Bill C-8: Canada revives its critical infrastructure cyber security law

Update 2026-06-17: Bill C-8 received royal assent on 2026-06-15. See Bill C-8 is law: what changes now.

On 2025-06-18, the federal government introduced Bill C-8, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts (LEGISinfo). It revives the critical infrastructure cyber security framework first proposed in Bill C-26, which died on the Order Paper when Parliament was prorogued in January 2025.

If your organization operates in banking, telecommunications, energy or federally regulated transportation, this bill is aimed at you. If you sell technology or services to those organizations, it will reach you through your contracts.

Two parts

Part 1: Telecommunications Act

Part 1 adds the security of the Canadian telecommunications system as a policy objective and gives the government power to order telecommunications service providers to stop using products or services from specified suppliers, or to take other measures to secure their networks (BLG).

Part 2: the Critical Cyber Systems Protection Act

Part 2 enacts the Critical Cyber Systems Protection Act (CCSPA). It applies to “designated operators” in sectors that provide vital services and systems under federal jurisdiction, including telecommunications, interprovincial and international pipelines and power lines, nuclear energy, federally regulated transportation, banking, and clearing and settlement systems (bill text).

What designated operators would have to do

• Establish a cyber security program covering how they identify and manage risks, protect their critical cyber systems, detect incidents and minimize their impact.
• Manage supply chain and third-party risk, including risks from the products and services they buy.
• Report cyber security incidents to the Communications Security Establishment (through the Canadian Centre for Cyber Security) within 72 hours (BLG).
• Comply with cyber security directions issued by the government, which may be confidential.
• Keep records about their program, incidents and the steps taken, and notify their regulator of material changes such as ownership, control or key suppliers.

Sector regulators, such as the Superintendent of Financial Institutions and the Bank of Canada, would oversee compliance. Penalties proposed in the bill reach up to $15 million per violation for organizations and $500,000 for individuals, per day of continuing violation, and directors and officers can be personally liable (BLG).

Why suppliers should pay attention

Operators cannot meet a third-party risk obligation without asking their suppliers for evidence. In practice, this means more security questionnaires, contract clauses on incident notification and audits, and requests for independent reports such as SOC 2 or ISO 27001. Federally regulated financial institutions already face similar expectations under OSFI Guidelines B-10 and B-13.

What to do now

• Find out whether your organization, or your largest clients, could be designated.
• Check whether you could detect, assess and report a significant incident within 72 hours.
• Build a reusable evidence pack: policies, risk assessment, incident response plan and an independent report. See answering security questionnaires without starting from zero.

The bill must still pass both Houses. Accel GRC helps organizations structure the program and evidence regulators and clients will ask for. Contact us.

Sources

• Parliament of Canada, LEGISinfo: Bill C-8 (45-1)
• Bill C-8, first reading text
• BLG: Bill C-8 revives Canadian cyber security reform