Bill C-26 is now Bill C-8, and the clock starts when you're designated
Trusted by
Bill C-8 readiness, three pillars, one operator.
One Canadian team scopes the exposure, builds the programme, and rehearses the report. The Critical Cyber Systems Protection Act is the Canadian cyber legislation people still search for as Bill C-26, and it reaches six sectors, not everybody.
Scope, honestly
Six federally regulated sectors are named in Schedule 1, and most Canadian organisations sit outside them. Schedule 2, the list of designated operators, is still empty, so we settle whether the Act can reach you before we quote anything.
The programme, built early
Risk identification, system protection, incident detection and impact limits, designed before designation makes it urgent. Ninety days is enough to document a programme you already run. It isn't enough to build one from a standing start.
Reporting you've rehearsed
The incident report to CSE, the notice to your sector regulator, and the records held in Canada. We write the report once while nothing is on fire, so your first real submission isn't also your first draft.
Does Bill C-26 Readiness work the same way in every industry?
No. The Bill C-26 Readiness work is the same craft in every sector, but the conditions around it are not. In energy and mining that means SCADA networks and remote sites that can't go offline; in government, Protected A, B and C data handling. We keep the service and change the part that bends.
Where you'd stand when Part 2 is brought into force.
SCADA and ICS. Availability outranks confidentiality here, and you often can't take a system offline to investigate what happened on it.
Where you'd stand if Part 2 is brought into force.
Protected A, B and C. Each level changes where the data can physically live, who can reach it, and what you have to prove about both. Most files turn on Protected B, and most disagreements turn on what counts as reaching it.
What do you need from Bill C-26 Readiness?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Service
- Bill C-26 Readiness
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584Bill C-8 and the CCSPA in Canada, made real.
Nobody is designated yet. That's the opening, and most operators are reading it as permission to wait.
Start with scope, because it has the cheapest answer.
The Bill C-26 requirements people bookmarked two Parliaments ago are the Bill C-8 requirements now, and they reach six federally regulated sectors: telecoms, interprovincial and international pipelines and power lines, nuclear, federally regulated transportation, banking, and clearing and settlement. Outside those, you have no obligation coming and we'll say so on the first call. Inside them, the question isn't whether to prepare. It's whether you'd rather build a cyber security programme over months, or in the 90 days the statute gives you once your class is named.
Four required outcomes, and the two places the risk sits.
We build the programme against the Act's four required outcomes: identify the risks, protect the system, detect incidents, and limit the damage. The risk sits in two places. Treating this as a documentation exercise, which satisfies nobody the first time a regulator asks. And leaving the supply chain out, because the duty to mitigate a supplier's risk starts as soon as you identify it, and most operators have never inventoried who touches their critical systems (source: Osler, 2026-06-17).
Where the statute actually stands, as of 2026-09-02.
Bill C-8 received royal assent on 2026-06-15 as Statutes of Canada 2026, chapter 9. Part 1 amends the Telecommunications Act to add security powers, which is the half people mean when they search for a telecom security act, and it's in force now. Part 2, the Critical Cyber Systems Protection Act itself, is law but waits on a Governor in Council order, and Schedule 2, which lists the designated classes, is still empty. Once your class is named you get 90 days for the programme, and incident reports go to CSE inside a window regulations will set, capped at 72 hours (source: Osler, 2026-06-17).
Want a Senior IT Consultant's Read on Your Setup?
Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.
Request a consultHow Critical Cyber Systems Protection Act readiness work runs.
Four steps, and step 01 ends the engagement for about half the organisations that ask. Scope under this Act is narrow, and being outside it is good news nobody else on this subject seems willing to deliver. For operators genuinely in a Schedule 1 sector, the rest is worth doing on its own merits, which is the test we apply before anything goes in the plan.
Engagement phases
Phases 01 to 04
Settle the scope
Whether you sit in one of the six sectors, which systems would count as critical, and what a class designation would capture. We put it in writing, including the answer that says the Act won't reach you.
Design the programme
Risk identification, system protection, incident detection and impact limits, written so it survives a regulator reading it, not a consultant filing it.
Map the supply chain
Who touches the critical systems, what each supplier could introduce, and the mitigation you owe once a risk is identified. That duty starts on identification, not on designation.
Rehearse the report
The CSE submission, the regulator notice, and the Canadian record. Then a tabletop, because the first real incident is the wrong time to read the procedure for the first time.
Bill C-26 and Bill C-8 questions, answered straight.
Answers first, including the one where we tell you the Act will never reach you. An architect takes the call.
Where this work connects.
These disciplines share the same senior team and tend to land together. Follow the thread to the next one.
- RegulatedISO 42001 AI Management SystemISO 42001 for Canadian organisations, from an AI system inventory to a certificate an accredited body signs.
- RegulatedQuebec Law 25 ComplianceLaw 25 Quebec compliance for Canadian businesses, where retention rules, incident registers and portability requests actually work.
- RegulatedCMMC ComplianceCMMC compliance for Canadian suppliers in the US defence chain, built on the controls that survived the suspension.
Not sure where you stand? Take the free Bill C-26 readiness assessment
