Bill C-8 · Critical Cyber Systems Protection Act
Bill C-8 is law. Here's what's settled, and what's coming.
Bill C-8 became law in June 2026. Its telecom provisions are already in force, and the Critical Cyber Systems Protection Act will be brought into force in phases. Much of what it will require is already settled in the Act itself.
Book a C-8 Readiness BriefingWhat's settled
What the Act already sets out
Who
Federally regulated operators of vital services in telecom, interprovincial and international pipelines and power lines, nuclear, federally regulated transportation, banking, and clearing and settlement.
How fast
Once designated, operators have 90 days to stand up a documented cyber security program. That window is written into the Act.
Reporting
Incidents go to the Communications Security Establishment within a period set by regulation, no longer than 72 hours.
Records and accountability
Records kept in Canada, supply-chain and third-party risk managed, and directors and officers accountable for violations.
What's coming
The sector regulations are being drafted now, and designations will follow. When they land, the 90 days start immediately. The organizations best placed will be the ones that start preparing before designation.
Read more
Our Bill C-8 writing
Want to see where you stand? Get the C-8 Readiness Checklist: ten self-scored questions to work through with your team.
Understanding and operationalizing Bill C-8 as a critical infrastructure operator
A plain-English walkthrough of what the Act requires of designated operators.
Read the postThe second ring of C-8: what selling to critical infrastructure now requires
How C-8 reaches suppliers and integrators through their customers' contracts.
Read the postFurther reading
Primary sources and guidance
The government's own overview, the Act itself, and the Cyber Centre's practical guidance for operators.
Public Safety Canada
Royal Assent of Bill C-8
The government's announcement and plain-language overview of the Act, with links to its backgrounders.
Read on canada.caLibrary of Parliament
Legislative Summary of Bill C-8
A non-partisan, section-by-section explanation of the bill and the CCSPA, revised April 2026.
Read the summaryParliament of Canada
Bill C-8 as passed
The full text of the Act at Royal Assent, including the Critical Cyber Systems Protection Act in Part 2.
Read the ActCanadian Centre for Cyber Security
Cyber Security Readiness Goals
36 voluntary practices for critical infrastructure operators, from the Cyber Centre that will receive C-8 incident reports.
Read on cyber.gc.caCyber Centre and partners
A definitive view of your OT architecture
Joint guidance on keeping an accurate record of OT assets, connections and third-party access, September 2025.
Read on cyber.gc.caOsler, Hoskin & Harcourt
Bill C-8: what businesses need to know
A legal rundown of the telecom powers, the CCSPA obligations and what's left to regulation, published the day after Royal Assent.
Read on osler.comTalk it through with us
Book a 45-minute C-8 Readiness Briefing with Adrian Norville, President of Telnet Networks: what the Act will mean for your organization and where the evidence gaps usually sit. No cost.
General information on Bill C-8 and the Critical Cyber Systems Protection Act, not legal advice. Last reviewed 13 October 2026. Questions: sales@telnetnetworks.ca or 1 800 561 4019.