National Strategy for Critical Infrastructure: The Foundation Document Behind Canada's CI Policy

The National Strategy for Critical Infrastructure, published by Public Safety Canada in 2009, is the foundation document for how Canada thinks about critical infrastructure. It defines critical infrastructure as the processes, systems, facilities, technologies, networks, assets and services essential to the health, safety, security or economic well being of Canadians and the effective functioning of government, and it classifies it into ten sectors: energy and utilities, finance, food, transportation, government, information and communication technology, health, water, safety and manufacturing.

The strategy sets three objectives: build partnerships through sector networks and a National Cross Sector Forum, implement an all hazards risk management approach that covers natural, accidental and intentional hazards, and advance the timely sharing and protection of information. It is explicit that owners and operators bear the primary responsibility for protecting their assets and services, that first response is almost always local, and that resilience is achieved through a combination of security measures, business continuity practices and emergency management planning. It also notes that the risks from interdependencies are compounded by society's increasing reliance on information technologies. Public Safety has since consulted on renewing the approach and, in June 2026, Bill C-8 gave the owner and operator responsibility a statutory footing for four of the ten sectors.

Our take

Seventeen years on, three lines in this document still do the heavy lifting. Owners and operators bear the primary responsibility. The hazards are all hazards, including intentional ones. And interdependency is where the cascading failures come from. Cryptography is the interdependency nobody drew on the sector map: the same handful of public key algorithms secure the energy SCADA link, the bank's settlement traffic, the carrier's backhaul and the water utility's remote access, and a large enough quantum computer breaks all of them at once. An all hazards approach that does not include harvest now, decrypt later is not all hazards. The strategy asked operators to understand their risks and interdependencies before managing them. For encryption that means an inventory of every cipher, key and certificate on the wire, which is where every Fabric engagement starts.