Canada’s Bill C-8 Raises the Stakes for Critical Infrastructure Cybersecurity

Canada’s critical infrastructure cybersecurity rules are becoming more explicit — and more enforceable. Historically, these organizations have navigated a patchwork of sector-specific requirements, privacy breach reporting rules, regulator guidance, and voluntary frameworks. Bill C-8 raises the stakes by creating statutory cybersecurity obligations for designated operators of critical cyber systems.  

Bill C-8 amends the Telecommunications Act and creates the new Critical Cyber Systems Protection Act (CCSPA). Together, these changes give the government new authority to oversee cybersecurity across telecommunications and designated federally regulated sectors, such as banks and financial market infrastructure, energy and pipeline operators, transportation providers, nuclear operators, and the suppliers that support these critical systems.

While many implementation details are still to come, Bill C-8 makes Canada’s policy direction clear: affected organizations will be expected to take measurable cybersecurity action that goes beyond standard compliance frameworks. 

Five Changes That Matter 

Bill C-8 introduces several important changes for organizations that operate critical systems or provide federally regulated services. 

1. Telecom security is now a national priority. 
   The Telecommunications Act elevates the security of Canada’s telecommunications system as a core policy objective. The federal government can now issue orders requiring telecom providers to remove, stop using, or place conditions on certain products, services, suppliers, or systems if they pose a security risk. 
2. The government can order cybersecurity action, not just recommend it. 
   Under the new CCSPA, the Governor in Council can direct designated operators to take specific measures to protect critical cyber systems. These directions may apply to individual organizations or entire classes of operators and could require operators to implement protective measures, remediate risks, change processes, or document compliance within specified timelines. 
3. Third-party and supply chain cyber risks now require mitigation, not just assessment.  
   Bill C-8 requires designated operators to identify and manage cyber risks associated with both their supply chain and their use of third-party products and services. Once a supply chain or third-party risk is identified, the bill says operators must mitigate it “as soon as” it is identified. 
4. A 72-hour incident reporting clock is coming. 
   Designated operators must report cybersecurity incidents affecting critical cyber systems to the Communications Security Establishment within a timeframe set by regulation, not exceeding 72 hours. Importantly, “incident” means more than a breach; it may include events that affect or may affect system confidentiality, integrity, availability, continuity, or security. Bill C-8 also does not replace existing Canadian breach obligations, including PIPEDA where applicable.  
5. Cyber programs must be documented, implemented, and provable. 
   Designated operators that own, control, or operate critical cyber systems must establish, maintain, and periodically review a cybersecurity program. Required within 90 days of designation, these programs must address risk identification, system protection, incident detection, incident impact reduction, and supply chain risk. 

The bill also introduces inspection powers, internal audit requirements, compliance orders, administrative monetary penalties, and potential offences for non-compliance. Penalties under the new critical cyber systems regime may reach up to $15 million for organizations.

Five Questions to Assess Readiness Now  

Bill C-8 does not mean every organization will be subject to the same requirements on day one. However, companies that may fall within scope should begin evaluating readiness now. The most mature organizations will be able to answer with evidence, not assumptions. 

1. Are we in scope? 
   Bill C-8 identifies vital services and systems including telecommunications services, power line systems, nuclear energy systems, transportation systems, banking systems, and clearing and settlement systems. The specific operator classes and regulators will depend on Schedule 2 designations, regulations, and future orders, but organizations in or supporting these sectors should begin preparing now rather than waiting for final designation. Multinational organizations should also account for overlapping obligations under CIRCIA, NIS2, UK NIS, and other regulatory authorities. 
2. Can we identify the systems that matter most? 
   Bill C-8 focuses on critical cyber systems — systems whose compromise could affect the continuity or security of a vital service. Organizations should begin mapping the systems that support essential operations, including dependencies across IT, cloud, operational technology, third parties, and business processes. The key question is not just what systems exist, but which ones could disrupt continuity, safety, or security if compromised.  
3. Is our cybersecurity program regulator-ready? 
   The CCSPA requires designated operators to establish, implement, maintain, periodically review, and amend cybersecurity programs if needed. That raises the bar from having a documented program to being able to show that the program operates in practice. Organizations should assess whether they have evidence that controls are tested, gaps are identified, remediation is tracked, and program improvements are made as threats, systems, and dependencies change. 
4. Can we quickly assess and report more than just breaches? 
   The 72-hour reporting clock may apply to more than data breaches. Ransomware, service disruption, integrity issues, availability impacts, operational technology events, and supplier-originated incidents may all require rapid assessment. Organizations should test whether they can quickly determine what happened, whether critical systems or vital services are affected, who must be notified, and what evidence is needed to support reporting decisions.  
5. Can our third-party risk program move from identification to mitigation? 
   Bill C-8 requires designated operators to mitigate supply chain and third-party cyber risks as soon as they are identified. Organizations should assess whether they can identify critical vendors, tier them by operational importance, monitor cyber risk continuously, enforce remediation, and plan for supplier compromise, outage, or forced replacement. For many organizations, this may require revisiting contracts to include cybersecurity obligations, audit rights, incident-notification requirements, and remediation commitments.   

How BlueVoyant Operationalizes C-8 Requirements  

Bill C-8 readiness requires more than documented policies. Organizations need operational capabilities to detect incidents quickly, manage supplier risk continuously, validate controls, and produce evidence that their cybersecurity program is working. 

Don’t Wait for Designation  

Many implementation details are still to come, but critical infrastructure operators should not wait to prepare. The best first steps are to understand whether you may be in scope, identify your critical cyber systems, assess your current program documentation, strengthen third-party risk mitigation, and prepare for rapid incident reporting.  

For organizations operating across borders, Bill C-8 should also be integrated into a broader cyber regulatory strategy. Reporting timelines may look familiar across Canada, the U.S., the EU, and the UK, but the details will vary, and incident response teams need to know what must be reported, to whom, and when. 

As Bill C-8 moves forward, organizations should prepare for a world where cybersecurity obligations are not only defined, but monitored, tested, and enforced. 

Global organizations are preparing for third-party risk compliance standards that demand continuous action — not just periodic assessment. Join us for “The Third-Party Gap Most Organizations Haven’t Closed,” a live webinar on July 21, to learn how to strengthen compliance readiness and get ahead of risk.