Introducing Stamus Networks: Network Security Built For The Bill C-8 Era

Telnet Networks and Stamus Networks partnership lockup over a network topology motif, announcing Stamus Networks Canada partnership

The ground shifted in June

Bill C-8 received Royal Assent in June. For designated operators in telecommunications, energy, finance, nuclear and transportation, the Critical Cyber Systems Protection Act (CCSPA) brings a 90-day clock to stand up a cyber security program once a class of operators is designated, an incident-reporting window capped at 72 hours, and a continuing duty to identify and mitigate supply-chain risk. That last obligation does not stop at the operator’s front door. It flows down to the vendors and integrators who serve them. The telecom provisions are already in force; the CCSPA itself is law and awaits its in-force order.

None of this arrives in a vacuum. Ransomware crews and state-sponsored actors have been attacking Canadian utilities, transit systems and government networks for years. At the same time, the question of where security telemetry lives, and who can compel access to it, has moved from a procurement footnote to a board-level concern. Data sovereignty is now a security requirement, not a preference.

That is the context in which we went looking for a network security partner. We were not looking for just the loudest platform on the floor. We wanted one that turns network activity into answers teams can act on, backs each finding with evidence and disclosed detection logic, and runs in the environments our customers actually operate.

We chose Stamus Networks and its Stamus Clear network security platform.

Meet Stamus Clear

Stamus Networks is the creator of Stamus Clear, a network security platform built on Suricata, the open-source network security engine much of the industry runs on. Stamus Clear turns network traffic into clear, evidence-backed answers about what is happening on the network, so teams can see what the rest of the stack misses and know what to do about it.

Stamus Clear watches the network itself. Endpoints get missed, logs get altered, and nobody is installing an agent on a substation controller or a signalling system. But every attacker has to cross the wire at some point, which makes the network the one layer they cannot avoid touching. Stamus Clear turns that traffic into a short,  list of response-ready cases: what happened, what to do next, and the evidence and reasoning behind it. Clear Detect raises high-confidence Declarations of Compromise and Declarations of Policy Violation rather than handing the team another queue of alerts or a score it has to trust.

That evidence is the point. When an incident happens, the questions come fast. What did the attacker touch? When did it start? What left the building? Can you prove it? A team running Stamus Clear can answer with evidence it can inspect and defend, and show its work to whoever is asking, whether that is the board, an auditor or a regulator.

Deployment is on your terms. Stamus Clear runs on-premise or in hybrid environments, including fully air-gapped deployments, with no dependency on a Stamus cloud. The customer keeps its network data under its own control.

A decade of proof

Stamus has been building on Suricata since 2014, founded by Eric Leblond and Peter Manev, two of the people behind the open-source engine. The team remains at the core of the Suricata project through the OISF. That depth matters: Stamus is not simply integrating the engine; it brings more than a decade of expertise turning network traffic into evidence teams can act on.

The customer list tells the rest of the story. Stamus is trusted by European national banks, EU institutions, government, critical infrastructure and global industrial operators: organizations that get attacked most and can least afford a finding they cannot explain. The team has also supported a decade of NATO cyber defender training. That track record, together with 97% net customer retention, is proof built over years rather than a marketing claim.

What settled it for us, though, was their approach. Stamus is transparent by design: for detections built on defined detection methods, analysts can inspect the detection logic that fired and the traffic evidence behind it; anomaly detections carry the evidence and reasoning behind the finding. Stamus Clear also integrates with the security tools customers already run. When you have to defend a decision to an auditor or a regulator, evidence and logic you can check are a very different proposition from a black-box score you are asked to trust.

From the fibre to the finding

For more than two decades, Telnet has designed and supplied the visibility fabric (network taps, packet brokers and aggregation) that Canadian utilities, telecoms, transit agencies, government departments and industry run. That fabric decides what a security tool can see. NDR is only as good as the traffic it is fed, and we have expertise in building the layer that feeds it.

Together, Telnet and Stamus deliver the complete evidence pipeline, from the fibre to the finding. We scope the traffic access, Stamus Clear turns network activity into prioritized, response-ready cases and evidence, and the whole chain stays in the customer’s custody.

We built this partnership for specific deployment realities: organizations that cannot send telemetry to a vendor cloud; air-gapped, OT and industrial networks where an agent will never be installed; and operators who will need audit-ready records as the CCSPA reporting obligations come into force. If you already run taps and brokers, Stamus Clear can be added to your existing visibility fabric, shortening the path from traffic access to useful, evidence-backed answers.

“Canadian critical infrastructure operators increasingly need control over where security data is processed and the ability to show exactly why a finding was made. Telnet Networks brings the local visibility expertise; Stamus Clear brings evidence-backed network security that can run on-premise or fully air-gapped. Together, we give operators a practical path from network traffic to answers they can act on without depending on a vendor cloud.”
— Mark Firmin, CEO, Stamus Networks

What happens next

Two things you can do today. Book a C-8 Readiness Briefing: 45 minutes with our team on what the Act requires, where the evidence gaps usually sit, and how to prepare for designation. Or ask us about a proof of concept on your existing visibility infrastructure.

