Bill C-26 (the Critical Cyber Systems Protection Act / CCSPA) mandates that operators of federally regulated critical infrastructure security in Canada must implement a cybersecurity program, report certain cyber incidents to the Canadian Centre for Cyber Security (CCCS), and manage supply-chain and third-party risk, with enforcement effective as of the 2024 budget implementation act and associated regulations.

For CISOs, GRC leads, and security architects at Vital Services and Designated Services Operators (VDSOs) in energy, telecommunications, finance, and transport, the legislation transforms formerly voluntary CCCS guidance into statutory obligations with penalties of up to CAD $1 million per violation for corporations and CAD $250,000 for individuals. This article breaks down who must comply, what the security program must contain, the mandatory incident reporting timeline, and how CyberSilo's Threat Exposure Management platform can streamline your CCSPA compliance program.

What is Bill C-26 and the Critical Cyber Systems Protection Act (CCSPA)?

Bill C-26 is an omnibus bill that received Royal Assent on June 20, 2024. Part 2 of that bill enacts the Critical Cyber Systems Protection Act (CCSPA), a standalone federal statute administered by the Minister of Public Safety and Emergency Preparedness. The CCSPA creates a binding regulatory framework for operators of Canada's critical infrastructure, requiring them to:

Separately, Part 1 of Bill C-26 amends the Telecommunications Act, empowering the Governor-in-Council to prohibit a Canadian carrier from using or supplying a “designated” telecommunications equipment or service from a supplier deemed a risk to national security (e.g., Huawei/ZTE). This article focuses on Part 2 — the CCSPA — and its direct operational impact on regulated entities.

Key Takeaway: The CCSPA applies only to federally regulated critical infrastructure operators — “Vital Services Operators” and “Designated Services Operators.” Provincially regulated entities (e.g., municipal utilities, school boards) are not in scope, though they may be subject to equivalent provincial security obligations or PIPEDA breach reporting.

Who Must Comply with the CCSPA? (VDSOs and Designated Entities)

The CCSPA uses a two-tier classification system: Vital Services Operators (VSOs) and Designated Services Operators (DSOs). The government’s intent is to capture the most critical nodes of Canada’s national cyber infrastructure.

Vital Services Operators (VSOs)

VSOs are the mandatory, baseline category. They include operators of systems or services deemed “vital” to Canada’s national security, public safety, or economic stability. As of the latest draft regulations (pre-publication in Canada Gazette, Part I, October 2024), VSOs include entities in:

Designated Services Operators (DSOs)

DSOs are entities that the Minister may designate by order on a case-by-case basis, often due to their systemic importance or unique risk profile. This category provides flexibility to capture emerging critical infrastructure, such as cloud service providers, data centres, or critical supply-chain intermediaries.

What Are the Key Obligations Under the CCSPA?

The Act establishes four core pillars of compliance, each with specific statutory requirements that must be documented, implemented, and audited.

1. Mandatory Cybersecurity Program

Each VSO/DSO must establish and maintain a written cybersecurity program that includes:

The program must be reviewed and updated at least annually, or after any material change in operations or threat landscape.

2. Mandatory Incident Reporting to the CCCS

This is perhaps the most operationally impactful requirement. The CCSPA obligates VSOs/DSOs to report qualifying cyber incidents to the Canadian Centre for Cyber Security (CCCS). While the specific threshold regulations are still being finalized (expected in 2025), the Act defines qualifying incidents as those that:

Reporting must be done as soon as feasible, but in any case within 72 hours of becoming aware of the incident. The report must include:

After the initial report, a follow-up report must be submitted within 30 days, providing a full root-cause analysis and remediation plan.

3. Supply Chain and Third-Party Risk Management

The CCSPA explicitly requires operators to “take reasonable steps to mitigate the risks that are posed to their critical cyber systems by third parties.” This means that your cybersecurity program must extend to vendors, managed service providers (MSPs), and software suppliers. Specifically, you must:

4. Compliance, Audits, and Penalties

The Act empowers the Minister to require an entity to undergo an independent audit of its cybersecurity program. Non-compliance can result in significant penalties under the Critical Cyber Systems Protection Act:

How is CCSPA Different from PIPEDA or OSFI B-13?

Canadian organizations often struggle to map overlapping federal obligations. The CCSPA is distinct in its focus on operational resilience of critical systems, not just data privacy (PIPEDA) or financial risk management (OSFI B-13).

