What Is Bill C-26 / CCSPA? Critical Systems Guide

What Is Bill C-26 (CCSPA)? A Definitive Answer

Bill C-26, formally titled the Critical Cyber Systems Protection Act (CCSPA), was introduced in June 2022 as part of a broader legislative package to modernize Canada's cybersecurity framework. The CCSPA component of the bill is designed to protect the "critical cyber systems" that underpin Canada's essential services. It is the Canadian equivalent of frameworks like the U.S. CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act), but with distinct Canadian regulatory architecture.

The bill applies to owners and operators of "designated critical infrastructure" across the following sectors, as determined by the Minister of Public Safety:

• Energy (electricity generation, transmission, distribution; oil and gas pipelines)
• Finance (banks, credit unions, securities dealers, clearing houses)
• Telecommunications (wireline, wireless, satellite operators)
• Transportation (air, rail, marine, pipeline carriers)
• Healthcare (hospitals, regional health authorities, public health labs)
• Water and wastewater (treatment and distribution systems)
• Government services (federal and provincial IT systems supporting critical services)
• Manufacturing (critical supply chains for food, chemicals, defence)

At its core, CCSPA requires each designated organization to:

• Establish a cybersecurity program that meets prescribed standards (expected to align with CCCS ITSG-33 and the CCCS Baseline Controls).
• Report cyber incidents to the CSE within 48 hours of becoming aware of a breach that could impact service continuity or national security.
• Undergo compliance audits conducted by the Public Safety Minister or a designated regulatory body.
• Disclose cybersecurity incidents to affected individuals and the Office of the Privacy Commissioner of Canada (OPC) where personal information is compromised, under PIPEDA obligations.

Who Must Comply with Bill C-26 / CCSPA?

The CCSPA applies to organizations designated as "responsible persons" for critical cyber systems. The Governor in Council (federal cabinet) will, through regulations, specify which types of systems and companies are in scope. However, based on the bill's text and policy intent, the following categories are almost certain to be designated:

• Federal Crown corporations operating critical infrastructure (e.g., Canada Post, Nav Canada).
• Provincially regulated entities that are part of national critical infrastructure (e.g., major hospitals, transit authorities, hydro utilities).
• Private sector companies owning or operating designated systems in banking, telecom, energy, and transportation.
• Supply chain partners that provide essential IT or operational technology (OT) services to designated organizations (e.g., cloud providers, SCADA vendors).

The bill also requires organizations to notify the CSE of any "material change" in their ownership, control, or operation that could affect the security of critical cyber systems. This extends the obligation to M&A due diligence and third-party risk management.

Key Requirements of the Critical Cyber Systems Protection Act

The bill mandates four primary obligations for designated organizations:

1. Mandatory Cybersecurity Program

Each responsible person must establish, implement, and maintain a cybersecurity program that includes:

• Risk assessments to identify threats and vulnerabilities to critical cyber systems.
• Protective measures aligned with an accepted cybersecurity framework (CCCS ITSG-33 or equivalent).
• Detection capabilities to identify cybersecurity incidents in a timely manner.
• Response and recovery plans to ensure continuity of critical services.
• Training and awareness for employees and contractors who access critical systems.
• Third-party oversight for vendors and partners with access to critical infrastructure.

These programs must be reviewed at least annually and updated after any material incident or change in operations.

2. Mandatory Incident Reporting (48-Hour Window)

Designated organizations must report any "cybersecurity incident" that could reasonably be expected to:

• Degrade, disrupt, or destroy the operation of a critical cyber system,
• Result in a loss of confidentiality, integrity, or availability of the system or data, or
• Cause significant harm to the organization, its stakeholders, or national security.

The report must be submitted to the CSE within 48 hours of the organization becoming aware of the incident. The bill also permits, but does not require, parallel reporting to law enforcement (RCMP) and the OPC. A separate report may be required under PIPEDA if personal information is involved.