Over the coming weeks we will go deeper on the questions this partnership was built to answer: what audit-ready network evidence actually looks like, why control of security data matters, how detection works in an air-gapped environment, and how to get ahead of the supply-chain questionnaires that C-8 will bring.

Welcome, Stamus Networks. We are glad to have you alongside us.

The Second Ring of C-8: What Selling to Critical Infrastructure Now Requires

Concentric rings diagram: designated operators at the centre of Bill C-8, vendors on the second ring

This article is a follow-up to our Bill C-8 overview post

The contract renewal arrives from a customer you’ve served for a decade: a telecom, a bank, a pipeline operator. Your product hasn’t changed. Your service hasn’t changed. But the paper has. It now carries security attestations, audit rights, a 24-hour incident-notification clause, and a new right to terminate for unremediated cyber risk. Nothing about your business triggered this. Your customer’s legal environment did.

Bill C-8, An Act Respecting Cyber Security, received Royal Assent on June 16, 2026. Its centrepiece, the Critical Cyber Systems Protection Act (CCSPA), names only “designated operators” in six vital services: telecommunications, interprovincial pipeline and power line systems, nuclear energy, federally regulated transportation, banking, and clearing and settlement. If your company isn’t on that list, the Act never mentions you.

It will still rewrite your contracts. We have a front-row seat to this shift: Telnet Networks has supplied network, security, and timing infrastructure to Canada’s critical sectors for over 25 years, and we serve both the operators C-8 designates and the vendors who sell to them. Here’s why the flow-down is coming, and what to do about it.

Why flow-down is structural, not optional

The CCSPA makes designated operators responsible for risk they don’t directly control. Operators must establish a cybersecurity program that identifies and manages risks “associated with the operator’s supply chain and its use of third-party products and services,” and they must mitigate those risks as soon as they’re identified. This is a continuing duty, not an annual checkbox. Operators must also keep records of every step taken to mitigate supply-chain risk, which means your security posture becomes part of their compliance file.

The enforcement stakes explain what happens next. Administrative monetary penalties run up to $15 million per day for organizations and $1 million per day for individuals, and directors and officers can be personally liable for their organization’s violations. When executives are personally exposed for supplier risk, vendor risk tolerance goes to zero.

Operators can’t outsource the legal obligation. So they’ll do the only thing they can: transfer it contractually. Due diligence questionnaires, security schedules in MSAs, and continuous monitoring of the vendor base aren’t a courtesy anymore. They’re how a regulated operator proves it met its statutory duty.

That’s the second ring of C-8: a much larger population of undesignated companies (technology vendors, MSPs, integrators, SaaS providers, contractors) regulated not by Parliament, but by procurement.

What “C-8 by proxy” looks like in practice

Expect these artifacts to show up in RFPs, renewals, and vendor portals over the next 12–24 months:

  • Security questionnaires with teeth. No longer check-the-box. Answers will be tied to renewal, payment terms, and award decisions, and they’ll be retained as evidence of the operator’s own compliance.
  • Incident-notification clauses that beat the regulator’s clock. Operators must report significant cyber incidents to the Canadian Centre for Cyber Security within a window capped at 72 hours (regulations may set it shorter). An operator can’t report what it doesn’t know, so vendor contracts will require notification of incidents affecting the customer faster than the operator’s own deadline: often 24 hours, sometimes less.
  • Audit and inspection rights. Evidence requests for SOC 2 or ISO 27001 reports, penetration test results, and patch cadence, plus the right to inspect and, in some drafts, the right to direct remediation.
  • Vulnerability disclosure and patching SLAs for products embedded in or connected to critical systems.
  • Termination for cyber cause. If a risk you represent is identified and you don’t mitigate it, the operator’s cleanest legal path is to end the relationship. Expect that right to be explicit.
  • Insurance flow-down. Cyber coverage minimums appearing in MSAs and renewal terms.
  • Supplier-origin scrutiny. The companion amendments to the Telecommunications Act give the government authority to compel action against threats in telecom networks, including restricting suppliers. Expect heightened questions about product provenance, subcontractors, and where data lives.

What “somewhat compliant” actually means for a vendor

You don’t need a full CCSPA cybersecurity program. You need to be answerable. A pragmatic maturity ladder:

Tier 1: Table Stakes. Documented security policy, MFA everywhere, patch management, asset inventory, a named security contact. Without these you’ll struggle to complete a questionnaire honestly.

Tier 2: Contract-Ready. An incident-response plan with defined customer-notification timelines you can actually meet; vendor risk management for your own suppliers; a pre-built evidence pack (certifications, pen-test summaries, standard questionnaire answers).

