Canada’s CCSPA: What it is, why it matters, and how to get ready Canada is moving toward a federal, cross-sector cybersecurity regime for critical infrastructure. Under the proposed Bill C-8 or Critical Cyber Systems Protection Act (CCSPA), the federal government can designate vital services and systems and the operators responsible for them (“designated operators”). Those operators must: Establish a cybersecurity program and file it with their sector regulator (typically within 90 days of designation); Mitigate supply- chain and third-party risks; Report cybersecurity incidents to the Canadian Centre§ for Cyber Security within prescribed timelines; Comply ° with binding cybersecurity directions§ issued by the government; and Maintain records to demonstrate compliance.

Join for free to read