Bill C‑8 · CCSPA
CCSPA (Bill C‑8) readiness for designated operators
Readiness assessment, a cyber security program and 72-hour reporting workflows for designated operators, built before the Act applies to you.
ABOUT THE ACT
WHAT BILL C‑8 CREATES
Bill C‑8 — An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts — received Royal Assent on June 15, 2026 (S.C. 2026, c. 9).
Part 2 creates the Critical Cyber Systems Protection Act (CCSPA): mandatory cyber security obligations for designated operators of vital systems in finance, telecommunications, energy and transportation.
WHAT APPLIES TODAY, AND TO WHOM
The amendments to the Telecommunications Act took effect immediately on Royal Assent. The CCSPA itself has not: its provisions come into force on a day or days fixed by order of the Governor in Council, and no such order had been published as of October 2026. That gap, passed but not yet binding, is the window to get ready before the clock starts.
Once it is in force, designated operators will have to establish a cyber security program within 90 days of designation — not 90 days from when they start building one.
ALREADY IN FORCE
The amendments to the Telecommunications Act took effect immediately on Royal Assent, June 15, 2026.
NOT YET IN FORCE
The Critical Cyber Systems Protection Act — the cyber security program, the 72-hour incident reporting, the supply chain risk obligations, the recordkeeping — comes into force through a phased approach. At the time of writing, no commencement order for CCSPA’s provisions had been published.
WHO CCSPA REACHES
The Act’s vital services and systems span telecommunications, pipelines and power lines, nuclear energy, transportation, banking, and clearing and settlement.
DESIGNATED, NOT AUTOMATIC
Within those sectors, the Governor in Council designates specific classes of operators by adding them to Schedule 2 by order. Schedule 2 lists no classes yet, so being in one of these industries does not put you in scope; designation does.
Getting ready before designation
Readiness assessment
Mapping your current controls against CCSPA’s obligations — cyber security program, incident detection, supply chain risk — before you’re a designated operator, not after.
Cyber security program design
Built on the same structure as an ISO 27001 ISMS, so the program CCSPA requires doesn’t start from a blank page.
Supply chain and third-party risk
CCSPA makes supply chain risk an explicit obligation; we assess vendor exposure against established third-party risk expectations such as OSFI’s B‑10 guideline.
72-hour incident reporting readiness
A workflow that gets a reportable incident classified and escalated inside the window CCSPA will set, rehearsed before it’s needed.
Recordkeeping design
Structured so the records CCSPA requires, kept in Canada, exist as a byproduct of how you already work, not a separate compliance task.
Evidence pack
Everything documented for the appropriate regulator once your class of operators is added to Schedule 2.
A readiness assessment now means the 90-day window after designation goes on implementation, not discovery.
Is the Critical Cyber Systems Protection Act in force yet?
No. Bill C‑8 received Royal Assent on June 15, 2026, but none of the CCSPA’s provisions are in force yet: they come into force on a day or days fixed by order of the Governor in Council, and no such order had been published at the time of writing. The Telecommunications Act amendments in Part 1 took effect immediately.
Who counts as a designated operator?
Operators of vital services and systems in telecommunications, interprovincial and international pipelines and power lines, nuclear energy, federally regulated transportation, banking, and clearing and settlement — but designation is specific, made by schedule and order, not automatic for every company in those sectors.
What is the 72-hour obligation?
Once CCSPA is in force, designated operators will have to report a cyber security incident to the Communications Security Establishment within a period set by regulation, not to exceed 72 hours, and then immediately notify their regulator. The cyber security program will be due within 90 days of designation.
Are the CCSPA penalties already enforceable?
No. There is nothing to enforce until the relevant provisions come into force. When they do, the Act will allow administrative monetary penalties of up to $15 million for an organization and up to $500,000 for an individual.
Do you have Canadian clients?
Yes. We have worked with clients in Canada, and under NDA we cannot name them.
Our certificates
Team portfolio
Where to start?
You can copy our materials only after making sure that your services are safe.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.