A managed service provider in Ottawa gets an unusual email from its largest client, a regional internet and cable provider. Attached: a multi-page security questionnaire, a draft contract amendment and a request to meet "before quarter end." One reference keeps coming up: Bill C-8.
Bill C-8 received Royal Assent on June 15, 2026. Part 2 enacts the Critical Cyber Systems Protection Act (CCSPA), which will impose demanding obligations on large operators in telecommunications, finance, energy and transportation. Your company is probably not a target of the law. But if you sell services, software or maintenance to one of those operators, the pressure will reach you through the contract.
The good news: the CCSPA is not in force yet. That gives you a window to prepare on your own schedule, instead of answering a questionnaire in a rush with a key account on the line.
TL;DR
- Bill C-8 became law on June 15, 2026; the CCSPA (Part 2) will come into force in phases by order in council, and was still not in force in early October 2026.
- It applies to designated operators (telecom, banking, energy, federally regulated transportation), not to small businesses in general.
- Those operators must manage supply chain and third-party risk, so expect questionnaires, new contract clauses and tight incident notice deadlines.
- Suppliers who document MFA, logging, backups and incident response now will be in a stronger position to keep their contracts.
What Bill C-8 contains, and what is actually in force
Bill C-8 has two parts. Part 1 amends the Telecommunications Act to make security an explicit policy objective and to let the government order telecom providers to take specific measures. It took effect on Royal Assent.
Part 2, the CCSPA, comes into force on dates set by the Governor in Council, under a phased approach announced by the government. As of early October 2026, no coming-into-force order, no regulations and no designated class of operators had been published.
The framework hinges on two schedules. Schedule 1 lists the vital services and systems:
- telecommunications services;
- interprovincial or international pipeline and power line systems;
- nuclear energy systems;
- transportation systems within federal jurisdiction;
- banking systems;
- clearing and settlement systems.
Schedule 2, still empty, will name the classes of designated operators and their regulator: the Minister of Industry, the Minister of Transport, the Superintendent of Financial Institutions, the Bank of Canada, the Canada Energy Regulator or the Canadian Nuclear Safety Commission.
Designated operator obligations, and how they land on your desk
Once designated, an operator takes on specific duties. Almost every one of them can turn into a request sent to suppliers.
| Operator obligation (CCSPA) | What the Act says | What your company may receive |
|---|---|---|
| Cyber security program (ss. 9–10) | Establish it and provide it to the regulator within 90 days of designation | Security questionnaire, request for written policies |
| Supply chain and third parties (ss. 9 and 15) | Identify, then mitigate, risks tied to suppliers and third-party products or services | Vendor assessment, audit rights, minimum controls |
| Incident reporting (ss. 17–18) | Report to the Communications Security Establishment (CSE) within a period set by regulation, not to exceed 72 hours, then notify the regulator | Notification clause measured in hours, 24/7 contact |
| Material changes (s. 14) | Notify the regulator of material changes, including in the use of third parties | Duty to give notice before switching hosting or subcontractors |
| Annual review (s. 13) | Review the program every year | Yearly reassessment and refreshed evidence |
The stakes are high. According to an analysis by the law firm BLG, administrative monetary penalties could reach $15 million per violation, per day, for an organization. Operators will naturally try to shift part of that risk onto their suppliers through contracts.
Why suppliers feel it first
To show a regulator that it manages supply chain risk, an operator's simplest tool is the contract. Three supplier profiles will get the most attention:
- The managed service provider in Ottawa with remote admin access to a telecom's network. This is the most scrutinized profile: privileged accounts, MFA, logging, technician laptops.
- The software company in Montréal hosting a platform used by a Toronto bank. Expect questions on data location, secure development, and a request for a recent penetration test report.
- The industrial maintenance firm in Hamilton servicing a federally regulated rail carrier's equipment. Remote access tools and field laptops that connect to equipment will be front and centre.
The common thread: perceived risk depends less on your size than on the access you hold. A parts supplier will face fewer questions than a five-person firm with a VPN tunnel into the core of its client's network.
Contract clauses worth reading twice
When the amendment arrives, give these clauses your full attention:
- Incident notification deadline. If your client has at most 72 hours to report to the CSE, it will likely ask you to notify it within 24 hours, or less. That only works if you can detect the incident in the first place, which makes a tested incident response plan essential.
- Right to audit. The client may want to verify your controls, directly or through a third party. Negotiate notice periods and who pays.
- Minimum technical controls. Encryption, log retention for a defined period and, above all, phishing-resistant multi-factor authentication on every remote access path.
- Flow-down to subcontractors. Obligations will often extend to your own subcontractors. Do you know exactly who on your side can reach the client's systems?
- Liability and indemnity. Some clauses can make you liable for uncapped losses. This is where the economics of the contract are decided.
These clauses bind your business. Review them with your legal counsel before signing, and ask your broker whether your insurance covers the commitments you are being asked to make.
Checklist: get ready before the CCSPA takes effect
There is no need to wait for regulations. These items will be requested regardless:
- List the clients likely to be designated (telecom, banking, energy, federally regulated transportation).
- Inventory every access you hold in their environment: accounts, VPNs, integrations, API keys.
- Enforce MFA on all remote access and separate admin accounts from day-to-day accounts.
- Centralize sign-in logs and decide how long you keep them.
- Test your incident response plan, with a contact reachable around the clock, weekends included.
- Confirm backups are isolated and that a restore was tested recently.
- Build an evidence folder: policies, penetration test report, audit results, list of your subcontractors.
- Review current contracts for security clauses you have already agreed to.
A supplier-focused security audit lets you answer these questions before your client asks them. That is how our team approaches its cybersecurity audit: a clear baseline, organized evidence and a prioritized remediation list.
The CCSPA does not replace privacy law
The CCSPA protects critical systems; privacy laws protect personal information. Both can apply to the same incident.
Picture a ransomware attack at the Montréal software company. Its banking client may have to report to the CSE under the CCSPA. Meanwhile, if personal information under the software company's control is affected and there is a risk of serious injury, Québec's Law 25 may require it to report the incident to the Commission d'accès à l'information and notify the individuals concerned. Outside Québec, federal privacy law (PIPEDA) has its own breach rules.
Your response plan should therefore spell out who notifies whom, and in what order. These obligations overlap and will keep evolving, so validate your reading with your legal counsel as soon as the first regulations are published.
Frequently asked questions
Is Bill C-8 the same as the old Bill C-26?+
Largely, yes. Bill C-26 was introduced in 2022 and died on the Order Paper when Parliament was prorogued in January 2025. The government reintroduced similar content as Bill C-8 in June 2025, and that version received Royal Assent on June 15, 2026.
Can a supplier be penalized under the CCSPA?+
Administrative monetary penalties are aimed at designated operators, along with directors and officers who took part in a violation. For a supplier, the exposure is mainly contractual: termination, penalties or an obligation to indemnify the client. Have your legal counsel confirm the scope of what you are signing.
Do suppliers need a specific certification to keep working with a designated operator?+
The CCSPA does not require suppliers to hold a certification. Each operator will set its own requirements and may ask for ISO 27001 certification, a SOC 2 report, CyberSecure Canada certification or simply documented evidence. Future regulations could clarify some expectations.
Where can I track when the CCSPA comes into force?+
Coming-into-force orders and regulations are published in Part II of the Canada Gazette. LEGISinfo and the Justice Laws website also show which provisions are in force. Your legal counsel or industry association can flag changes as they happen.