Bill C-26 explained: what Canadian critical infrastructure needs to know

What Bill C-26 actually does

Bill C-26, formally introduced as An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, was introduced in June 2022 and has moved through Parliament in stages. The substantive component for most operators is Part 2: the Critical Cyber Systems Protection Act (CCSPA).

The CCSPA establishes a framework under which the Governor in Council can designate sectors and operators as subject to cyber-security obligations. Once designated, operators must:

• Establish, implement, and maintain a cyber-security programme
• Mitigate supply-chain and third-party risks
• Report cyber-security incidents to the Communications Security Establishment (CSE) and the relevant regulator
• Comply with cyber-security directions issued under the Act

Who is covered

The Act applies to operators in designated sectors. At introduction, six sectors were named:

• Telecommunications
• Energy (pipelines, nuclear, interprovincial power)
• Finance (banking, clearing and settlement)
• Transportation (federally-regulated)

Additional sectors are expected to be designated by regulation. The framework is deliberately extensible: the threat landscape is moving, and the Act anticipates that designated-sector lists will grow.

What "cyber-security programme" obligations imply for cloud

The CCSPA does not prescribe technical controls. Instead, it requires that operators "take reasonable steps" to protect their critical cyber systems. The interpretive guidance — and the implicit floor for designated operators — has crystallised around several themes:

• Supply-chain risk. Operators must assess and mitigate risks from third-party providers, including cloud platforms. A US-controlled hyperscaler holding critical operational data is a supply-chain risk under the Act.
• Sovereignty of operational data. Although the Act doesn't use the word "sovereignty," guidance increasingly treats foreign legal-process exposure as a risk to be mitigated.
• Incident reporting. Reporting requirements assume the operator can produce signed, verifiable artefacts of system state and access.

The implicit cloud-sovereignty pressure

Bill C-26 doesn't say "don't use US clouds." It says "manage your supply-chain risk." For most designated operators, the practical implication is that critical operational data should live in architectures where compelled-disclosure exposure can be quantified and limited.

This is where multi-cloud RAID architectures change the conversation. Under SkyeConnex's topology, no single provider — and no single jurisdiction — can compel access to readable data. The supply-chain risk attached to any one provider drops sharply, because the architecture doesn't depend on any one provider being trustworthy.

Reporting and verifiable evidence

The Act's incident-reporting and oversight mechanics assume operators can produce evidence. Most cloud platforms produce evidence that depends on the platform itself: "trust our logs." That is awkward when the operator is reporting an incident about the platform.

Architectures that produce externally-verifiable evidence — dual-signed audit logs, offline-verifiable integrity certificates — answer this concern structurally. SkyeConnex's audit log is dual-signed with HMAC-SHA-256 and ML-DSA-87. Auditors and regulators can verify reports offline against the platform's published issuer key without trusting the platform.

How SkyeConnex maps to CCSPA obligations

• Supply-chain risk mitigation: No single provider holds enough of any file to read or destroy it. The architecture is provider-agnostic by construction.
• Jurisdictional risk mitigation: Allow-list and block-list geo-policy enforced at upload. Real-time SkyeMap shows where every file's shards reside.
• Incident reporting evidence: Dual-signed audit log, offline-verifiable. Reports can be reproduced by regulators without contacting the platform.
• Provincial / federal residency mandates: Per-account and per-company geo policies cascade through reseller → company → account.

What to do now

• If your sector is on the initial designated list, formalise your cloud supply-chain risk assessment this quarter.
• If your sector is plausibly next, get ahead of the requirement now — sovereign-cloud postures are easier to defend at audit when they were designed in, not retrofitted.
• For operators already running multi-cloud, evaluate whether your topology is replicated (single-provider exposure) or erasure-coded (no single-provider exposure).

For a sector-specific briefing — Telecom, Energy, Finance, Transportation — book 45 minutes. We will walk through CCSPA implications and how SkyeConnex maps to them.

---

Published April 12, 2026 · Written by SkyeConnex Inc. · More from the SkyeConnex blog