Is your organization ready for Bill C-8?
Bill C-8 sets real cyber security obligations for Canada's critical sectors, and it signals to everyone else where the bar is heading. Find out in 10 minutes where you stand. Free.
Built to save your team time and money: every control is tied to its evidence, so internal reviews can run shorter and your evidence is in order when a customer, insurer or regulator asks.
What is Bill C-8, in plain terms
Bill C-8 is Canada's federal legislation requiring designated operators of critical infrastructure to establish documented cyber security programs, report significant incidents, comply with government directions, and protect their supply chains. Sectors in scope include finance, telecommunications, energy, and transportation.
Where it stands: Bill C-8 received royal assent on June 15, 2026. Its Critical Cyber Systems Protection Act part comes into force on a date the government sets, and its duties apply to the operators the government designates. As of October 16, 2026, that part is not yet in force (Justice Laws Website).
The four obligations
- Cyber security program. A documented program covering risk identification, protection, incident detection and response, and recovery. Supply chain risk included.
- Incident reporting. Significant cyber incidents must be reported to the relevant authority on tight timelines.
- Government directions. Operators must comply with cyber security directions and be able to evidence that compliance.
- Supply chain protection. Third party and supply chain cyber risk must be identified and managed, not just internal systems.
Most organizations do not know which of these they could evidence today. This free self-check shows you in minutes.
Want the full picture first? Read our Bill C-8 compliance guide, covering all four obligations and how compliance automation handles them.
Get your free Bill C-8 Readiness Checklist
Enter your details to unlock the 10-point self-check instantly and download the full PDF checklist to share with your team.