As cyber threats continue to escalate in frequency, scope, and
sophistication, Canada is preparing to respond by implementing a
sweeping new regulatory framework. The framework is set out in An Act respecting cyber security, amending the
Telecommunications Act and making consequential amendments to other
Acts ("Bill C-8"),1
and is set to fundamentally reshape the compliance landscape for
organizations operating in federally regulated critical
infrastructure sectors.
Bill C-8 will enact the Critical Cyber Systems Protection
Act ("CCSPA") to establish a
comprehensive framework for the protection of "critical cyber
systems" in key sectors such as banking, telecommunications,
energy, transportation, nuclear, and clearing and settlement
systems. It will simultaneously amend the Telecommunications
Act, making the security of Canada's telecommunications
system a central policy objective.2 In this blog, we
break down the main components of the CCSPA, highlighting the
