Canada’s Bill C-8 redefines critical infrastructure security

Canada’s new Critical Cyber Systems Protection Act (Bill C-8) introduces a strict 72-hour cyber incident reporting mandate. Find out how Tenable is helping critical national infrastructure operators bridge the IT/OT divide to ensure full compliance.

With the enactment of Canada’s Critical Cyber Systems Protection Act (CCSPA), commonly known as Bill C-8, the Canadian federal government is laying down a clear framework to protect the cyber-physical systems that are vital to national critical infrastructure security.

For designated operators in telecommunications, energy, transportation, and banking, the mandate is clear: Establish formalized cybersecurity programs, mitigate supply chain risks, and — most critically — report cyber incidents to authorities within 72 hours.

Failure to comply carries heavy consequences, including penalties that can reach up to $15 million Canadian dollars (CAD). But beyond the threat of fines, Bill C-8 highlights a fundamental operational challenge that many industrial organizations are still struggling to solve: How can you detect, investigate, and report a breach in 72 hours when you lack unified visibility across your converged IT and OT environments?

Requirements for meeting Bill C-8’s 72-hour incident reporting mandate

In modern industrial operations and critical infrastructure, the line between IT and OT continues to blur. The introduction of connectivity (e.g., IoT-connected cameras and building management systems) has optimized processes and service delivery, but it has also introduced new cyber exposures. Today, threat actors do not honor traditional network silos; they frequently compromise a web-facing IT asset or IoT device and move laterally into the operational technology (OT) environment to disrupt physical processes.

Meeting a 72-hour incident reporting window is nearly impossible if your security team is relying on fragmented point solutions. Solutions that focus exclusively on passive OT network monitoring often leave massive blind spots — especially considering that IT and IoT devices can constitute up to 50% of an industrial environment. When an incident occurs, teams waste precious hours manually correlating alerts across disconnected tools rather than actively investigating the root cause.

To comply with CCSPA and protect uptime, critical national infrastructure (CNI) operators must bridge the IT/OT security divide.

Establish your CCSPA cybersecurity baseline

The CCSPA requires operators to implement formalized cybersecurity programs. The foundation of any mature security program is a comprehensive asset inventory — you cannot secure what you cannot see. 

The Tenable One Exposure Management Platform helps organizations eliminate security blind spots by building a complete, unified inventory of all OT, IoT, and IT assets. Tenable goes beyond passive-only network monitoring with our proprietary Safe Active Query technology. This hybrid approach safely communicates with industrial devices in their native protocols to uncover significantly more assets than passive monitoring alone — including dormant process control systems, shadow IT, and unmanaged IoT — without disrupting process integrity or impacting equipment uptime.

Prioritize what matters for physical safety

Once you have established your security baseline, the next challenge is managing the inevitable flood of vulnerabilities. In highly regulated sectors, patching every vulnerability is simply not feasible, in part due to strict requirements for operational uptime.

Instead of drowning your security teams in theoretical alerts, Tenable utilizes predictive Vulnerability Priority Rating (VPR) scoring. VPR uses data science and threat intelligence to measure the real-world exploitability of a vulnerability. 

By pinpointing the small fraction of critical flaws that actually threaten physical safety and production uptime, organizations can confidently prioritize remediation efforts and map their controls directly to CCSPA requirements and other compliance frameworks and industry standards like: 

Automate response to beat the clock

To report an incident within 72 hours, you must be able to detect it instantly. Unlike similar reporting requirements in other regulations, the C-8 bill starts the reporting countdown the moment a cyber incident occurs, not when it’s detected. Tenable One leverages an advanced multi-detection engine, which combines behavioral anomalies, signature-based detection, and policy violations from Tenable One OT Exposure to uncover high-risk events in real time.

Tenable maximizes your existing security investments through enterprise-scale integrations. By feeding critical OT intelligence directly into IT workflow platforms like ServiceNow and Jira with AI-powered workflow orchestration, you can automate incident response workflows in real-time across the necessary IT and OT teams when an anomaly is detected. This drastically reduces MTTR and provides the forensic context needed for rapid, accurate reporting.

Source: Mobilization Quick Reference Guide, Tenable Docs

Don’t wait for the audit

Canada’s Bill C-8 is more than a compliance mandate; it is a wake-up call for critical infrastructure operators to mature their cybersecurity posture. Stop reacting to fragmented alerts and start managing risk across your entire cyber-physical ecosystem.

Are you ready for the 72-hour reporting window? Request a demo of Tenable One OT Exposure today to see how you can unify your digital and physical attack surface, establish your CCSPA baseline, and secure your operations without disrupting productivity.