Tier 3: Differentiated. Alignment to a recognized framework such as the Cyber Centre’s baseline guidance, NIST CSF, or ISO 27001; continuous monitoring; and the ability to support a customer audit without disrupting your operations.

The fourth-party ripple

Your customer’s obligation flows to you; yours flows onward. Because operators must manage supply-chain risk wherever it originates, they’ll increasingly ask about your suppliers: subprocessors, hosting providers, offshore development. Vendors will need their own miniature supply-chain risk program, starting with a current subprocessor list and baseline security requirements flowed into their own vendor contracts. C-8’s reach is recursive.

Turning compliance into a moat

Here’s the reframe worth internalizing: every artifact above is also a sales asset.

The first vendors in a category who can hand procurement a complete evidence pack shorten the security-review cycle from months to days, and win deals against slower competitors. “C-8-ready” is a positioning claim you can substantiate: pre-answered questionnaires, a standard security rider you’ll sign without three rounds of legal, notification commitments you’ve rehearsed. And as designation orders land, expect procurement teams at operators to begin disqualifying vendors on security posture alone. Readiness isn’t just risk management; it’s revenue protection.

A 90-day starter plan

  1. Map your exposure. Inventory which customers are, or will plausibly become, designated operators across the six vital services.
  2. Read your own paper. Review existing contracts for security and notification clauses already in force. Know your current commitments before new ones arrive.
  3. Build the evidence pack before you’re asked. Policies, certifications, test results, standard answers.
  4. Rehearse incident notification. Define who calls whom, and prove you can beat a 24-hour clock. That requires two things most vendors haven’t built: the visibility to detect an incident quickly, and trustworthy timestamps that let you reconstruct exactly when it started.
  5. Push requirements downstream. Identify your own critical suppliers and set baseline expectations now.
  6. Anchor to a framework. Run a gap assessment against the Cyber Centre’s guidance or NIST CSF and prioritize the gaps a customer would flag first.

Where Telnet Networks fits

Telnet Networks has spent over 25 years supplying mission-critical network, security, and precision-time solutions to Canadian enterprises, government, and the very sectors C-8 designates. That puts us on both sides of this story: we help operators meet their obligations, and we help their vendors become the low-risk suppliers those operators need. Four areas matter most for second-ring readiness.

Visibility you can act on. A 24-hour notification commitment is only as good as your ability to detect an incident in the first place. Network TAPs, packet brokers, and bypass switches give your security tools complete, reliable access to traffic, so detection isn’t dependent on luck or SPAN-port leftovers. The same architecture becomes evidence in an audit: it shows a customer exactly how you’d know something happened.

Detection you can demonstrate. Visibility feeds detection, and detection is what the questionnaires will probe. Through our new partnership with Stamus Networks, we deliver Clear NDR: Suricata-based network detection and response that produces transparent, explainable findings rather than black-box verdicts. When a designated operator asks “how would you know you’d been breached, and can you show us?”, an NDR deployment turns that answer from a paragraph of assurances into something you can put on the table.

Time you can prove. When a customer or regulator asks “when did you know?”, the answer lives in your logs, and logs are only as credible as the clocks behind them. Our GNSS and NTP/PTP precision timing platforms keep timestamps synchronized and defensible across your environment, turning an incident timeline from an estimate into a record.

Connections that can’t flow backward. If your service touches a customer’s critical or OT environment, you are the pathway an operator worries about. Data diode TAPs enforce one-way traffic flow in hardware, letting you deliver monitoring and support while physically removing the inbound threat path, which is often the single fastest way to shrink the risk you represent.

If C-8 clauses are starting to appear in your renewals, or you want to get ahead of them, talk to our team about a visibility and readiness assessment.

Sidebar: The C-8 timeline: why vendors feel it first

June 2022: Bill C-26 introduced, Canada’s first attempt at critical cyber systems legislation.

January 2025: C-26 dies on the Order Paper when Parliament is prorogued.

June 2025: Reintroduced as Bill C-8, substantially the same framework.

April 2026: Passes the House of Commons following substantive committee amendments.

June 16, 2026: Royal Assent. Telecommunications Act amendments take effect immediately.

Today: The CCSPA itself is not yet in force. Its obligations begin on dates set by the Governor in Council, and the schedule of designated-operator classes is still empty. Regulations defining incident-reporting thresholds and program details are still to come.

Designation + 90 days: Once designated, operators have 90 days to stand up their cybersecurity program.

Here’s the catch for vendors: procurement moves ahead of the law. Operators know designation is coming and are papering their supply chains now, because remediating hundreds of vendor relationships takes longer than 90 days. The contractual flow-down is arriving before the legal obligations that drive it, which means the vendor deadline is, effectively, already here.

This post discusses commercial and contractual trends, not legal obligations. The CCSPA imposes no direct duties on non-designated companies. It isn’t legal advice; talk to counsel about your specific contracts.