Canada Introduces Bill C-26: Setting Cybersecurity Standards to Safeguard Critical Infrastructure

In response to growing cyber threats around the globe, the House of Commons of Canada has introduced Bill C-26 to establish a baseline for good cyber hygiene within the nation’s critical infrastructure. The bill comes in response to a growing number of cybersecurity incidents throughout the country.

The bill, also referred to as the Critical Cyber Systems Protection Act (CCSPA), authorizes the Governor in Council to designate any service or system as vital to the country’s security and establish a class of operators (or organizations) that are responsible for the cybersecurity of those vital systems. Designated operators are then tied to a branch of the government which will oversee the implementation of the regulatory requirements put forth in the bill. For example, the Minister of Transport will be tasked with overseeing the cybersecurity programs of any federally regulated transportation system.

In 2019, 21% of Canadian businesses reported being impacted by cybersecurity incidents. However, it is likely that this number is even higher, because prior to C-26’s passing, the country lacked an incident reporting mandate. The CCSPA specifically targets telecommunications, finance, energy and transportation. This is the first time that Canada has passed a bill addressing cybersecurity in critical infrastructure and follows similar bills passed in the U.S., such as S.2491 – Defense of United States Infrastructure Act of 2021.

What’s at Stake

The bill’s goals are multifaceted. Designated operators will need to implement cybersecurity programs, develop systems for mitigating supply chain vulnerabilities, and institute a two-step reporting process for any cybersecurity incident that may occur. These regulations are intended to shine a light on the scope of cyber attacks nationwide and give regulators visibility into the current state of cyber threats to critical infrastructure. While organizations may not currently be too motivated to report an incident, penalties will now be instituted for those who do not report an incident under the new law.

The bill also imbues responsible regulators with broad inspection and audit powers, including the ability to ask organizations to conduct internal audits. Noncompliance with the provisions of CCSPA (including delays in reporting incidents) can result in fines of up to C$15 million, and failure to adhere to certain sections can result in criminal fines or imprisonment.