CanadaCritical Cyber Systems Protection Act, Reporting of Cyber Security Incidents
Critical Cyber Systems Protection Act (S.C. 2026, c. 9, s. 11), ss. 17, 18 and 136
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This does not bind anyone yet: the Act is not in force, and it binds a designated operator, being a person, partnership or unincorporated organization that belongs to a class of operators the Governor in Council adds to Schedule 2 in respect of a vital service or vital system named in Schedule 1 (telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems within federal authority, banking systems, and clearing and settlement systems), reached by declaring that you operate an essential service, provide telecommunications services or provide financial services.
- Report a cyber security incident in respect of any of your critical cyber systems to the Communications Security Establishment, in accordance with the regulations, within the period the regulations prescribe, which may not exceed 72 hours (section 17).
- Immediately after reporting, notify the appropriate regulator that the report was made, in the form and manner the regulations prescribe, and give it a copy of the report (section 18).
- Keep records of every cyber security incident you reported under section 17 (section 30).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Contravening section 17 or 18 is an offence punishable on summary conviction under section 136(1) of the Act.
Who enforces it
Enforcement body
The appropriate regulator for the designated operator's class of operators, which Schedule 2 of the Act names for each class (Schedule 2 lists no class at present), and the Communications Security Establishment, which receives incident reports.
Settledness
- As of
- Open questions
- Which classes of operators will the Governor in Council add to Schedule 2, and when will the Governor in Council fix the day on which Part 2 of the amending Act comes into force, given that Schedule 2 lists no class of operators and no order bringing Part 2 into force has been made?
What this law does
Section 17 of the Critical Cyber Systems Protection Act requires a designated operator to report a cyber security incident in respect of any of its critical cyber systems to the Communications Security Establishment within a period the regulations prescribe, not to exceed 72 hours. Section 18 of the Act requires the designated operator, immediately after reporting a cyber security incident, to notify the appropriate regulator that the report was made and to give it a copy of the report.
Section 2 of the Act defines a cyber security incident in respect of a critical cyber system as an incident that interferes or may interfere with the continuity or security of a vital service or vital system or with the confidentiality, integrity or availability of the critical cyber system. Section 136(1) of the Act makes it an offence punishable on summary conviction to contravene section 17 or 18. The Act was enacted by section 11 of chapter 9 of the Statutes of Canada, 2026 and is not in force.
When LexLint raises it
When your app profile says your app runs an essential service, provides telecom services or provides financial services.