INDUSTRIES

Mining, energy and utilities IT

The sites that matter most are the ones furthest from any IT support, and the regulator is starting to care. A truck roll to a remote site costs more than the fix it delivers. On a control network availability outranks confidentiality, in a way an office never has to think about.

WHAT APPLIES

Which rules apply to you?

  • Bill C-8 and the CCSPA

    Not yet in force

    Names energy and pipelines among six Schedule 1 sectors. Part 2 is law but not in force and Schedule 2 is empty, so no operator carries the duty today. It's a readiness question, not a deadline.Royal assent 2026-06-15

  • SCADA and ICS

    Applies now

    Availability outranks confidentiality here, and you often can't take a system offline to investigate what happened on it.

  • Remote-site connectivity

    Applies now

    No local hands, expensive truck rolls, and whatever link the site can actually get.

  • ISO 22301

    Applies conditionally

    Continuity planning that accounts for physical isolation, plus whatever your provincial regulator expects on top.

WHERE TO START

Which services answer them?

TECHNOLOGY

Whose kit does this run on?

The platforms we design, build and support. Named because a buyer with an estate already standardised on one of them needs to know before the first call, not after it.

Cisco, Fortinet, Palo Alto, Juniper, VMware, Azure

QUESTIONS

What buyers in this sector ask.

Not yet. The Critical Cyber Systems Protection Act received royal assent on 2026-06-15 and names energy, pipelines and nuclear among six Schedule 1 sectors, but Part 2 isn't in force and Schedule 2, the list of designated operator classes, is still empty. No organisation carries a CCSPA obligation today.

Indirectly, and the distinction matters. NERC writes the standards. In Canada they're made enforceable by provincial regulators rather than by FERC, so your obligation runs through your province while the CIP standards themselves are the same ones used across the interconnection.

By designing so that most problems don't need hands. Remote management that works over a poor link, out-of-band access for when the primary path is down, and recovery that doesn't assume somebody can walk to a rack. A truck roll should be the last option, not the runbook.

Yes, and that's usually the requirement rather than a preference. Passive monitoring off a span or tap sees the traffic without introducing anything to the control network. Active scanning belongs on the enterprise side, and on the control side only with the operator's agreement and a window.

If the work is engineering or revalidating the control system itself, that's your OEM or automation integrator. We build and secure the network and the IT around it, and we work alongside them. Ask which of the two you need before the procurement is written.

LET'S CONNECT

Ready to build a stronger,
smarter network?

Explore our servicesBook a free consultation

A senior engineer replies within an hour, 24/7.