🛡️ **CANADA'S BILL C-8 (CCSPA) NOW LAW — 72-HOUR BREACH REPORTING REQUIREMENT EFFECTIVE**
Published Friday, July 31, 2026 at 10:20 AM PT BLUF: Canada’s Critical Cyber Systems Protection Act (Bill C-8) has received Royal Assent and is now in force, imposing a mandatory 72-hour incident reporting requirement on critical infrastructure operators. Organizations providing essential services in Canada must align incident response and disclosure procedures with this reporting timeline immediately. DETAILS Bill Status: Royal Assent received; law is now active. Formal title: Critical Cyber Systems Protection Act (CCSPA). Reporting Requirement: Critical infrastructure operators must report cyber incidents within 72 hours. The material does not specify whether this 72-hour clock begins at discovery, notification, or incident confirmation. Scope: Applies to “critical infrastructure operators.” The material provided does not detail the specific sectors or organization types captured under this definition (e.g., energy, water, telecommunications, transportation, financial systems, healthcare). Enforcement & Penalties: Material provided does not specify penalties for non-compliance, enforcement authority, or exemption criteria. Regulatory Authority: Enforcement likely falls to Public Safety Canada or CISA-equivalent Canadian agency; detail unclear from available material. IMPACT ...