REGULATORY REFERENCE · CANADA
Bill C-8, An Act respecting cyber security, received Royal Assent in June 2026. It amends the Telecommunications Act to make security an explicit policy objective and creates the Critical Cyber Systems Protection Act (CCSPA), which requires designated operators in finance, telecommunications, energy and transportation to protect the cyber systems that vital services depend on. This page summarises what the Act requires, who it applies to and what an operator should do now. It is updated as regulations are published. Last reviewed September 25, 2026.
Bill C-8 is Canadian federal legislation with two parts. Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as a policy objective and gives the Governor in Council and the Minister of Industry authority to direct telecommunications service providers to act against threats. Part 2 enacts the Critical Cyber Systems Protection Act. Bill C-8 replaced Bill C-26, which died on the order paper in January 2025.
The CCSPA applies to designated operators of vital services and vital systems in four federally regulated sectors: finance (banking and clearing and settlement), telecommunications, energy (interprovincial and international pipelines and power lines, and nuclear energy) and transportation. Operators are designated by regulation; the sector regulators are the Office of the Superintendent of Financial Institutions, the Bank of Canada, the Minister of Industry, the Canada Energy Regulator, the Canadian Nuclear Safety Commission and the Minister of Transport. The Canadian Centre for Cyber Security receives incident reports and the RCMP's National Cybercrime Coordination Unit supports enforcement.
Establish a cyber security program within the period set by regulation after designation, and keep it current. Identify and manage cyber security risks, including risks from the supply chain and from third party products and services. Protect critical cyber systems from being compromised. Detect cyber security incidents and minimise their impact. Report cyber security incidents to the Canadian Centre for Cyber Security; legal commentary describes a 72 hour window, to be confirmed by regulation. Notify the regulator of material changes such as ownership or third party products. Comply with cyber security directions issued by the Governor in Council. Keep records of all of the above.
The Act provides for administrative monetary penalties. Legal commentary on the bill cites maximums of $15,000,000 per violation per day for organizations and $500,000 per violation per day for individuals, with directors and officers potentially liable for non compliance. Final amounts and the enforcement scheme are set by regulation.
June 2025: Bill C-8 introduced in the House of Commons. June 2026: Royal Assent; Telecommunications Act amendments in force immediately. Following Royal Assent: CCSPA provisions come into force by order in council on a phased basis; regulations designating operators, setting the cyber security program deadline and the incident reporting window are being developed. This section is updated when Public Safety Canada publishes each step.
A cyber security program has to state what protects the critical cyber systems in scope, and for most operators the honest answer is encryption they have never inventoried: VPN tunnels, SCADA links, vendor connections and cloud paths using classical public key algorithms that a large enough quantum computer breaks. Under the Act's own logic, every third party tunnel is a supply chain risk, and harvest now, decrypt later is an incident that has already started. Canada's ITSM.40.001 roadmap sets the federal migration dates (high priority systems by 2031, all systems by 2035) and expects vulnerable algorithms to be disabled, isolated or tunnelled. A program a regulator can inspect therefore needs a cryptographic inventory, a migration roadmap and evidence that keys are managed.
Confirm whether you are likely to be designated and which regulator you answer to. Inventory the cryptography on your critical cyber systems before the regulations land, because everything else in the program depends on it. Fix the transport first: quantum-safe keys can be delivered into the firewalls and VPNs you already run without replacing them. Put continuous monitoring and an evidence pack in place so incident reporting and record keeping are outputs of operations rather than projects. Fabric Networks delivers each of these as Detect, Protect, Comply and Scale; see the Discovery Program.
Public Safety Canada, Government of Canada Strengthens Cyber Security and Critical Infrastructure with Royal Assent of Bill C-8, June 16, 2026: https://www.canada.ca/en/public-safety-canada/news/2026/06/government-of-canada-strengthens-cyber-security-and-critical-infrastructure-with-royal-assent-of-bill-c8.html . Parliament of Canada, Bill C-8 text and status: https://www.parl.ca/legisinfo/ . Public Safety Canada, Critical Infrastructure: https://www.publicsafety.gc.ca/cnt/ntnl-scrt/crtcl-nfrstrctr/index-en.aspx . Public Safety Canada, National Strategy for Critical Infrastructure (2009): https://www.publicsafety.gc.ca/cnt/rsrcs/pblctns/srtg-crtcl-nfrstrctr/index-en.aspx . Penalty and reporting figures are from Borden Ladner Gervais commentary on the bill and will be replaced with the regulation text when published.
Start with an inventory: the Discovery Program