Canada's new Cyber Security Act introduces mandatory protections for critical infrastructure operators

Plain-language summary · AI-assisted · not legal advice

A new federal Act creates two main frameworks: amendments to the Telecommunications Act and a new Critical Cyber Systems Protection Act (Part 2, not yet in force). It targets operators of vital services and systems — including telecommunications, pipelines, power lines, nuclear energy, transportation, banking, and clearing and settlement systems — requiring them to protect critical cyber systems. Part 2 will take effect on a date set by the Governor in Council, so operators in these sectors should monitor for that order. A mandatory ministerial review of the Act's effectiveness must be completed within five years of royal assent, with findings tabled in Parliament within 90 days after the review concludes.

Who this affects: telecommunications service providers · pipeline and power line operators · nuclear energy system operators · federally regulated transportation operators · banks and clearing and settlement system operators