Bill C-8: An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

This law affects federally regulated businesses operating in telecommunications, banking, pipelines and power lines, nuclear energy, transportation, and clearing and settlement systems — essentially any company whose digital systems, if disrupted, could threaten national security or public safety. These are typically large, established operators (not small businesses or solo operators) who run complex infrastructure across multiple provinces: think a major bank managing payment systems, a pipeline company moving oil across provincial borders, a telecom provider running national network infrastructure, or an airline with federally regulated operations. Day-to-day, these businesses will now need to build and maintain formal cybersecurity programs, vet their software vendors and third-party suppliers for security risks, report cyberattacks to the Communications Security Establishment within 72 hours, keep detailed records of their security activities, and potentially remove specific products or vendors from their networks if the government orders it. Non-compliance can result in administrative penalties up to $15 million for corporations, plus the possibility of criminal charges — so security and compliance teams at these organizations will face significantly increased workloads and oversight.