Bill C-8 and OT: What the Critical Cyber Systems Protection Act Means for Operators

Canada now has its first dedicated cybersecurity law for critical infrastructure. Bill C-8 received Royal Assent in June 2026, creating the Critical Cyber Systems Protection Act, and with it a set of binding obligations for designated operators in federally regulated sectors. For operators of industrial environments, one detail stands out: the Act protects critical cyber systems, and it explicitly includes operational technology. This is not an IT-only law. It reaches the control systems that run pipelines, power, and other essential services.

This article explains what the Act requires, who it applies to, where operational technology fits, and why the operators most affected are already preparing even though the compliance clock has not formally started.

 

What Bill C-8 Actually Is

Bill C-8 has two parts. The first amends the Telecommunications Act to make security an explicit policy objective and to give the government new powers over telecommunications providers. The second, and the part that matters most for industrial operators, enacts the Critical Cyber Systems Protection Act. This new statute establishes cybersecurity obligations for designated operators of critical cyber systems, backed by audit powers, compliance orders, and financial penalties.

The Act became law on Royal Assent, but its operator obligations are being brought into force gradually rather than all at once. That distinction matters, and it shapes how operators should be preparing right now.

 

Who the Act Applies To

The Act targets designated operators in federally regulated sectors that deliver services vital to national security or public safety. The sectors named include:

• Telecommunications services
• Banking and clearing and settlement systems
• Energy, including interprovincial and international pipelines and power lines
• Nuclear energy systems
• Federally regulated transportation

Several of these are OT-intensive. Pipelines, power transmission, and nuclear facilities all run on industrial control systems, which is why the Act's reach into operational technology is so significant for these operators.

 

A key point on timing The obligations do not attach at Royal Assent. They attach once the government formally designates an operator's class through an order. When that designation happens, the operator has 90 days to establish and implement its cybersecurity program. Ninety days is a short runway to build a defensible OT security program from a standing start, which is why preparation before designation is the sensible course.

 

The Core Obligations
 

Once designated, an operator faces a set of duties that a mature OT security program must satisfy. In broad terms these are:

• Establish a cybersecurity program. A documented program to protect the operator's critical cyber systems, including OT, within 90 days of designation.
   
• Manage supply chain and third-party risk. Identify and mitigate cyber risks arising from suppliers and service providers on a continuing basis.
   
• Report cybersecurity incidents. Report significant incidents to the government within the defined window.
   
• Maintain records and support compliance. Keep the records that demonstrate the program is real and operating, and submit to audit and compliance mechanisms.

Non-compliance carries administrative monetary penalties that reach into the millions of dollars, which places this firmly at board level rather than treating it as a purely technical matter.

 

Where Operational Technology Fits

The explicit inclusion of OT is what makes this law different from a general IT security regime. For an operator running a pipeline or a power system, protecting critical cyber systems means protecting the control systems, SCADA, and safety systems that actually deliver the service. That is a different discipline from securing corporate IT, and a program that treats OT as an afterthought will not be defensible.

A credible OT security program under the Act is built on the same foundations that OT security frameworks have long recommended: a complete asset inventory, network segmentation, controlled access, monitoring, and incident response designed for industrial environments. Our overview of the OT/ICS risk assessment process sets out how operators establish the baseline these programs are built on, and our regulatory playbooks cover the control frameworks that map to these obligations.
 

Segmentation and High-Assurance Isolation

Segmentation between IT and OT is one of the most important controls a designated operator can demonstrate. For the most critical boundaries, high-assurance isolation carries particular weight. A data diode enforces one-way data flow in hardware, so operational data can be exported for monitoring and reporting while any inbound path is physically removed. As documented, certifiable evidence of isolation, this is exactly the kind of control that supports a defensible program and stands up to audit.

How to Prepare Before Designation

The operators best positioned for the Act are treating the current period, before designation and before the 90-day clock starts, as preparation time. Practical steps include:

• Conduct an OT-focused gap assessment against the likely program requirements
   
• Build or update a complete OT asset inventory, since you cannot protect what you have not identified
   
• Review and strengthen IT and OT segmentation, prioritising the most critical boundaries
   
• Assess supply chain and third-party access to OT systems
   
• Develop or test an OT-specific incident response and reporting capability
   
• Document everything, because the Act rewards operators who can evidence a real program, not just assert one

 

Why Waiting Is the Risk

It can be tempting to wait until designation before acting, but the 90-day window makes that a gamble. Building an OT asset inventory, redesigning segmentation, and standing up incident response inside 90 days, while running a live operation, is difficult. Operators who begin now convert a compressed compliance sprint into a manageable program, and in doing so they reduce genuine cyber risk regardless of the regulatory timeline.

 

Next Steps

If you operate critical infrastructure in a federally regulated sector, the time to build your OT security program is before designation, not after. Arista Cyber helps Canadian operators prepare through OT gap assessments, segmentation design, and high-assurance isolation. Explore our OT cybersecurity services to see how we support Bill C-8 readiness.

 

Preparing for Bill C-8?

Talk to Arista Cyber about an OT gap assessment and a defensible cybersecurity program.

Explore OT Cybersecurity Services