Canada’s Critical Cyber Systems Protection Act (Bill C-8) receives Royal Assent today, creating a federal cyber security regime for critical infrastructure, with commencement to follow by order.
Key points
- Covers telecommunications, pipelines and power, nuclear, transport, banking, and clearing and settlement systems.
- Designated operators must establish a cyber security programme within 90 days.
- Operators must mitigate supply-chain and third-party cyber risks.
- Cyber incidents must be reported to the Canadian Centre for Cyber Security.
- Government can issue binding cyber security directions.
UK suppliers to Canadian critical infrastructure operators should prepare for supply-chain security requirements. The Act parallels the UK’s Cyber Security and Resilience Bill and the EU NIS2 Directive.
Source: Bill C-8 (45-1) – Critical Cyber Systems Protection Act (LEGISinfo, Parliament of Canada)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
