreened members of other firms is hard to reconcile with that description unless the inspected area is a separable, controlled private space. That is an inference; the inspector decides.

Cleaners and maintenance staff are a recurring question. PSPC says employees, contractors and subcontractors such as cleaners must be cleared, or escorted at all times, when they enter security zones ^[6]. RCMP guidance for shared government workspace similarly expects third parties and contractors working in a user's private space to be escorted ^[28]. RCMP physical security guidance adds that where cleaning and maintenance take place during limited access hours, the custodian should be the contract authority ^[9]. In a managed workspace the provider usually controls cleaning and maintenance, which is why the premises checklist asks for written answers.

Storage levels

At Protected B, RCMP guidance lists a locked file cabinet or desk drawer when material is not in use ^[29], with an operations zone as the minimum zone ^[29].

Protected C and above move to RCMP-approved security containers in a security zone ^[29]. Security containers are RCMP-approved cabinets, cases, boxes or bags ^[29], and material should not share a container with valuables such as cash ^[29].

Protected B is information whose disclosure could reasonably be expected to cause serious injury outside the national interest ^[30].

Security orders and the CSO role

Organizations with a DSC must have security orders. As an inference, that places accountability on the tenant rather than the provider, which is a key reason a provider's marketing wording cannot substitute for the tenant's own inspection record. Clients, for their part, are responsible for confirming that everyone accessing the work sites has the appropriate security clearance ^[27].

Client-site work

When work happens at a government or client site, the contractor's own premises may not need a DSC. Individuals who need access to sensitive sites in the performance of their work must be security screened ^[13]. Client-site work also adds a CSO duty: coordinating with the client's security representative to brief employees working at client sites.

Task-by-Location Matrix

Table 2 below translates four tasks into workspace models. Every cell is conditional on the contract's SRCL and on CSP approval; none is a finding that a workspace type is allowed or prohibited.

The matrix shows one repeated pattern. Where the contract requires no sensitive material at the supplier's site, the workspace decision can reduce to ordinary commercial criteria. Where storage or electronic handling is required, the work moves into a site-by-site, contract-by-contract approval, and the cheapest membership may not be the cheapest path.

Premises Evidence Checklist and Questions for the Inspector

Premises evidence checklist

Sensitive work should not begin until the CSP confirms the required approval in writing ^[4]. The checklist below builds the evidence packet. Each item should have an owner and a written response, because a verbal assurance from a front desk is not evidence the CSP can rely on.

• Floor plan: a detailed plan showing rooms, doors and zones; the field officer requests one before inspecting.
• Access rights: who holds keys, keycards or master access. RCMP shared-space guidance notes access control is usually managed by the workspace provider ^[28] and makes screening of everyone granted access a joint responsibility of provider and user ^[28].
• Shared circulation: whether the route from street to the private room passes through public or reception zones ^[8], and whether access to tenant space from elevator lobbies is controlled ^[9].
• Visitors: how the provider logs and escorts visitors; shared-space guidance expects visitors to be pre-screened and escorted at all times inside security zones ^[28] and visitor logs to be retained securely for a defined period ^[28]; where escorts are not feasible, a temporary access badge must be issued to all visitors in government facilities ^[9].
• Cleaning and maintenance access: schedule, key control and whether staff can be escorted or cleared ^[28].
• Controlled storage: where an approved cabinet would sit, who owns it and whether the lease allows installing it ^[29].
• Door and alarm hardware: which changes the tenant may make; the CSP provides guidance on required access controls, and private spaces should be locked each time the user leaves ^[28].
• Tailgating and relaxed entry policies: shared-space guidance recommends access barriers that prevent tailgating ^[28] and acknowledges that some shared spaces have deliberately relaxed entry policies ^[28].
• Incident contact: a named provider contact for reporting loss or unexplained access to the tenant's CSO.
• Change notification: a lease clause requiring advance notice of moves, renovations or door-control changes, since the CSO must inform the CSP before any physical move or new construction.