3. Compliance Audits and Enforcement

The Minister of Public Safety (or an authorized person) may conduct compliance audits to verify that an organization's cybersecurity program meets the prescribed standards. The bill empowers the Minister to:

• Enter premises where critical cyber systems are located (with notice).
• Require production of records, including incident reports and risk assessments.
• Issue compliance orders directing an organization to take specific corrective actions.

Penalties for non-compliance range from warning letters to administrative monetary penalties (AMPs) up to CAD $1 million per violation. The bill also creates a new offence for knowingly failing to report an incident, which could lead to personal liability for directors and officers.

4. Cross-Border and Third-Party Obligations

Where a critical cyber system is hosted or managed outside Canada (e.g., by a U.S. cloud provider), the Canadian designated organization remains responsible for compliance. This has significant implications for organizations using cross-border data storage or managed services from U.S. vendors. The Canada cybersecurity compliance services framework addresses these extraterritorial obligations.

Timeline: When Will Bill C-26 Take Effect?

Bill C-26 received first reading in the House of Commons on June 20, 2022. As of early 2025, it has passed second reading and is currently at the committee stage (Standing Committee on Public Safety and National Security). The timeline for final passage remains uncertain due to parliamentary dynamics, but the following milestones are anticipated:

• 2025 (Expected): Royal Assent and passage into law.
• 2026 (Estimated): Regulations specifying designated systems, cybersecurity program standards, and reporting thresholds come into force.
• 2027 (Target): Full compliance deadline for all designated organizations.

However, organizations should not wait for the bill's passage. The legislative intent is clear, and early adopters will have a competitive advantage in terms of compliance readiness and risk reduction. The OSFI Guideline B-13 (which already imposes technology and cyber risk requirements on federally regulated financial institutions) provides a preview of the kinds of controls CCSPA will mandate.

How Bill C-26 Relates to Other Canadian and U.S. Frameworks

Bill C-26 does not exist in a vacuum. It intersects with multiple existing and emerging compliance regimes. Understanding these relationships is critical for organizations operating across North America.

Canadian Frameworks

• CCCS ITSG-33: The IT Security Risk Management framework for the Government of Canada is expected to serve as the technical foundation for CCSPA's cybersecurity program requirements.
• CCCS Baseline Controls: These 46 minimum security controls (based on NIST SP 800-171) will likely be mandatory for all designated organizations.
• PIPEDA: CCSPA does not replace PIPEDA. Both laws will apply concurrently. A cyber incident involving personal information will trigger separate notification obligations under both laws.
• Quebec Law 25: For Quebec-based organizations, the provincial privacy law imposes additional obligations (including privacy impact assessments and breach reporting to the CAI) that run parallel to CCSPA.
• OSFI B-13 and B-10: For federally regulated financial institutions, OSFI already mandates technology and cyber risk management. CCSPA will add a layer of regulatory coordination with the CSE.

U.S. Frameworks

• CIRCIA: The U.S. equivalent requires critical infrastructure owners to report cyber incidents to CISA within 72 hours and ransom payments within 24 hours. Canadian organizations operating U.S. infrastructure must comply with both CIRCIA and CCSPA.
• NIST CSF 2.0 and NIST SP 800-171: Many Canadian organizations that are part of U.S. supply chains (defence, aerospace, technology) already align with NIST standards. CCSPA's alignment with CCCS ITSG-33 (which maps to NIST) creates a pathway for cross-walk compliance.
• SEC Cyber Disclosure Rules: Canadian companies listed on U.S. exchanges must comply with SEC materiality-based incident disclosure requirements within four business days. CCSPA adds a separate 48-hour report to the CSE.

This multi-framework landscape underscores the need for a unified compliance strategy. CyberSilo Threat Exposure Management helps organizations map controls across CCCS ITSG-33, NIST, PIPEDA, and CCSPA, reducing duplication and audit fatigue.

