Is your organisation ready for Bill C-26?
Bill C-26 is now Bill C-8, and the Critical Cyber Systems Protection Act it enacts is law but not yet in force as of 2026-08-27. No operators are designated. If you run or supply a federally regulated system in one of the six sectors Schedule 1 names, this check gives you an honest readiness tier before the duties attach.
- 6 questions
- About 2 minutes
- Report by email
Bill C-26 (now Bill C-8) readiness assessment
Quick context
What is Bill C-26?
Bill C-26 was Canada's federal cyber security bill. It died at prorogation in January 2025 and was reintroduced as Bill C-8, which received Royal Assent on 2026-06-15 (S.C. 2026, c. 9). It amends the Telecommunications Act and enacts the Critical Cyber Systems Protection Act for critical infrastructure.
Who does the CCSPA apply to?
The Critical Cyber Systems Protection Act applies to designated operators of critical cyber systems in six federally regulated sectors: telecommunications, interprovincial or international pipeline and power line systems, nuclear, federally regulated transportation, banking, and clearing and settlement. Government sets the operator classes by regulation and, as of 2026-08-27, has not: Schedule 2 is empty, so no organisation carries CCSPA duties yet. Vendors are reached through their customers' contracts.
What are the obligations under the CCSPA?
A designated operator must establish a documented cyber security program (within 90 days of designation), report incidents to the Communications Security Establishment within a window not to exceed 72 hours, manage supply-chain and third-party risk, comply with cyber security directives, and keep records. Penalties run high for non-compliance.
Who closes the gaps this finds?
We do. This assessment scores where you stand against the framework, and stops there. The next step is the engagement behind that score: what we audit, what we build, and who runs it. Start there if you would rather have the gaps closed than catalogued.