By contrast, government tenants must establish documented arrangements such as lease or occupancy agreements that set out security requirements ^[13]; a contractor tenant can ask for equivalent written terms. RCMP guidance for shared Government of Canada workplaces is a useful vocabulary although it is not a contractor standard. It says a space provider must offer minimum security requirements based on the zones required ^[28], that most shared space will be treated as an operations zone environment ^[28], and that work is permitted only up to the categorization level the space was built for ^[28]. It is described as a guide for shared Government of Canada workplaces ^[28], so it should not be presented to a provider as a contractor requirement.

Questions to ask the inspector or CSP before paying for changes

• Does this contract's SRCL require storage at the supplier's site, or only access? Contracts can carry security requirements even when the contract documents themselves are not designated protected ^[25].
• Which zone does the proposed private room map to, and which provider-controlled areas lie outside it? Tenants determine appropriate zones within their own space ^[9], while in multi-tenant facilities a security committee coordinates custodian and tenant access-control requirements ^[9].
• Does the CSP accept a space where the tenant does not control building-wide access, and what compensating controls would it expect?
• Who pays and who owns equipment? PSPC says the organization pays for equipment or construction needed to safeguard information.
• Are scheduled and unscheduled inspector visits compatible with the provider's access rules? Such access is a normal condition of a contract with security requirements.
• Does the CSP see any issue with a virtual-office address as the registered address?

The manual also advises organizations to consult the CSP at an early stage when building, buying, leasing or renovating facilities ^[4]. That sentence is the closest official language to a workspace-selection rule, and it points to asking before signing.

IT and Remote-Work Approval Gates

IT authorization

PSPC states that IT security is required for organizations that access, store, save, process, transmit, view or back up protected or classified information electronically, and written CSP approval must precede electronic access ^[7]. A sample federal clause bars use of the contractor's own IT systems to electronically process protected information until the CSP gives written approval ^[7]. The IT inspection follows contract award and the physical requirements ^[19]. The CSO or alternate CSO completes a new checklist for each contract, and approvals are contract specific and valid for the life of the contract.

A VPN or a client-issued laptop therefore does not resolve site requirements by default. The Cyber Centre baseline controls recommend VPN connectivity with two-factor authentication for remote access ^[26], say organizations should never connect public Wi-Fi networks to corporate networks ^[26], advise avoiding public Wi-Fi for business needs where possible ^[32], and recommend automatic patching ^[26] and encrypted back-ups ^[26]. Those are baseline recommendations for small and medium organizations ^[26], not a substitute for CSP approval. The Cyber Centre also advises being mindful of physical security in a public or shared area ^[32], and shared-space guidance for government tenants recommends separate Wi-Fi networks for visitors and users ^[28].

Cloud services need a different route. The CSP does not assess or approve cloud solutions ^[18], and the Cyber Centre's assessment program defines a Cloud Medium baseline for services processing up to Protected B ^[33]. Cloud tools chosen by a small team should therefore be raised with the CSP early.

COVID-era wording to verify

The IT page still carries a note that DSC and IT inspections are currently done virtually ^[18] and that an organization may be subject to an on-site inspection to validate the security requirements ^[18]. The note remains on a page dated March 20, 2025, so current practice should be confirmed with the CSP rather than assumed.

Remote work and additional premises

The manual passages reviewed do not use the words telework, home or coworking; the closest rule is that any site with a document safeguarding requirement must be assessed and approved before work begins there. A 2020 law-firm bulletin reports that a contractor's CSP registration and Company Security Orders identify whether work from home is permissible ^[31], that remote work may be allowed if security requirements can still be met ^[31], and that the Client Technical Authority decides ^[31]; this is dated secondary commentary. RCMP guidance allows limited amounts of Protected A, B and Confidential material to be processed and stored at remote locations, with departments managing the risk ^[34], and says material should never be kept in personal residences or other unauthorized storage locations ^[29]. Those documents address government employees, not contractor coworking desks.

Subcontract flow-down

A freelancer working as a subcontractor sits inside the prime's approval chain. Federal policy requires contracts to extend applicable security requirements to any other entity involved in fulfilling them ^[13]. The prime must obtain CSP approval before awarding a subcontract with security requirements ^[35], a sample solicitation bars awarding such subcontracts without prior written CSP permission ^[7], and approval is needed at each successive level.

