OPINION: Cybersecurity legislation has passed. Now the real work begins

The years-long debate over Canada’s critical infrastructure cybersecurity legislation is finally over. Bill C-8, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, and its predecessor C-26 spent years working its way through Parliament. While cybersecurity legislation was being debated in Canada, the threat landscape was rapidly evolving in a world of rising geopolitical tensions and AI-enabled attacks. The passage of Bill C-8 is an overdue milestone in advancing cybersecurity preparedness for critical infrastructure operators in this context. But just as importantly, it’s a signal to all organizations of where cybersecurity preparedness is going in Canada. In March 2025, Nova Scotia Power experienced a significant Canadian cyber breach when what is believed to be a Russia-based threat actor was able to compromise the personal information of hundreds of thousands of Canadians, including driver's licences and social insurance numbers. This event is a reminder of what the Canadian Centre for Cyber Security described as “an expanding and complex cyber threat landscape,” where two in 10 Canadians have been victims of a successful cyberattack or data breach in the past year, according to CIRA’s own research. C-8 implementation is underway—new government powers have been established for the telecommunications sector, while the broader cybersecurity regime for designated operators is coming. Orders and regulations still need to clarify who will be designated operators and provide more details on programs and incident reporting requirements. The implementation details are obviously important from a compliance perspective, but compliance should not be confused with security. Here are three practical issues, aligned with the emerging C-8 framework, that organizations need to think through to develop stronger cybersecurity practices. First, understand that the impacts and expectations created by C-8 will extend well beyond those who are directly regulated. We know the sectors it will directly touch—telecommunications, banking, energy, transportation—but C-8 also includes expectations around supplier risk. In practice, that means C-8-related commercial expectations are likely to start flowing through the supply chain. Security assessments, contractual arrangements and incident notification requirements can all reasonably be expected to be part of the new way of doing business with regulated entities, and preparations can start now. This leads to a second point, which is matching cyber investments with an organization’s capacity. Not everyone has a large cybersecurity team or the resources to build sophisticated defences from scratch. Finding right-sized, layered controls and solutions that are effective but straightforward to deploy is critical. Canadian options should be part of this solution set wherever they meet the need, strengthening not just an organization’s own cybersecurity suite, but Canada’s domestic cyber capacity and digital sovereignty as well. Finally, be prepared to act if there is an incident. The latest Statistics Canada data showed only 26 per cent of Canadian businesses had written cybersecurity policies in place. More than just understanding incident reporting compliance requirements, incident readiness involves being able to detect, assess, escalate, contain and notify. Organizations need to have the capacity to understand when they’ve been compromised and what happened, then act quickly. Putting this all together, Bill C-8 will provide new legal obligations for some but a cyber preparedness roadmap for all. The next step is turning it into practical security: understanding internal cyber dependencies and readiness, finding the right tools that are fit for purpose and having the systems and processes in place to respond. Cyber threats didn’t change because C-8 passed. But how we prepare for and respond to them can. Byron Holland is the president and chief executive of CIRA (the Canadian Internet Registration Authority), the national not-for-profit best known for managing the .CA domain and developing new cybersecurity, DNS, and registry products and services. The positions and opinions expressed by The Wire Report columnists and contributors are solely reflective of the author’s perspective and do not necessarily reflect The Wire Report’s views or values.

OPINION: Cybersecurity legislation has passed. Now the real work begins

Opinion |
By Byron Holland
|October 8, 2026

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

OPINION: Cybersecurity legislation has passed. Now the real work begins

Opinion | By Byron Holland |October 8, 2026

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Liberals propose amendments to Radiocommunication Act in effort to reduce red tape

CRTC dismisses challenge raising concerns of government interference

CMPA survey finds continuing public support for Online Streaming Act

Related Stories

OPC launches investigation into ID verification company following breach

Eastlink data breach affects 75,000 customers

Cybersecurity, 6G set to pose challenges for telecoms: Bell CTO

Liberal cybersecurity bill receives Royal Assent

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Opinion |
By Byron Holland
|October 8, 2026