For a BC firm with 20 to 250 staff, start with two questions: does your firm fall within a designated operator class, and do your clients depend on your systems? The enacted Critical Cyber Systems Protection Act (CCSPA) separates designated operators from their suppliers, while expressly addressing supply-chain risk. CCSPA, sections 2, 7, 8 and 15.
We recommend preparing evidence of your security controls before agreeing to new client requirements. That preparation is useful whether you run an accounting practice, a consulting firm or a financial advisory business. Treat the steps below as our practical recommendations, not a finding that your firm has a new statutory duty.
Bill C-8 in Canada: enactment and commencement differ
As of October 9, 2026, Bill C-8 has received Royal Assent. LEGISinfo records assent on June 15, 2026, as Statutes of Canada 2026, chapter 9. This is Bill C-8 from the 45th Parliament, 1st session, introduced on June 18, 2025. Its full title is An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts. Parliament of Canada, LEGISinfo.
The legislative stage is therefore completed, rather than awaiting passage. Implementation is a separate question. Public Safety Canada says the Telecommunications Act amendments took effect on Royal Assent, while CCSPA implementation will be phased. Public Safety Canada, June 16, 2026.
Status checked October 9, 2026: the Justice Canada CCSPA consolidation, current to September 21, 2026, marks the Act as enacted but not in force. Do not treat that consolidation date as confirmation of every subsequent implementation decision. Recheck commencement orders, regulations and designation before deciding which obligations apply to your firm. Justice Canada, CCSPA.
For background, the Library of Parliament’s April 20, 2026 legislative summary explains the relationship to the earlier Bill C-26 and the amendments made during Commons consideration. It predates Royal Assent, so use LEGISinfo for legislative status. Library of Parliament, legislative summary, page 1.
Two parts change different responsibilities
Part 1 amends the Telecommunications Act. It adds telecommunications security as a policy objective and gives the Governor in Council and Minister of Industry powers to direct telecommunications service providers to take security measures. It also adds enforcement provisions. Royal Assent text, Part 1 and summary.
Part 2 enacts the Critical Cyber Systems Protection Act for federally regulated vital services and systems. It also makes consequential amendments to the Office of the Superintendent of Financial Institutions Act, Nuclear Safety and Control Act, and Transportation Appeal Tribunal of Canada Act. Part 3 requires a five-year review. Royal Assent text, Parts 2 and 3.
For a professional firm buying internet and phone services, Part 1 targets the provider’s responsibilities. For a supplier supporting a designated operator’s critical systems, Part 2 is the relevant starting point for discussing third-party risk. This distinction follows the recipients of the duties in the enacted text; it is not a determination of your firm’s legal status. Royal Assent text, Telecommunications Act sections 15.1 and 15.2; CCSPA sections 8 and 15.
Coverage depends on designation, not staff count
The framework targets finance, telecommunications, energy and transportation. Schedule 1 lists six vital services and systems: telecommunications; interprovincial or international pipelines and power lines; nuclear energy; federally regulated transportation; banking; and clearing and settlement. Public Safety Canada, sector coverage; Library of Parliament, section 2.2.2.
A designated operator belongs to a class in Schedule 2. Section 7 provides for adding classes and their regulators. The consolidation consulted on October 9, 2026, current to September 21, has an empty Schedule 2. Working in financial services, supplying a bank or having 250 employees does not, by itself, establish designation under that definition. CCSPA, sections 2 and 7, Schedule 2.
Ask counsel to assess your firm’s actual activities and any applicable designation order. Keep that assessment separate from reviewing a client’s contract. Use the dated primary sources above for Bill C-8 status.
What designated operators would need to do
Once applicable provisions are in force and an operator is designated, the enacted framework calls for a cybersecurity program, ongoing maintenance and review, incident reporting, records and compliance with cybersecurity directions. Royal Assent text, CCSPA sections 9 to 13, 17, 20 and 30.
The program deadline is tied to membership in a designated class after publication of the section 7 order, not simply Royal Assent. The enacted reporting period is to be prescribed by regulation and cannot exceed 72 hours. Neither deadline is a universal reporting rule for BC suppliers. CCSPA, sections 9 to 11 and 17.
For a supplier, we recommend asking the client which service, system and contract clause its request concerns. Do not copy an operator’s statutory deadlines into your procedures without checking your own responsibilities and the agreed notification terms.
How client requirements could reach your firm
The supply-chain connection is explicit: section 9 includes third-party risk in the operator’s program, section 15 addresses mitigation, and section 14 addresses material supply-chain changes. Our practical inference is that clients preparing for those duties could ask suppliers for evidence or revised terms. That is a possible contractual effect, not automatic supplier designation or proof that every client will change its requirements. CCSPA, sections 9, 14 and 15.
For example, consider a hypothetical BC consulting firm supporting a bank’s business process. We would ask the firm to map any client-system access, information transfers and subcontractors before answering a security questionnaire. If the work connects to a critical system, ask the client to identify the relevant dependencies and evidence it needs.
Prepare to discuss access controls, incident contacts, recovery testing and changes to subcontractors. These are our suggested discussion topics, not a prescribed Bill C-8 questionnaire. Have counsel review requested audit rights, notification deadlines, confidentiality terms and responsibility for costs before accepting them.
Five preparation steps for BC firms
1. Record why each requirement applies
Create a short register with separate entries for designation, client contracts and other duties counsel identifies. Record the source, review date, owner and next action. Avoid a single checkbox labelled “Bill C-8 compliant”.
For a financial firm, ask counsel to confirm the legal entity and regulated activities before building a control plan. For a supplier, attach each client request to the actual service agreement. Review unresolved requests with management before making commitments.
2. Map client data and access
List systems used for client work, administrative accounts, remote connections and subcontractors. Name an owner for each relationship. Record which client can be affected if a system stops working or an account is compromised.
Use that map to review unnecessary access and unsupported software. The Canadian Centre for Cyber Security’s baseline guidance recommends software updates, strong authentication and restricting administrative privileges. Use those controls as a starting point, not as evidence of CCSPA compliance. Cyber Centre, baseline controls, sections 3.2, 3.5 and 3.12.
3. Build a small evidence pack
We recommend keeping dated records of access reviews, update coverage, security training and restore tests. Include open gaps and their owners. Share evidence through an approved channel and remove credentials, client records and unnecessary infrastructure details.
Start with the systems a client actually depends on. Give a specific answer when a control covers only part of your environment. Do not describe a planned control as implemented. Our compliance and risk management services describe support for control documentation and gap analysis.
4. Test incident communication and recovery
Write down who can assess an incident, contact each client and authorize recovery. Agree how to reach those people if email is unavailable. Run a tabletop exercise using a supplier-related incident and record what needs repair.
Test restoration as well as notification. The Cyber Centre recommends an incident response plan and testing backup restoration. These are general security recommendations, not a new statutory timetable for your firm. Cyber Centre, baseline controls, sections 3.1 and 3.7.
5. Review changes before signing
Ask clients to explain any new security schedule. Compare requested notification times, evidence, subcontractor approvals and recovery commitments with what your firm can deliver. Assign unresolved legal questions to counsel and technical gaps to your IT owner.
Schedule another status review when commencement, regulations or designation changes are announced. Keep the dated sources with the decision record. Do not buy a certification or promise an outcome solely because a questionnaire mentions Bill C8.
Start with one client dependency
Choose one important client relationship. Identify the systems it depends on, the agreed incident contact and the evidence you can provide today. Then assign owners to missing controls and unclear contract terms.
For technical help, review our cybersecurity services, or book a fit call. Use counsel to determine legal obligations. Use your IT team to establish what operates today and what still needs work.