Under the simplest option, protected or classified information cannot be received or stored at the subcontractor's location ^[4], so a coworking desk would not host the sensitive part of that work.

Primes may in certain situations hold personnel screenings for subcontractor personnel, assessed case by case ^[17], and commentary notes the prime remains responsible for subcontractor compliance ^[5].

Budget, Lead Time and Decision Record

Budget worksheet

The cost of a compliant site is the membership quote plus documented security changes, approved IT, storage and any overlap between old and new space. The worksheet uses blanks on purpose: figures must come from written quotes with currency, tax treatment and quote date.

• Membership or lease quote: $____ per month, currency ____, taxes included or excluded ____, quote date ____, term ____ months.
• Documented security changes: $____ (door hardware, access control, alarm, partitions) per CSP recommendations, with provider written consent ____.
• Storage: $____ for approved cabinets or containers; the field officer assists in ordering RCMP-approved cabinets.
• IT approval work: $____ for network design, endpoint controls and consultant time; the CSP does not charge a fee for processing personnel screening requests.
• Overlap cost: $____ for months paying two locations while waiting for approval.
• Total scenario cost: the sum of the above, compared with contract value ____.

PSPC states that organizations should not sign a contract until they understand the implications and potential cost, and the same logic applies to a lease. There is no inspection fee, but equipment and construction costs fall on the organization.

Lead time

Published PSPC figures concern screening, not site inspection. PSPC says organization screening length depends on many factors and that personnel processing times begin once the CSP receives a properly completed request. A Crown corporation's guidance for exporters restates that processing takes anywhere from 7 to 120 business days for a properly completed request ^[36]. One federal tender notice reminds bidders to obtain the required clearance promptly ^[37]. Because no source reviewed publishes a site inspection duration, the worksheet carries a blank for it and a decision rule: no non-cancellable lease obligations before the CSP's written answer.

Decision record and escalation

Keep a dated decision record with six fields: contract and SRCL number; approvals required; premises evidence gathered; provider written answers; CSP question sent and answer received; decision and next review date. Escalate to the CSP when an evidence item is missing or the answer depends on inspector judgment. Organizations must keep the CSP informed of any changes following screening, so the record should also log later changes such as new work sites, ownership changes or moves.

Provider Comparison and Reference Figures

Provider comparison

Table 3 below compares the Montreal providers whose own pages were reviewed with one another. Provider rows are vendor claims, labelled by page date where one is printed, and are not endorsements or evidence of any security approval.

The main lesson is that the security vocabulary providers publish (keycards, secure Wi-Fi, enhanced protocols) is generic, while the CSP evaluates a floor plan, zones and access control. Provider terms vary by product and page, so a buyer should confirm in writing which minimum term applies to any quoted price. Regus also says a Regus address can often serve as a registered company location ^[46], a vendor statement that should be checked against the official address rules below. Virtual-office offers typically bundle an address for business documents and mail ^[39], and Spaces notes that mail forwarding and scanning may incur additional charges ^[47].

Screening periods and fees

The Contract Security Manual states that a DOS is valid for up to 2 years and an FSC for up to 1 year if the organization complies and nothing changes ^[4]. The Directive on Security Screening, effective January 6, 2025 ^[48], lists Top Secret clearance validity as 5 years ^[48]. PSPC's estimated organization screening timelines are up to 4 months for a DOS and 6 months or more for an FSC, and added safeguards extend them ^[10]; a PSPC page dated August 21, 2026 lists a current average of 50 business days for simple DOS requests against a target of 30 ^[49]. Commentary on the 2021 program changes reported that organizations would have until the date of contract award to obtain required clearances ^[22]. All of these are organization and personnel figures; no source reviewed publishes a site inspection duration.

