Pricing Models, Comparisons and 2026 Rules
Bill C-8 and the Critical Cyber Systems Protection Act: status in 2026 and who it covers
Bill C-8 in October 2026: Royal Assent, who the Critical Cyber Systems Protection Act covers, its duties and what it means for SMEs.
Bill C-8, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, received Royal Assent on 15 June 2026 (Statutes of Canada 2026, chapter 9), according to LEGISinfo and the Justice Laws annual statutes. Part 2 enacts the Critical Cyber Systems Protection Act (CCSPA). That Act applies to designated operators in federally regulated sectors, not to businesses in general, and its provisions come into force on a day or days fixed by order of the Governor in Council. As of late October 2026 the Justice Laws Website still marks Part 2 as not in force (consolidation current to 30 September 2026), and we found no coming-into-force order in the Canada Gazette, Part II, issues up to 21 October 2026. Check both again before treating any duty as already in effect. Most small and mid-sized businesses will meet the Act indirectly, through security clauses in contracts with telecom, banking, energy and transportation clients.
This guide is part of the pricing models and 2026 rules section. It summarises the statute as published; it is not legal advice.
How the bill got here
| Step | Date (as shown on LEGISinfo) |
|---|---|
| House of Commons first reading | 18 June 2025 |
| Second reading | 3 October 2025 |
| Committee report with amendments | 11 March 2026 |
| Report stage and third reading | 26 March 2026 |
| Senate first reading | 26 March 2026 |
| Senate second reading | 23 April 2026 |
| Senate committee report without amendment | 2 June 2026 |
| Senate third reading | 4 June 2026 |
| Royal Assent | 15 June 2026 (S.C. 2026, c. 9) |
An earlier bill with a similar purpose, Bill C-26 in the previous Parliament, did not become law before Parliament was prorogued in January 2025. Bill C-8 brought the proposals back in the 45th Parliament.
Who the CCSPA covers
The Act works through two schedules. Schedule 1 lists vital services and vital systems:
- Telecommunications services
- Interprovincial or international pipeline and power line systems
- Nuclear energy systems
- Transportation systems within the legislative authority of Parliament
- Banking systems
- Clearing and settlement systems
Schedule 2 is meant to list classes of operators and the regulator for each class, but in the Act as enacted it is empty: classes are added later by Governor in Council order (s. 7). The regulators the Act can assign are the Minister of Industry, the Minister of Transport, the Superintendent of Financial Institutions, the Bank of Canada, the Canadian Energy Regulator and the Canadian Nuclear Safety Commission. A "designated operator" is a person, partnership or unincorporated organisation in one of those classes.
A typical local accounting firm, retailer or manufacturer is not a designated operator. A small telecom reseller, a federally regulated transportation company or a payment-clearing participant might be, depending on the classes eventually added to Schedule 2 and any regulations; that is a question for legal counsel.
Main duties for designated operators
Based on the enacted text:
- Cyber security program: once an order adding a class to Schedule 2 is published in the Canada Gazette, Part II, establish one within 90 days after becoming a member of that class (s. 9), then implement and maintain it.
- Supply-chain and third-party risk: take steps to mitigate cyber security risks from the supply chain and from third-party products and services as soon as they are identified.
- Incident reporting: report cyber security incidents to the Communications Security Establishment (which houses the Canadian Centre for Cyber Security) within a period set by regulation that may not exceed 72 hours.
- Directions: comply with cyber security directions the Governor in Council may issue by order to an operator or class of operators (s. 20).
- Records: keep prescribed records in Canada.
The Act sets the maximum administrative monetary penalty per violation, to be fixed by regulation, at $500,000 for an individual and $15,000,000 in any other case, and it also creates offences. Part 1 separately amends the Telecommunications Act to allow orders to secure the telecommunications system.
What this means for SMEs and managed security buyers
Even if your business is not covered, the Act can reach you through contracts:
| If you are… | What you may be asked | Cost impact |
|---|---|---|
| An IT or software supplier to a telecom, bank, pipeline, nuclear or federal transport client | Security questionnaires, evidence of controls, faster incident notice to the client | More reporting from your MSSP; possibly SOC with longer retention |
| A managed security provider serving those sectors | Supply-chain assurance, incident timelines aligned with 72-hour reporting | Contract terms passed on to subcontractors |
| A business with no such clients | Probably nothing directly | None, but the Cyber Centre's guidance is still useful |
If a client asks you to notify incidents within, say, 24 hours, your managed security contract must let you meet that: the provider must tell you first and quickly. See SLA and contract questions.
How it differs from privacy breach rules
The CCSPA is about the security of critical cyber systems. Privacy breach duties under PIPEDA, Quebec's Law 25 and Alberta's PIPA are about personal information, apply to most businesses and are already in force. A single incident at a designated operator could trigger both. See breach reporting under PIPEDA, Law 25 and Alberta PIPA.
For how these rules shape pricing, return to the pricing overview, and compare service types in MSSP vs MDR vs SOC-as-a-service.
Frequently asked questions
Is the CCSPA in force?
Not yet, as far as we could find. It received Royal Assent on 15 June 2026, but Part 2 comes into force on dates fixed by order; Justice Laws still shows it as not in force and no order had appeared in the Canada Gazette, Part II, by 21 October 2026. Check the Justice Laws consolidation and the Canada Gazette, Part II, for orders and regulations.
Does the Act require all businesses to report cyber incidents?
No. The 72-hour ceiling applies to designated operators. Other businesses have privacy breach duties and may have contract duties.
Who issues the regulations?
The Governor in Council and the sector regulators named in Schedule 2. Watch the Canada Gazette, Part I, for proposed regulations and consultation periods.
Should an SME buy more security because of C-8?
Only if clients or insurers require it. Start from the Cyber Centre baseline controls and your contracts.
Sources
- LEGISinfo, Parliament of Canada — Bill C-8 (45th Parliament, 1st session) stages and Royal Assent
- Justice Laws Website — S.C. 2026, c. 9 annual statute and consolidated Acts
- Canada Gazette — orders fixing coming into force and regulations
- Canadian Centre for Cyber Security — incident reporting and guidance
- Public Safety Canada — national cyber security policy
