Managed Compliance

CCSPA and Bill C-8 compliance

Canada's Bill C-8 is now in force. Telecom, energy, transportation, banking, and nuclear operators have 90 days to provide a cyber security program once designated. Are you ready?

Talk to a CCSPA specialist

Share what you need and a consultant will follow up to book a call.

What the engagement covers

Build the cyber security program the CCSPA will ask your regulator, or your customer, to inspect.

icon-5

Exposure read

Designated operator, supplier to one, or neither. Decided from Schedule 1 and Schedule 2 as published, in writing, with your counsel where a reading is contested.

icon-9

Critical cyber system scoping

The system as the law defines it rather than the boundary the company chose, and the third-party dependencies inside it.

icon-6

Gap analysis against the four program elements

Your existing ISO 27001 or SOC 2 program measured against identify and manage, protect, detect, and respond and recover. Usually re-cutting scope and evidence, not rebuilding controls.

icon-4

Supply chain risk duty

Vendor inventory, assessments, contract clauses, and the record trail behind them.

icon-2

Incident reporting rehearsal

Tabletop against the statutory 72-hour ceiling and the CSE Cyber Centre reporting path, with the period set by regulation once published.

icon-8

Records-in-Canada review

Where compliance evidence physically resides, and what has to move.

Assess, Build, Operate, applied to a designated operator's program

The program is built once and kept operating, so designation becomes a notification exercise. A documented methodology, led by a senior architect with more than ten years of enterprise security experience and a CISSP.

01

Assess

Exposure read, critical cyber system scoping, and a gap analysis of what you already hold against the four program elements and the supply chain duty.

02

Build

Scope and evidence re-cut to the statutory boundary, supply chain records, the regulator notification workflow, and the incident reporting rehearsal.

03

Operate

Records kept current, vendors reassessed, the reporting path exercised, and the program provided to the regulator on designation.

Built inside two of the six sectors

Truvo's team built and operated security programs inside Canada's national payments infrastructure. Clearing and settlement systems and banking systems are two of the six Schedule 1 sectors the CCSPA names.

Book a strategy call

  • Exposure determination, in writing

  • Critical cyber system scope and dependency map

  • Gap analysis against the four program elements

  • Supply chain risk register and contract clause set

  • Incident reporting runbook and rehearsal record

  • Records-in-Canada review

  • Cyber security program document ready to provide

What changes

The period before designation is the part an operator controls.

A program that exists before the clock starts

Designation becomes a notification exercise, with 90 days to provide a program that is already operating.

Questionnaires answered with evidence

Customers in the six sectors get what they need for their own record: security clauses, audit rights, incident notification terms and something certified behind them.

A defensible position

Administrative monetary penalties reach $15 million per violation for organizations. A due diligence defence is available, and a documented, operating program is what that defence rests on.

One program, mapped to every framework

SOC 2 and ISO 27001 controls carry the substance. The CCSPA work is scope, records and reporting on top of them.

Who this is for, and who it is not

Being in one of the six sectors does not by itself make you a designated operator. Selling into one is enough to be asked about it.

Right call when

  • You sell into telecommunications, pipelines and power lines, nuclear, federally regulated transportation, banking, or clearing and settlement, and customers are asking about Bill C-8

  • You expect to be a designated operator and want the program in place before the 90-day clock starts

  • You hold ISO 27001 or SOC 2 and need it re-cut to the critical cyber system as the law defines it

  • Your supply chain risk records and incident reporting path have never been rehearsed against a statutory deadline

Wrong call when

  • You need a legal opinion on designation; Truvo is not a law firm and works beside your counsel

  • You want a one-time policy pack with no ongoing operation

  • Nothing you sell or operate touches a Schedule 1 sector

Frequently asked questions

Directly, only if the organization is a designated operator: a member of a class added to Schedule 2 that runs a critical cyber system supporting one of six Schedule 1 sectors, namely telecommunications, interprovincial and international pipelines and power lines, nuclear energy, federally regulated transportation, banking, and clearing and settlement. Being in one of those sectors is not enough on its own. Indirectly, it reaches every company selling into them, because a designated operator has a statutory duty to mitigate the cyber security risk its suppliers introduce and to keep records of what it did.

Part 2 of Bill C-8, the CCSPA itself, was enacted on June 16, 2026 and comes into force on a day fixed by order. Obligations then attach to a given organization only once its class is designated in Schedule 2, published in the Canada Gazette, Part II, and that publication starts a 90-day clock. Ninety days is enough time to document a program that already exists. It is not enough time to build one. The period before designation is the part an operator controls.

Substantially, on control substance. An ISO 27001 ISMS or a SOC 2 report covers the identify, protect, detect, and respond elements the Act names. What neither supplies automatically is the CCSPA's scoping to the critical cyber system as the law defines it rather than the boundary the company chose, the regulator notification workflow, and whatever the regulations prescribe. The work is usually re-cutting scope and evidence, not rebuilding controls.

They need evidence they can put in their own record: what risk they identified in the relationship, and what reasonable steps were taken to mitigate it. In practice that arrives as security clauses, audit rights, incident notification terms, a completed questionnaire, and something certified behind it. A supplier who answers with verifiable proof clears procurement while competitors sit in security review.

Administrative monetary penalties reach $15 million per violation for organizations and $500,000 for individuals, and each day a violation continues counts as a separate violation. Serious contraventions can be prosecuted as offences. A due diligence defence is available, which is the reason the documented, operating program is the defensible position.

Talk to the architect who would do the work

A 30-minute call. We look at your environment and say plainly whether we can help and what it would take.

From the blog: Bill C-8 and the CCSPA

ISO 42001 Cost in 2026: The 4 Factors

Bill C-8 Is Law: What Canada's Critical Cyber Systems Protection Act Requires, and Who It Reaches

Bill C-8 is now law. Its centrepiece, the Critical Cyber Systems Protection Act (CCSPA), places mandatory security obligations on operators in six ...

Learn More
Two open doors labeled “Bill C-8 / CCSPA” and “CPCSC” lead into the same glowing cybersecurity control room, illustrating how Canada’s regulatory and procurement mandates both require a documented security program.

Bill C-8 vs CPCSC: Canada Now Has Two Cyber Mandates. Which One Reaches You?

Canada now runs two federal cybersecurity mandates that reach companies through entirely different doors. Bill C-8's Critical Cyber Systems ...

Learn More
Flat vector illustration showing Bill C-8 supplier requirements, with a secured laptop and servers connected to banks, telecom towers, energy infrastructure, rail, and aviation, alongside legal documents, a gavel, a 90-day program window, and a deadline clock.

Bill C-8 Supplier Requirements: Selling to Banks, Telecoms, and Energy After the CCSPA

Bill C-8 is law, and its centrepiece, the Critical Cyber Systems Protection Act (CCSPA), places no direct obligations on the software and technology ...

Learn More