Official address rules

Address rules are narrow. Corporations Canada says the registered office address of a federal corporation cannot be a post office box ^[50]. Quebec's enterprise register defines the domicile of a legal person as the head office address ^[51] and says a P.O. box cannot be given as a business address ^[51]. None of these sources states whether a staffed virtual-office address qualifies, so they set a floor, not a safe harbour.

Montreal market context

Montreal office conditions shape lease-length risk. Cushman & Wakefield reports Greater Montreal overall office vacancy of 16.7% in Q3 2026, down from 18.2% a year earlier ^[52], and CBRE reports 17.3% with a second consecutive quarterly decline ^[53]; the two use different measures and are not directly comparable. Cushman & Wakefield reports Central Class A average gross asking rent of $47.55 per square foot ^[52]. For audience context, the federal industry statistics tool counts 157,994 employer establishments in professional, scientific and technical services nationally ^[54], and ISED reports that more than half of Canada's small employer businesses are concentrated in Ontario and Quebec ^[55]. These are national and provincial context figures, not Montreal demand estimates.

Implications and Future Directions

For buyers, the main implication is sequencing. Read the SRCL and security clauses, ask the four questions, and only then tour space. Where the work is at a client site or involves no protected material at the supplier's location, the decision can be commercial. Where storage or electronic handling is required, the workspace becomes part of a regulated approval path, and the decision should be gated by the CSP's written answer.

For providers, the implication is documentation. A provider that can supply a floor plan, an access-rights description, visitor and maintenance procedures and a lease clause permitting approved security equipment makes the tenant's evidence packet easier, without claiming any approval on the tenant's behalf. RCMP's shared-space guidance already frames provider and user responsibilities for government tenants ^[28], which gives providers a vocabulary to borrow.

Several items may change. PSPC has published phased changes to its screening process and describes shorter processing times as targets; the Cyber Centre maintains a Cloud Medium assessment baseline ^[33]; and the COVID-era note on the IT page may be updated. Readers should recheck current PSPC pages before each bid, because the current manual took effect August 13, 2020 ^[2] and contract clauses refer to its latest edition.

Evidence gaps remain. No official source reviewed addresses coworking directly, and procurement advisers or incubators could usefully collect anonymised CSP answers on shared-office cases. Until such a body of answers exists, the best practice is the evidence packet described here.

Frequently Asked Questions (FAQs)

Can a federal contractor use a coworking space in Montreal?

It depends on the contract. If the SRCL and clauses require no storage or electronic handling at the supplier's site, the space may be a commercial decision. If they do, a DSC and IT approval attach to that exact site ^[4].

Can a facility security clearance be held in a shared office?

The clearance belongs to the organization ^[5], while the DSC belongs to a site and contract ^[5]. No source reviewed says a shared office is excluded or accepted; the inspector decides after reviewing the floor plan.

What are the Protected B storage requirements for a contractor office?

Minimum paper storage is a locked cabinet in an operations zone ^[29], and the operations zone is limited to appropriately screened personnel and escorted visitors ^[8].

Does designated organization screening cover coworking?

A DOS covers the organization at the Protected A or B level ^[7]; it does not approve a location. A DSC does that for storage ^[5].

Can a virtual office address be used?

A post office box is not recognized as an organization's address, and eligibility requires being physically located in Canada. A federal registered office also cannot be a post office box ^[50]. Ask the CSP in writing.

What do the French terms mean?

See the glossary above: Programme de sécurité des contrats, vérification d'organisation désignée, attestation de sécurité d'installation and autorisation de détenir des renseignements.

Does the requirement change for subcontractors?

Yes: the prime needs CSP approval before awarding a subcontract with security requirements ^[7].

Conclusion

A secure-looking office, a personal clearance or a provider's security claim does not substitute for the approvals the contract requires. The decision sequence is simple to state: start from the SRCL, identify whether the contract needs storage or electronic handling at the supplier's site, assemble the premises evidence, and put a written question to the CSP before committing money or a long term. Coworking neither passes nor fails by category; the specific room, the specific contract and the CSP's written confirmation decide. Readers should treat this report as a structure for that conversation, have a procurement or security specialist review their own matrix, and contact the CSP for case-specific answers.