Canada's new cyber security framework for critical infrastructure
Published · Updated
What happened
Bill C-8 has officially become law, establishing a federal cyber security framework that enhances protections for critical systems, particularly in the energy sector. The legislation mandates compliance measures for energy operators and sets the stage for forthcoming regulatory guidance and reporting requirements.
Why it matters
This legislative change significantly alters the landscape of cyber security obligations within Canada's critical infrastructure, positioning the energy sector for increased scrutiny and accountability. Stakeholders must prepare for imminent compliance demands and operational shifts.
The Government of Canada announced on June 16, 2026 that Bill C-8, the Act Respecting Cyber Security, received Royal Assent. The law expands federal powers and compliance obligations aimed at protecting vital systems across telecommunications, finance, transportation and energy. For the energy sector, the immediate significance is the move from legislative proposal to enacted framework, which raises implementation, compliance and regulatory coordination requirements for operators and responsible departments.
Watch for
Public Safety Canada's implementation guidance for critical cyber systems Natural Resources Canada's engagement measures for energy operators Canada Gazette updates on regulatory details for the new act Canadian Energy Regulator's compliance expectations for energy infrastructure operators
Sources
Researched and written by AI from the sources listed, under published rules. How V³ Aware is made