CanadaCritical Cyber Systems Protection Act, Cyber Security Programs of Designated Operators
Critical Cyber Systems Protection Act (S.C. 2026, c. 9, s. 11), ss. 7-9, 12, 15 and 137
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This does not bind anyone yet: the Act is not in force, and it binds a designated operator, being a person, partnership or unincorporated organization that belongs to a class of operators the Governor in Council adds to Schedule 2 in respect of a vital service or vital system named in Schedule 1 (telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems within federal authority, banking systems, and clearing and settlement systems), reached by declaring that you operate an essential service, provide telecommunications services or provide financial services.
- Within 90 days after you become a member of a class of operators set out in Schedule 2, establish a cyber security program in respect of your critical cyber systems, with steps to identify and manage organizational cyber security risks, protect those systems from being compromised, detect cyber security incidents and minimize their impact (section 9(1)).
- Notify the appropriate regulator in writing, immediately after the program is established, that it has been established, and provide the program to the regulator within 90 days after you become a member of the class (sections 9(2) and 10).
- Implement the program by taking the steps it includes, and maintain the program (section 12).
- Review the program each year, or on the dates the regulations prescribe, and notify the appropriate regulator whether changes were made (section 13).
- Mitigate any cyber security risk in your supply chain or your use of third-party products and services as soon as it has been identified (section 15).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Contravening subsection 9(1) or section 12 or 15 is an offence under section 137 of the Act; on conviction on indictment an individual is liable to a fine in the court's discretion or imprisonment for up to five years, or both, and a corporation to a fine in the court's discretion.
Penalty structure
Section 91 caps the administrative monetary penalty that regulations may fix at $15,000,000 for a designated operator that is not an individual and at $500,000 for an individual. No regulation fixing a penalty has been made, and the section is not in force.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 15,000,000
Who enforces it
Enforcement body
The appropriate regulator for the designated operator's class of operators, which Schedule 2 of the Act names for each class (Schedule 2 lists no class at present), and the Communications Security Establishment, which receives incident reports.
Settledness
- As of
- Open questions
- Which classes of operators will the Governor in Council add to Schedule 2, and when will the Governor in Council fix the day on which Part 2 of the amending Act comes into force, given that Schedule 2 lists no class of operators and no order bringing Part 2 into force has been made?
What this law does
Section 8 of the Critical Cyber Systems Protection Act requires a designated operator that owns, controls or operates a critical cyber system to comply with the requirements of the Act and the regulations with respect to that critical cyber system. Section 9(1) of the Act requires a designated operator that belongs to a class of operators set out in Schedule 2 to establish a cyber security program in respect of its critical cyber systems within 90 days after it becomes a member of that class.
Section 12 of the Act requires the designated operator to implement the cyber security program by taking the steps that are included in it and to maintain the program. Section 15 of the Act requires the designated operator to mitigate any cyber security risk associated with its supply chain or its use of third-party products and services as soon as the risk has been identified. Section 7 of the Act allows the Governor in Council to amend Schedule 2 by order.
Schedule 1 to the Act names telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems within the legislative authority of Parliament, banking systems, and clearing and settlement systems as vital services and vital systems. The Act was enacted by section 11 of chapter 9 of the Statutes of Canada, 2026 and is not in force.
Section 16 of the amending Act brings the provisions of Part 2 into force on a day or days to be fixed by order of the Governor in Council. Section 137 of the Act makes it an offence to contravene subsection 9(1) or section 12 or 15.
When LexLint raises it
When your app profile says your app runs an essential service, provides telecom services or provides financial services.