Critical Cyber Systems Protection Act (S.C. 2026, c. 9, s. 11)

Marginal note:Mitigation — supply-chain or third-party

15 As soon as any cyber security risk associated with the designated operator’s supply chain or its use of third-party products and services has been identified under paragraph 9(1)(a), the designated operator must mitigate those risks.

Marginal note:Guidelines on mitigation of risks

15.1 The Communications Security Establishment may, in consultation with relevant industry stakeholders, develop guidelines on the mitigation of risks associated with supply chains and the use of third-party products and services, taking into consideration internationally recognized frameworks such as those developed by the International Organization for Standardization on cybersecurity in supplier relationships.

Marginal note:Guidance from Communications Security Establishment

16 An appropriate regulator may provide to the Communications Security Establishment any information, including any confidential information, respecting a designated operator’s cyber security program or any steps taken under section 15, for the purpose of requesting advice, guidance or services from the Communications Security Establishment in accordance with the mandate of the Communications Security Establishment, in respect of the exercise of the appropriate regulator’s powers or the performance of its duties and functions under this Act.

Marginal note:Report — cyber security incident

17 A designated operator must, within a period prescribed by the regulations, not to exceed 72 hours, report a cyber security incident in respect of any of its critical cyber systems to the Communications Security Establishment in accordance with the regulations, for the purpose of enabling the Communications Security Establishment to exercise its powers or perform its duties and functions.

Marginal note:Notify

18 Immediately after reporting a cyber security incident, the designated operator must

• The following provision is not in force.

  (a) notify the appropriate regulator, in the form and manner prescribed by the regulations that the report was made; and

• The following provision is not in force.

  (b) give a copy of the report to the appropriate regulator.

Marginal note:For greater certainty

18.1 For greater certainty, nothing in sections 17 and 18 affects the provisions of the Personal Information Protection and Electronic Documents Act.

Marginal note:Communications Security Establishment — provision of incident report

19 The Communications Security Establishment must, without delay, at the request of a regulator, give that regulator a copy of any incident report or any portion of it that relates to a designated operator in respect of which that regulator is the appropriate regulator, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations.

Marginal note:Direction

• The following provision is not in force.

  20 (1) The Governor in Council may, by order, direct any designated operator or class of operators to comply with any measure set out in the direction for the purpose of protecting a critical cyber system, if the Governor in Council believes on reasonable grounds that it is necessary to make the order for that purpose.

• The following provision is not in force.

  Marginal note:Private communication

  (1.1) Despite subsection (1), the Governor in Council must not order the decoding of an encrypted private communication, as defined in section 183 of the Criminal Code.

• The following provision is not in force.

  Marginal note:Amend or revoke

  (2) The Governor in Council may, by order, amend or revoke a direction in whole or in part.

• The following provision is not in force.

  Marginal note:Factors

  (3) Before making an order under subsection (1), the Governor in Council must consider

  • The following provision is not in force.

    (a) its operational impacts on affected designated operators;

  • The following provision is not in force.

    (b) its impact on public safety of Canadians;

  • The following provision is not in force.

    (b.1) its impact on the privacy of Canadians;

  • The following provision is not in force.

    (c) its financial impacts on affected designated operators;

  • The following provision is not in force.

    (d) its impact on the delivery of vital services and vital systems to consumers; and

  • The following provision is not in force.

    (e) any other factor that the Governor in Council considers to be relevant.

• The following provision is not in force.

  Marginal note:Scope and substance

  (3.1) The provisions of the direction must, in scope and substance, be reasonable in relation to the purpose of protecting a critical cyber system.

• The following provision is not in force.

  Marginal note:Compliance with direction

  (4) Every designated operator that is subject to a direction must comply with it.

• The following provision is not in force.

  Marginal note:Notification by Minister

  (5) The Minister must, within 90 days after an order is made under subsection (1), notify the National Security and Intelligence Committee of Parliamentarians and the National Security and Intelligence Review Agency of the making of the order.

• The following provision is not in force.

  Marginal note:For greater certainty

  (6) For greater certainty, despite subsection (1), the Governor in Council is not permitted to order any designated operator or class of operators to intercept a private communication or a radio-based telephone communication, as those terms are defined in section 183 of the Criminal Code.

Marginal note:Contents of direction

• The following provision is not in force.

  21 (1) A direction made under section 20 must set out

  • The following provision is not in force.

    (a) the name of the designated operator or the class of operators in respect of which the direction applies;

  • The following provision is not in force.

    (b) the measures to be taken by the designated operator along with any conditions; and

  • The following provision is not in force.

    (c) the period within which those measures are to be taken.

• The following provision is not in force.

  Marginal note:Condition

  (2) In addition to any conditions referred to in paragraph (1)(b), the Governor in Council may impose other conditions in a direction.

Marginal note:Exemption from Statutory Instruments Act

• The following provision is not in force.