Requirement

CCSPA (VSO/DSO)

PIPEDA (General)

OSFI B-13 (Banks/Insurers)

Trigger

Compromise of “critical cyber system”

Real risk of significant harm to individuals

Disruption to critical business operations

Report To

CCCS (Canadian Centre for Cyber Security)

OPC (Office of the Privacy Commissioner) + individuals

OSFI (Office of the Superintendent of Financial Institutions)

Timeline

“As soon as feasible” / within 72 hours proposed

Within 24 hours for significant incidents

Maximum Fine (Corp)

CAD $1,000,000

Up to 5% of global revenue (Bill C-27)

Varies by supervision; not statutory

How to Build a CCSPA Compliance Program in 5 Steps

For CISOs and compliance leads, here is a practical workflow to operationalize the CCSPA requirements using a structured, defensible approach.

Identify and Inventory Critical Cyber Systems

Map every system, application, and data flow that supports your “vital service.” This includes OT/ICS assets, core banking platforms, telecom switching gear, and supporting IT infrastructure. The CCSPA requires you to understand which systems are “critical” and to document their dependencies.

Adopt a Risk Management Framework (ITSG-33 or Equivalent)

Choose a recognized framework — the CCCS ITSG-33 (based on NIST SP 800-53) is the natural fit. Alternatively, NIST CSF 2.0 2.0 or ISO 27001 compliance can serve as a baseline. Map each control to the CCSPA’s implicit requirements for risk assessment, access control, continuous monitoring, and incident response.

Implement Continuous Threat Monitoring (SIEM/NDR)

To meet the detection and incident-reporting requirement, you need a security information and event management (SIEM) or network detection and response (NDR) solution that provides 24/7 visibility into your critical systems. This is where CyberSilo's Threat Exposure Management platform (which includes a next-gen SIEM and automated threat hunting) directly supports your CCSPA obligations by providing a centralized, audited view of all security events.

Formalize Incident Response and Reporting Procedures

Write and test playbooks for incident detection, classification, containment, and reporting to the CCCS. Ensure your team can produce a 72-hour report and a 30-day root-cause analysis. Use automation (ThreatHawk SIEM & SOAR) to accelerate workflows.

Manage Third-Party Risk Programmatically

Deploy a vendor risk management platform that can perform continuous security assessments (e.g., questionnaires, external attack surface monitoring). Integrate it with your SIEM to flag high-risk third-party behavior.

Ready to Build Your CCSPA Cyber Program?

Ensuring compliance with Canada’s Critical Cyber Systems Protection Act requires more than just a policy. CyberSilo's Threat Exposure Management solution provides the continuous monitoring, automated reporting, and supply-chain visibility your organization needs to meet CCCS requirements and avoid penalties. Our team of Canadian-focused cybersecurity experts can help you design a defensible compliance program in weeks, not months.

Talk to Our Team Explore Threat Exposure Management

When Does the CCSPA Take Effect? (Timeline and Deadlines)

The CCSPA is already in force (passed June 2024), but the specific regulations defining timelines, report formats, and detailed control requirements are still in development. Here is the current timeline as of late 2024:

How CyberSilo Helps with CCSPA Compliance in Canada

Meeting the CCSPA’s requirements for a documented cybersecurity program, continuous monitoring, and supply-chain risk management demands a unified technical platform. CyberSilo Threat Exposure Management is purpose-built for Canadian critical infrastructure operators, providing:

CyberSilo is a Canadian company with deep experience supporting VSOs in the energy, telecom, and financial sectors. We understand the nuance of federal compliance and can help you navigate the transition from voluntary best practice to statutory obligation. For more on how we support Canadian organizations, see our Canada cybersecurity compliance services.

Our Conclusion & Recommendation

For any organization operating federally regulated critical infrastructure in Canada, the CCSPA represents a paradigm shift from voluntary CCCS guidance to enforceable law. The key to compliance is not to wait for final regulations, but to build a robust, continuously monitored cybersecurity program today.

We recommend that CISOs and GRC leads begin by mapping their critical systems, adopting ITSG-33 as a control baseline, and deploying a unified threat detection and exposure management platform. CyberSilo's Threat Exposure Management solution directly addresses these needs, providing the continuous visibility, automated reporting, and supply-chain risk management required to not only pass an audit but to genuinely protect Canada’s critical infrastructure. Don't wait for a designation letter — act now to reduce your risk and ensure compliance.

Build a CCSPA Cyber Program Today

Contact our team for a free readiness assessment against the CCSPA requirements.