Protecting Critical Infrastructure: Preparing for Bill C-26 and Canada’s New Cyber Rules

The Wake-Up Call for Critical Infrastructure

May 2024. A major Canadian pharmacy chain was hit by ransomware. Seventy-nine stores closed. Vital prescriptions went unfilled. Employee data was leaked.

October 2023. The Toronto Public Library the busiest urban library system in the world had its systems encrypted. It took four months to recover.

March 2024. The City of Hamilton lost multiple online services to ransomware. Critical systems weren’t affected this time. But the warning was clear.

November 2020. The City of Saint John disconnected itself from the entire world. A ransomware attack forced them to build a completely new network from scratch. The city manager’s warning still echoes: “It is no longer a question of ‘if’ a corporation or entity will be attacked, but rather ‘when.'”

Bill C-26 is the government’s response.

What Is Bill C-26? (The Non-Technical Overview)

Bill C-26, An Act respecting cyber security, is actually two complementary legislative initiatives in one package.

While Bill C-26 died on the order paper during the 2025 parliamentary prorogation, a substantially similar bill—Bill C-8—was introduced in June 2025 and is now proceeding through Parliament.
The core requirements remain consistent. This is coming.

Who Is Affected?

The CCSPA applies to “designated operators” in federally regulated sectors that provide “vital services” or operate “vital systems.”

The Governor in Council can add or remove services and systems over time. Health systems have already been flagged as a potential future addition.

What Are the Key Requirements?

Designated operators must:

Incident Reporting Timeline

The proposed reporting requirement is 72 hours from the time the operator detects the incident.
This aligns with U.S. standards and is meant to enable “one organization’s detection another’s prevention.”

Penalties for Non-Compliance

These are administrative monetary penalties separate from other legal liability.

The Four Pillars of Compliance

Pillar 1: Cybersecurity Program

The CCSPA requires a cybersecurity program including steps to:

This is not a one-time exercise. The program must be maintained, updated, and effective.

Pillar 2: Supply Chain and Third-Party Risk Management

The CCSPA explicitly focuses on supply chain risk. Designated operators must notify regulators of material changes and mitigate risks in third-party relationships.

Pillar 3: Incident Reporting

The 72-hour reporting requirement is designed to give the Canadian Centre for Cyber Security real-time visibility.

Be ready to report:

• Nature of the incident
• Systems affected
• Impact on operations
• Steps taken to respond
• Threat actor information (if known)

Why it matters: the government can provide timely threat intel and mitigations to help other operators.

Pillar 4: Record-Keeping

Records related to your cybersecurity program and incidents must be kept in Canada. This impacts global tooling and cloud providers your data must remain on Canadian soil.

The Telecommunications Angle: High-Risk Suppliers

Part 1 amends the Telecommunications Act to add security as a key policy objective, enabling the government to:

• Prohibit use of products/services from certain entities
• Require network/facility reviews
• Mandate security plans

Real-world impact: explicit authority to address high-risk suppliers like Huawei and ZTE.

For telecom operators, expect:

• Potential requirements to remove/replace equipment
• Increased scrutiny of supply chain decisions
• New compliance obligations around network security

The Compliance Timeline: When Does This Happen?

The CCSPA comes into force on a day (or days) fixed by order. Regulations will follow a consultative process.

The NIST Connection: A Ready-Made Framework

The CCSPA doesn’t prescribe a specific framework. The clear answer: NIST CSF 2.0.

NIST CSF 2.0 is structured around six core functions:

The new Govern function is particularly relevant: it covers supply chain risk management, roles and responsibilities, policy, oversight, and continuous improvement.

Other Relevant Frameworks

The key is not which framework you choose it’s that you choose one and implement it consistently.

What This Means for Your Organization

For CEOs and Boards

For CISOs and Security Leaders

For Compliance Officers

For IT and Operations

The 12-Month Preparedness Roadmap

This roadmap keeps you moving regardless of regulatory timelines.

The 5 Things You Can Do Right Now

1. Know Your Critical Cyber Systems

You cannot protect what you don’t know. Start with an inventory of:

• Systems that could impact vital services if compromised
• Supporting infrastructure (IT, OT, cloud)
• Dependencies and interconnections

2. Map Against NIST CSF 2.0

Use NIST CSF 2.0 as a self-assessment tool. For each function, ask:

• Do we have this capability?
• Is it documented?
• Is it tested?
• Can we prove it?

3. Document Your Program

The CCSPA requires a formal cybersecurity program not just controls. That means:

• Written policies and procedures
• Assigned roles and responsibilities
• Regular review and updates
• Evidence of implementation

4. Assess Your Supply Chain

Start building your vendor risk management program:

• Inventory third parties with access to systems or data
• Assess their security posture
• Require security controls contractually
• Monitor for material changes

5. Test Your Incident Response

The 72-hour clock starts when you detect an incident. Test your ability to detect, assess impact, report on time, and document everything.

How Canadian Cyber Helps

Canadian Cyber’s SharePoint ISMS platform gives you the structure to build CCSPA compliance that lasts.

The 15-Minute Readiness Assessment

You don’t need to guess whether your organization is ready for Canada’s new cyber rules.

We’ll tell you:

• Which CCSPA requirements you already satisfy (most organizations are 30–40% there without knowing it)
• Where your biggest gaps are (based on the proposed framework)
• One thing you can do this week to move toward compliance

The Question Every Leader Must Answer

For most operators in finance, telecom, energy, and transportation, the honest answer is “no” or “I’m not sure.”

• The regulations are coming, but they’re not here yet.
• The requirements are clear, even if the details aren’t final.
• The frameworks exist (NIST CSF 2.0, CIS, ISO 27001).
• The time to act is now.

Be the former. Use the runway.

Conclusion: From Uncertainty to Readiness

Bill C-26 represents a fundamental shift in how Canada protects its critical infrastructure.

• Mandatory cybersecurity programs will become the norm.
• Supply chain risk will be regulated.
• Incident reporting will be required.
• Government directions will compel action.

This is not overreach. It is response response to a threat environment that has already demonstrated its ability to disrupt essential services, compromise sensitive data, and threaten public safety.

Follow Canadian Cyber

Get practical playbooks, audit-readiness tips, and compliance workflows.