(Cybersecurity Bill C-26)

Cybersecurity Act in Canada in 2025

Why is the Cybersecurity Act useful?

• No longer be satisfied with technical recommendations or scattered policies
• The need to adopt a legal and proactive approach, hence the birth of Bill C-26 (Cybersecurity Act)

Problem: Today, what is the level of adoption of the Cybersecurity Act?

Canadian legal framework, trends and statistics

-Introduced in 2022, Bill C-26 aims to strengthen the cybersecurity of critical infrastructure by introducing obligations for so-called strategic companies and amending:

• Laws on communication, on emergency managementn des urgences

-Key objectives of Bill C-26:

• Enforce the application of minimum protection measures for critical systems
• Request cybersecurity incident reports (Generally 24-hour complaint deadline)
• Require immediate patches for critical vulnerabilities

-Entities concerned: Telecommunications – Energy (electricity, oil, gas) – Transport (rail, maritime, air) – Financial services – Health – etc.

According to the CCC (Canadian Centre for Cybersecurity), more than 40% of targeted entities have not yet implemented cybersecurity program measures in accordance with minimum requirements.

Risks, real cases, consequences

-We have recorded several major incidents in recent years:

• Ransomware Attack on the Newfoundland Health Authority (2021)
• Attempts to Infiltrate Telecommunications Networks (2022-2023)
• Hacking of a Rail Transportation Provider’s Database (2024)

-These incidents revealed:

• Lack of intersectoral coordination
• Delays in detection and response
• Lack of awareness of the legal framework by many subcontracting SMEs

Consequences: Under Bill C-26, failure to comply with the requirements may result in sanctions, court orders, or even the suspension of certain operations.

Key Recommendations

For Large Enterprises / Critical Infrastructure:

• Develop a clear, concise and rapid incident reporting procedure
• Conduct a C-26 compliance audit annually
• Appoint a cybersecurity officer (CISO) and implement appropriate governance
• Comply with the Canadian Centre for Cyber ​​Security Guidelines (CCS Framework)

For SMEs or Subcontractors:

• Update internal security policies
• Establish an incident log and response plan
• Ensure that systems are patched, segmented and continuously monitored
• Regularly seek expert advice as needed

Bill C-26 marks a strategic shift in the posture of the digital landscape in Canada by imposing an unprecedented level of vigilance, traceability and increased preparation.