  22 (1) An order made under section 20 is exempt from the application of sections 3, 5 and 11 of the Statutory Instruments Act.

• The following provision is not in force.

  Marginal note:Precondition for contravention

  (2) A designated operator must not be found to have contravened a direction made under section 20 unless it is proved that, at the time of the alleged contravention, the designated operator had been notified of the direction or reasonable steps had been taken to bring the purport of the notice to those designated operators likely to be affected by it.

• The following provision is not in force.

  Marginal note:Certificate

  (3) A certificate purporting to be signed by the Minister or responsible minister and stating that a notice containing the order was given to designated operators likely to be affected by it is, in the absence of evidence to the contrary, proof that notice was given to those designated operators.

Marginal note:Exchange of information

• The following provision is not in force.

  23 (1) To the extent necessary, for any purpose related to the making, amending or revoking of a cyber security direction in respect of a designated operator, the following persons or entities may collect information from and disclose information, including confidential information, to each other:

  • The following provision is not in force.

    (a) the Minister;

  • The following provision is not in force.

    (b) the responsible minister;

  • The following provision is not in force.

    (c) the appropriate regulator;

  • The following provision is not in force.

    (d) the Minister of Foreign Affairs;

  • The following provision is not in force.

    (e) the Minister of National Defence;

  • The following provision is not in force.

    (f) the Chief of the Defence Staff;

  • The following provision is not in force.

    (g) the Chief or an employee of the Communications Security Establishment;

  • The following provision is not in force.

    (h) the Director or an employee of the Canadian Security Intelligence Service; and

  • The following provision is not in force.

    (i) any other person or entity that is prescribed by the regulations.

• The following provision is not in force.

  Marginal note:Confidential information

  (2) Any confidential information, within the meaning of this Act or any other Act of Parliament that applies to or is administered by a person or entity referred to in subsection (1), that is collected or disclosed under that subsection must be treated as confidential.

Marginal note:Prohibition against disclosure

24 Every designated operator that is subject to a cyber security direction is prohibited from disclosing, or allowing to be disclosed, the fact that a cyber security direction was issued and the content of that direction, except in accordance with section 25.

Marginal note:Disclosure — when allowed

• The following provision is not in force.

  25 (1) A designated operator that is subject to a cyber security direction may disclose the fact that the direction was issued and its content only to the extent necessary to comply with the direction.

• The following provision is not in force.

  Marginal note:Prohibition — further disclosure

  (2) A person must not, without the authorization of the designated operator, disclose or allow the disclosure of any information obtained by them under subsection (1).

Marginal note:Prohibition

• The following provision is not in force.

  26 (1) Subject to subsection (2), a person must not knowingly disclose confidential information or allow it to be disclosed to any agency, body or other person or allow any other agency, body or other person to have access to the information, except if

  • The following provision is not in force.

    (a) the disclosure is required by law;

  • The following provision is not in force.

    (b) the information to be disclosed is publicly available;

  • The following provision is not in force.

    (c) the designated operator to which the information relates consents to its disclosure;

  • The following provision is not in force.

    (d) the disclosure is necessary for the protection of vital services, vital systems or critical cyber systems;

  • The following provision is not in force.

    (e) the disclosure is made in accordance with any provision of this Act; or

  • The following provision is not in force.

    (f) the disclosure is made in accordance with the Security of Canada Information Disclosure Act.

• The following provision is not in force.

  Marginal note:Right to disclose information preserved

  (2) Nothing in this section precludes a person from disclosing confidential information to a law enforcement agency or the Canadian Security Intelligence Service if the disclosure of the information is otherwise lawful.

• The following provision is not in force.

  Marginal note:Confidential information

  (3) Any confidential information that is disclosed or allowed to be accessed under subsection (1) must be treated as confidential.

Marginal note:For greater certainty

26.1 For greater certainty, nothing in this Act affects the provisions of the Privacy Act in relation to the protection of personal information.

Marginal note:Agreements and arrangements — exchange of information

• The following provision is not in force.

  27 (1) Subject to subsection (2), the Minister, a responsible minister or a regulator may enter into an agreement or arrangement, in writing, with the government of a province or of a foreign state, or with an international organization established by the governments of foreign states, for the exchange of information, other than confidential information, relating to the protection of critical cyber systems

  • The following provision is not in force.

    (a) between the Minister, the responsible minister or the regulator, as the case may be, and any institution or agency of that government; or

  • The following provision is not in force.

    (b) between the Minister, the responsible minister or the regulator, as the case may be, and the international organization.

• The following provision is not in force.

  Marginal note:Confidential information — government of province

  (2) Confidential information may be disclosed to any institution or agency of the government of the province only if

  • The following provision is not in force.

    (a) it is disclosed under the agreement or arrangement; and

  • The following provision is not in force.

    (b) the Minister, the responsible minister or the regulator, as the case may be, is satisfied that the information will be treated in a confidential manner and not be further disclosed without their express consent.