Bill C-8 Is Law. Here's What Canadian CISOs Need to Know

For: CISOs, legal counsel, and risk and compliance folks

Let's be honest: most of us didn't get into cyber security because we love reading federal legislation. But Bill C-8 is one you'll want to know well.

On June 15, 2026, Bill C-8, An Act respecting cyber security, received Royal Assent. For the first time, Canada has a binding federal framework that tells operators of critical systems how they need to protect them. If you work in banking, telecom, energy or transportation, this affects you directly. Even if you don't, your clients or partners might be pulling you into it soon.

Here's a plain-language breakdown of what changed, what it could cost you, and what to do about it.

So, What Exactly Is Bill C-8?

Think of Bill C-8 as two laws in one.

Part 1 updates the Telecommunications Act. It makes security an official policy goal and gives Ottawa new powers to order telecom providers to act against threats. This part is already in force.

Part 2 creates a brand-new law called the Critical Cyber Systems Protection Act, or CCSPA. This is the big one. It will require "designated operators" in federally regulated sectors to run proper cyber security programs, manage supply chain risk and report incidents.

The catch? The CCSPA is being rolled out in phases, and the detailed regulations are expected to take 12 to 24 months. So the rules are on the books, but many of the specifics are still being written.

Our advice: don't treat that as breathing room. Treat it as a head start.

The Quick Version

If you only have 30 seconds, here's what you need to know:

1. Report incidents fast: within a deadline set by regulation, but never more than 72 hours
2. Report to the right people: the Communications Security Establishment (CSE) first, then your sector regulator right after
3. Fines are serious: up to $15 million per violation for organizations and $500,000 for individuals
4. Fines add up: every day a violation continues counts as a new violation
5. Who's covered: finance, telecom, energy and transportation, including nuclear and clearing and settlement systems

Let's Talk About the Money

This is the part that tends to get the board's attention.

Under the CCSPA, administrative monetary penalties can reach $15 million per violation for organizations. And because each day of a continuing violation is treated separately, a gap you leave unfixed for a week could turn into seven violations instead of one.

The Telecommunications Act changes come with their own penalties too: up to $10 million for organizations, rising to $15 million for repeat offences.

Some failures, like not having a cyber security program at all or ignoring supply chain risks, can even be treated as criminal offences. For individuals, that can include jail time.

And here's the piece that really changes the conversation: directors and officers can be held personally liable if they direct, authorize or take part in a violation. Cyber security is no longer something the board can hand off to IT and forget about.

"Wait, Doesn't PIPEDA Already Cover This?"

Good question, and the answer is: not quite. Bill C-8 does not replace PIPEDA. They sit side by side, and that's where things can get tricky.

Here's how they differ:

- PIPEDA is about personal information. You report breaches to the Privacy Commissioner "as soon as feasible" when there's a real risk of significant harm.
- The CCSPA is about critical systems. You report to the CSE within 72 hours or less, and the bar is lower. It covers any incident that interferes, or even may interfere, with a vital service or system.

So if a ransomware attack hits a bank and exposes customer data, the bank may need to file reports under both laws, on different timelines, to different agencies. Your legal and security teams should plan for this together, not separately.

What Should You Actually Do Now?

Here are four practical steps to get ahead of the regulations.

1. Get your 24/7 triage sorted

Seventy-two hours sounds like plenty of time until you factor in detection, investigation, escalation, legal review and sign-off. That clock moves fast.

You'll need a Security Operations Centre (SOC), whether in-house or through a managed provider, that runs around the clock and can quickly tell the difference between harmless noise and a reportable incident. Write down clear criteria for what counts as "reportable," set up escalation paths in advance, and run a few tabletop exercises. You don't want your first real report to also be your first practice run.

2. Take a hard look at your vendors

Supply chain attacks are still one of the most common ways attackers get in. Under the CCSPA, you're responsible for managing the risks that come from your vendors and managed service providers (MSPs), especially the ones with privileged access.

Start with a simple question: who has access to our critical systems? Build a full inventory, cut back access to only what's needed, require multi-factor authentication and add cyber security requirements to your contracts. Where you can, ask for independent proof, like SOC 2 reports, instead of taking a vendor's word for it.

3. Think about where your data lives

Data sovereignty isn't a specific requirement in Bill C-8, but it's coming up more and more in Canadian procurement conversations, especially in finance, telecom and the public sector.

Sit down with your procurement and legal teams and figure out where your critical data and systems are hosted, whose laws apply to them and whether Canadian-hosted options make more sense for your organization and your clients.

4. Get to know your regulator

Oversight under the CCSPA is shared among several regulators, including OSFI, the Bank of Canada, the Canadian Energy Regulator, the Canadian Nuclear Safety Commission, Transport Canada and Innovation, Science and Economic Development Canada. Figure out which one is likely to oversee you, keep an eye on their consultations and share your input where you can. It's much easier to shape the rules than to scramble after they land.

The Bottom Line

Bill C-8 is a big shift for Canadian cyber security. The detailed rules are still coming, but the direction is clear: mandatory security programs, tight reporting deadlines, accountability for your supply chain and real consequences when things go wrong.

The organizations that start now by tightening incident response, cleaning up vendor access and getting their boards involved will be in a much better spot than those that wait for the final regulations.

Compliance isn't just a legal box to tick. Done right, it's simply good, resilient business.

Need a hand getting your organization ready for Bill C-8? Get in touch with the DigitalXS team.

Thank you DigitalXS for their contribution to cybersecuritynews.ca. And their hosting.