Bill C-8 · Readiness Checklist · Free PDF
10 questions to ask before you're designated
Bill C-8 is law, and the Critical Cyber Systems Protection Act will be brought into force in phases. Once designated, operators will have 90 days to stand up a documented cyber security program. This self-scored checklist shows where you stand today, in the order you'd prepare.
8 pages · Fillable on screen or printable · Self-scored out of 20
What's inside
Seven sections, in the order you'd prepare
Each question comes with why it matters, what good looks like, and room for your answer and notes. Work through it with whoever owns the C-8 file and the people who know the network.
Section 1 · Know
Are you in scope?
Which of your systems count, and which of C-8's three rings you sit in.
Section 2 · Own
Who's accountable?
A named owner, and a program you could document within 90 days of designation.
Section 3 · See
Can you see what's happening?
Visibility into traffic between your critical systems, including OT that can't run an agent.
Section 4 · Keep
Can you produce the record?
Network evidence you could hand over, held in Canada and in your custody.
Section 5 · Report
Could you meet the clock?
Whether your people, process and evidence would hold up against the 72-hour reporting window.
Section 6 · Extend
Does it reach your suppliers?
Third-party access to your critical systems, and C-8 terms in supplier contracts.
Section 7 · Prepare
What comes next?
A 12-month plan, so you're ready before designation starts the clock.
Then
Score it out of 20
Three bands tell you where you stand and what to do next.
A preview
Three of the ten, up front
If any of these give you pause, the rest of the checklist will show you where the work is.
01
Do you know what “critical cyber systems” means in your environment?
Every obligation in the Act attaches to the systems on that list, so the boundary you draw sets the scope of everything else.
02
Who owns the C-8 program response?
Without a named owner, C-8 sits between security, OT, legal and compliance, and nobody moves.
03
Could you produce 72 hours of network record today?
An alert is not a record. Incident reports, investigations and a due diligence defence all depend on showing what actually happened on the network.
Free download
Get the full checklist
All ten questions across seven sections, with a status summary of what's already settled in the Act and what's still to come.
Why each question matters, and what good looks like
Yes / Partly / No answers and notes, fillable on screen
A score out of 20, with what it means for your next step
PDF, 8 pages. Name, work email and organization to download.
Next step
Talk it through with us
Book a C-8 Readiness Briefing: 45 minutes with Adrian Norville, President of Telnet Networks. Bring whoever owns the C-8 file and the person who knows the network. We'll go through your answers together, look at where the evidence gaps sit, and you'll leave with a short written summary.
No cost. No follow-up unless you ask for one.
General information on Bill C-8 and the Critical Cyber Systems Protection Act, not legal advice. Last reviewed 13 October 2026. Questions: sales@telnetnetworks.ca or 1 800 561 4019.