Bill C-26 / CCSPA Readiness Canada
Cyber Security Readiness for Canadian Critical Infrastructure under Bill C-26 / CCSPA
Praxis-Q prepares Canadian critical-infrastructure operators - telecom, finance, energy, transport - for the Critical Cyber Systems Protection Act (CCSPA) under Bill C-26: cyber security program design, incident reporting workflows and supply-chain risk controls aligned to expected regulatory direction.
Bill C-26 Canada
Bill C-26 / CCSPA Readiness Canada
Cyber Security Readiness for Canadian Critical Infrastructure under Bill C-26 / CCSPA
The Problem
Canada Bill C-26 (CCSPA) will compel critical-infrastructure operators to harden systems and report incidents on strict timelines, with penalties up to $15M. Most designated operators are not yet ready.
What We Do
- Scoping
- Program Design
- Controls
- Incident Reporting
- Assurance
What You Get
- Designation and scope assessment
- Cyber Security Program (CSP) design
- Mandatory incident reporting workflows
- Supply-chain and third-party risk controls
- Maps to NIST CSF and ISO 27001
- Sector-regulator alignment (OSFI, CRTC)
- Tabletop exercises and IR readiness
- Board and executive reporting
Why weeks, not months
AI-assisted evidence review, one client portal
Every Bill C-26 Canada engagement runs on the Praxis-Q compliance platform. You upload evidence per control, AI scores it against the requirement, and your auditor reviews in the same workflow — from scoping through to the issued, publicly verifiable certificate.
AI evidence scoring
Every upload is scored against the control before an auditor sees it — gaps surface in minutes, not at the review meeting.
One client portal
Scoping, evidence, auditor queries and status live in one place. No email chains, no spreadsheet trackers.
Auditor sign-off
Praxis-Q auditors review inside the same workflow, so review rounds shrink and the certificate issues sooner.
Who is a 'designated operator' under the CCSPA
Schedule 2 of the Act lists the classes of operators in scope, and as of Royal Assent that schedule was still to be populated by regulation — meaning the exact list of covered entities within the six eligible sectors (telecom, pipelines/power lines, nuclear, transportation, banking, clearing/settlement) is still being finalized. Organisations in these sectors should assume designation is likely and start preparing rather than waiting for the final list.
The five required elements of a cybersecurity programme
The Act requires programmes addressing: identification and management of cyber risks including supply-chain and third-party risk; protection of critical cyber systems from compromise; detection of cybersecurity incidents; minimization of the impact of incidents; and any other matter prescribed by regulation. Programmes must be documented, submitted to the sector regulator, and reviewed annually at minimum.
72-hour incident reporting to the CSE
Operators must report cybersecurity incidents affecting critical systems to the Communications Security Establishment (CSE) within a timeframe expected not to exceed 72 hours, with the exact period to be set by regulation. The reporting threshold is broad — incidents that interfere or 'may interfere' with vital service continuity or system security must be reported, with the relevant regulator also notified.
Board and officer accountability
Directors and officers face personal liability for CCSPA violations they direct, authorize, assent to, acquiesce in, or participate in — independent of whether the corporation itself is prosecuted. A documented due-diligence defense exists, which makes board-level cyber governance and a well-evidenced compliance programme a direct legal protection, not just good practice.
Penalties and building the programme ahead of designation
Administrative monetary penalties reach up to $500,000 per violation for individuals and $15 million per violation for organisations (statutory maximums, with actual amounts to be set by regulation), plus criminal offences carrying up to five years' imprisonment for indictable offences. Given the phased coming-into-force and pending regulations, we help likely-designated operators build the cybersecurity programme, supply-chain risk process, and incident reporting workflow now, so the transition once regulations land is operational rather than a scramble.