On June 15, 2026, Bill C-8, An Act respecting cyber security, received Royal Assent. It amends the Telecommunications Act and creates the Critical Cyber Systems Protection Act (CCSPA).

What the law does

– Telecommunications Act changes took effect immediately, making the security of Canada’s telecommunications system an explicit policy objective.

– The CCSPA sets mandatory cybersecurity requirements for “designated operators” of critical cyber systems in federally regulated sectors: finance, telecommunications, energy, and transportation.

– Phased implementation: the Act comes into force gradually, and operators are designated through regulation. As of our review, no operator classes had yet been designated.

Typical obligations for designated operators

– Establish and maintain a cybersecurity program

– Identify and manage risks, including supply chain and third-party risk

– Protect critical cyber systems and detect incidents

– Minimize the impact of incidents

– Report cybersecurity incidents to the Communications Security Establishment (through the Cyber Centre) within a period set by regulation, which cannot exceed 72 hours

– Comply with cybersecurity directions issued by government

Different regulators oversee different sectors, such as OSFI for banking, the Canadian Energy Regulator for interprovincial pipelines and power lines, the Bank of Canada for clearing and settlement systems, and others.

Why smaller businesses should still pay attention

– Suppliers and service providers to designated operators may face contract requirements flowing down from them, including security controls and incident reporting

– The standard sets expectations that insurers, customers, and regulators may adopt more widely

– Managed service providers that support critical sectors need strong, documented security

What to do now

1. Find out if you serve finance, telecom, energy, or transport customers

2. Ask customers about expected security terms

3. Strengthen basics: MFA, patching, backups, logging, and an incident response plan

4. Map your third-party dependencies

5. Watch for regulations that designate operators and set details

Sources:
https://www.publicsafety.gc.ca/cnt/trnsprnc/brfng-mtrls/prlmntry-bndrs/20260306-1/index-en.aspx#a4
https://www.canada.ca/en/public-safety-canada/news/2026/06/government-of-canada-strengthens-cyber-security-and-critical-infrastructure-with-royal-assent-of-bill-c8.html

DBR Soft can help suppliers to regulated sectors prepare for flow-down security requirements. Contact us for more information.