On June 15, 2026, Bill C-8, An Act respecting cyber security, received Royal Assent. It's the law that Ottawa first tried to pass as Bill C-26, and it creates Canada's first cyber security rules for critical infrastructure.
If you run a 40-person business, the law almost certainly doesn't name you. It may still change what your largest customers expect from you.
What passed
The Act does two things:
- It amends the Telecommunications Act to make security an explicit objective and give the government powers to compel action against threats to Canada's telecom networks. That part took effect immediately.
- It creates the Critical Cyber Systems Protection Act, which applies to "designated operators" in federally regulated sectors. Public Safety Canada describes these as the finance, telecommunications, energy and transportation sectors.
What designated operators must do
Once designated, an operator has 90 days to establish a cyber security program. Under the Act, that program must identify and manage cyber risks, including risks from the operator's supply chain and its use of third-party products and services. Operators must also report cyber security incidents to the Communications Security Establishment within a period set by regulation, which can't exceed 72 hours.
When it starts
Not yet. Public Safety Canada says the new Act will be implemented gradually, with provisions coming into force in phases on dates set by the federal cabinet. The classes of designated operators are added by order, published in the Canada Gazette. When we wrote this, no start date had been announced.
Why it reaches smaller businesses
Look again at that supply-chain duty. A bank, a telecom carrier, a pipeline operator or a federally regulated transport company will have to show its regulator that it manages the cyber risk its suppliers bring. The practical way to do that is to ask suppliers.
So if you sell services, software, support or parts to a federally regulated organization, expect:
- longer and more detailed security questionnaires
- contract clauses requiring you to tell them quickly about an incident, so they can meet their own reporting deadline
- requests for evidence: monitoring, incident response plans and how you protect accounts
None of this has to wait for the regulations. Large buyers often start asking well before the rules formally apply.
What to do now
- List your federally regulated customers. Banks, telcos, energy and transport companies are the ones to watch.
- Write a short incident response plan. Who decides, who you call, and how fast you can tell a customer something has happened.
- Be able to show 24/7 monitoring on your computers and Microsoft 365 or Google accounts. "We have antivirus" no longer answers the question.
- Keep a list of your own suppliers and what access they have to your systems.
How we help
Managed EDR and Managed ITDR give you round-the-clock monitoring of computers and accounts, with a monthly summary you can hand to a customer. A security assessment shows where you stand before a regulated customer asks, and what to fix first.
Received a questionnaire that mentions Bill C-8? Book a security call.