Canada Launches Its First National Water Security Strategy

On World Water Day, March 22, 2026, the Canada Water Agency announced the start of work on Canada's first National Water Security Strategy, under the Honourable Julie Dabrusin, Minister of Environment, Climate Change and Nature. The Agency will develop the strategy with provinces and territories, First Nations, Inuit and Métis partners, stakeholders across sectors and the public, with engagement timelines to be announced. It builds on the Government of Canada's $650 million, ten year Freshwater Action Plan. The release lists the water challenges the strategy is meant to address: droughts, floods, pollution, wildfires, aging critical water infrastructure, groundwater stress, permafrost degradation and algal blooms. A companion page on the Agency's site carries a public survey on freshwater security priorities.

What the release does not say

Nothing in the announcement mentions cyber security, control systems, telecommunications or digital infrastructure. The strategy is a freshwater policy exercise, and the Freshwater Action Plan funds watershed management and restoration, not utility networks. Readers should not treat this as a requirement, a mandate or a funding source for security work. The only infrastructure reference is the phrase "aging critical water infrastructure" in the list of challenges.

Our take

Water and wastewater is one of the ten critical infrastructure sectors in Public Safety Canada's National Strategy for Critical Infrastructure, and it is the one that is almost entirely municipal. Treatment plants, pumping stations and distribution networks run on SCADA and telemetry that is often older than the staff who operate it, connected over VPN tunnels and radio links whose encryption was chosen years ago. Aging infrastructure is not only pipes.

Water was left out of the first wave of designated sectors under Bill C-8, which covers finance, telecommunications, energy and transport. That means no regulator is asking a water utility today what cryptography protects its control systems or how long that protection will last. It also means a strategy that sets out to define water security for a generation will be doing so in the same period that federal guidance (ITSM.40.001) moves government systems to post-quantum cryptography and Bill C-8 regulations are written. It would be strange for water security to end without a line on the security of the systems that deliver water.

Fabric's suggestion to utilities and municipalities: use the engagement window. When the Canada Water Agency opens consultation, say that water security includes the systems that run water, and ask that the strategy recognise cyber resilience and cryptographic hygiene as part of infrastructure renewal. Separately, know what is on your own network before anyone asks. A cryptographic inventory of a treatment plant takes weeks, not years, and it is the first line in any future compliance conversation. Detect first.

Fabric Networks intends to make a submission when engagement opens. If your utility would like to see it or co-sign it, contact us.