Canada's Critical Cyber Systems Protection Act is coming. Make sure your organization is prepared.
The Critical Cyber Systems Protection Act (CCSPA), introduced through Bill C-26 and now carried forward as Bill C-8, represents the most significant Canadian cybersecurity legislation in a generation. It establishes mandatory cybersecurity obligations for operators of critical infrastructure across federally regulated sectors.
For the first time, Canadian law will require designated operators to establish formal cybersecurity programs, report incidents to the Communications Security Establishment (CSE), manage supply chain cyber risks, and comply with government directives — or face severe financial penalties.
The CCSPA applies to operators in six federally regulated critical infrastructure sectors.
Telecom service providers and network operators
Interprovincial/international pipeline and power line systems
Banks and clearing and settlement systems
Federally regulated transportation systems
Nuclear energy systems and facilities
Other critical services within federal jurisdiction vital to national security
The CCSPA imposes five core obligations on designated operators.
Designated operators must establish and implement a formal cybersecurity program within 90 days of being classified. The program must identify and manage organizational cyber risks, protect critical cyber systems, and detect cybersecurity incidents.
Operators must immediately report cybersecurity incidents affecting their critical systems to the Communications Security Establishment (CSE) and their appropriate industry regulator. A “cybersecurity incident” includes any act, omission, or circumstance that interferes with the continuity, confidentiality, integrity, or availability of critical systems.
Operators must identify and manage cybersecurity risks associated with their supply chain and the use of third-party products and services. If a supply chain risk is identified, operators must take reasonable steps to mitigate it and notify their regulator of material changes.
The Governor in Council may issue cybersecurity directions to designated operators to protect critical cyber systems. The Minister of Public Safety may also issue orders requiring operators to take specific actions, including ceasing use of specified products or services.
Operators must keep records related to their cybersecurity program and make them available to regulators upon request. Regulators can conduct audits and compliance reviews of designated operators’ cybersecurity programs.
The CCSPA establishes significant penalties for non-compliance. Each day a violation continues constitutes a separate offence.
Our existing threat intelligence capabilities map directly to CCSPA requirements.
24/7 monitoring across 10+ intelligence sources, automated IOC tracking, and security posture scoring for your domains and assets.
Real-time breach detection, credential exposure monitoring, and automated alerting via Slack, email, and webhooks to support rapid incident identification.
Domain security scoring, exposure scanning, vulnerability detection, and SSL/DNS/header analysis to identify and quantify your risk surface.
STIX/TAXII feeds, IOC export, and vendor comparison tools to assess and monitor the security posture of your supply chain partners.
PDF security reports, historical threat data, IOC logs, and white-label documentation to support compliance record-keeping and regulatory audits.
Purpose-built packages to help your organization meet CCSPA requirements. All plans include our core threat intelligence platform.
Answer 8 questions to gauge your organization’s preparedness for CCSPA requirements. Takes less than 2 minutes.
Organizations that start preparing now will be in the strongest position when the CCSPA takes effect. Let us help you build a compliance-ready cybersecurity posture.