Canada's Critical Cyber Systems Protection Act creates mandatory cyber security obligations for federally regulated operators

Plain-language summary · AI-assisted · not legal advice

A new federal law establishes a comprehensive cyber security compliance framework for federally regulated operators in sectors including telecommunications, banking, energy pipelines, nuclear energy, transportation, and clearing and settlement systems. Operators designated under the law must establish a written cyber security program within 90 days of being designated, covering risk identification, system protection, incident detection, and impact minimization — including supply chain and third-party risks. Cyber security incidents must be reported to the Communications Security Establishment within 72 hours, with immediate notice to the relevant sector regulator. The government can also issue binding cyber security directions requiring specific protective measures, and regulators have broad inspection, audit, and compliance order powers. Penalties for violations can reach $15 million for organizations, and criminal offences carrying fines or up to five years imprisonment apply for more serious breaches; directors and officers can be personally liable. Affected organizations should assess whether they fall within a designated class of operators and begin readying the internal processes needed to establish a compliant cyber security program.

Who this affects: federally regulated telecommunications operators · banks and clearing and settlement operators · interprovincial pipeline and power line operators · nuclear energy system operators · federally regulated transportation operators