Penalties for Non-Compliance with Bill C-26

The CCSPA carries substantial enforcement teeth:

• Administrative Monetary Penalties (AMPs): Up to CAD $1 million per violation for organizations. The amount may be increased for subsequent violations or where the organization derived a financial benefit from non-compliance.
• Director and Officer Liability: Directors and officers can be personally liable if they knowingly or negligently fail to implement the required cybersecurity program or report an incident.
• Compliance Orders: A regulator can compel an organization to cease operations, disconnect from external networks, or take other remedial actions.
• Reputational Damage: Non-compliance incidents will likely be disclosed publicly (e.g., in annual reports, ministerial statements), causing significant brand harm.

The first CTA should go here, after the "Penalties" section, since the audience is now aware of the costs of non-compliance.

Implementation Steps: How to Prepare for Bill C-26 / CCSPA

While the bill is not yet law, forward-looking organizations should begin preparing now. The following five-step process provides a structured approach.

How Bill C-26 Compares to Other Cyber Incident Reporting Laws

The following table maps the key attributes of Bill C-26 against other prominent reporting regimes in North America. This comparison is essential for organizations operating across borders.

This comparison underscores a critical reality: organizations operating in both Canada and the U.S. face a complex web of reporting obligations that vary by window, threshold, and regulator. A unified incident response and compliance management strategy is essential to avoid accidental non-compliance.

Frequently Asked Questions About Bill C-26 / CCSPA

To address common questions and support FAQPage schema, we have compiled the most pressing queries CISOs and compliance officers face.

Is Bill C-26 law yet?

No. Bill C-26 is still before Parliament (as of early 2025). It has passed second reading and is at the committee stage. However, given the national security imperative and growing cyber threats, passage is considered a matter of "when" not "if." Organizations should begin compliance preparations immediately.

What is the difference between Bill C-26 and PIPEDA?

PIPEDA is Canada's federal private sector privacy law that governs how organizations collect, use, and disclose personal information. It requires breach notification within 30 days to the OPC and affected individuals. Bill C-26 / CCSPA focuses specifically on protecting critical cyber systems that underpin essential services. It imposes a shorter 48-hour reporting window and applies only to designated critical infrastructure operators. Both laws will apply concurrently to incidents involving personal information.

Will Bill C-26 apply to small businesses?

Only if a small business is designated as a responsible person for a critical cyber system. For example, a small energy provider that operates a grid-connected substation or a regional water utility would be in scope. However, most small businesses that are not part of national critical infrastructure will not be directly regulated under CCSPA. They may still be affected indirectly if they are part of a designated organization's supply chain.

How does CCSPA address ransomware?

Ransomware attacks that disrupt critical cyber systems will be explicitly reportable under CCSPA's 48-hour rule. The bill does not currently require disclosure of ransom payments (unlike CIRCIA in the U.S.), but organizations should anticipate that such disclosures may be required in future amendments or as part of CSE guidance.

Can CCSPA audits lead to criminal charges?

While CCSPA itself creates a regulatory regime (with AMPs and compliance orders), the bill also creates a new criminal offence for knowingly failing to report an incident. This could lead to prosecution under the Criminal Code (e.g., fraud, obstruction of justice) in egregious cases. Personal liability for directors and officers who authorize non-compliance is a real possibility.

How CyberSilo Helps You Prepare for Bill C-26 / CCSPA

Navigating the complexity of CCSPA—especially when layered with existing obligations under PIPEDA, OSFI B-13, Quebec Law 25, and U.S. frameworks—requires more than a static compliance checklist. CyberSilo provides a unified compliance automation platform designed to reduce complexity and accelerate readiness.

• Automated Control Mapping: Our platform automatically maps your existing security controls to CCCS ITSG-33, the Baseline Controls, NIST CSF 2.0, and NIST SP 800-171, highlighting gaps and duplications.
• Continuous Monitoring: Real-time dashboards show your compliance posture across all relevant frameworks, with alerts when controls drift out of compliance.
• Incident Response Playbooks: Pre-built playbooks for 48-hour CSE notification, including notification templates, evidence collection workflows, and escalation procedures.
• Third-Party Risk Management: Assess and monitor vendor compliance against CCSPA requirements, with automated evidence collection and audit trails.
• Board Reporting: Generate executive-ready reports that demonstrate due diligence and regulatory readiness, helping protect directors and officers from personal liability.