On June 16, Canada’s Bill C-8, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, received Royal Assent and became law.

ISC2 commends the Government of Canada for passing this important legislation, which will help protect the country’s critical national infrastructure and strengthen resilience against evolving cyber threats. The Act marks a significant step forward in safeguarding telecommunications, energy, transportation, financial systems and other essential services Canadians depend on every day.

After years of development, Bill C-8 introduces stronger authorities to manage cyber risk while maintaining flexibility to adapt to a rapidly evolving threat landscape. It also reinforces Canada’s commitment (both domestically and among its allies) to strengthening the security of critical systems.

As regulations begin to take shape, cybersecurity professionals will play a central role in translating legislative intent into operational reality. Below, ISC2 explores what this bill means for the workforce, organizations and the broader cybersecurity ecosystem.

For ISC2 members, Bill C-8 emphasizes the growing importance of cybersecurity professionals in shaping how organizations manage operational risk, protect critical services and demonstrate accountability. As implementation details emerge, ISC2 members working in or supporting critical sectors will be well positioned to help organizations interpret requirements, strengthen incident response capabilities and build the governance structures needed to meet new expectations.

Cybersecurity Workforce and Skills Implications

How will Bill C-8 shape demand for cybersecurity skills in Canada?

Bill C-8 shifts many established cybersecurity practices from voluntary guidance to mandatory expectation. While detailed regulations are still forthcoming, the legislation signals a clear direction: organizations will be required to demonstrate stronger risk management, improved incident response readiness and greater accountability across their operations and supply chains.

This shift is expected to increase demand for cybersecurity professionals with expertise in risk management, governance, incident response and compliance, as well as familiarity with frameworks such as NIST CSF 2.0. Importantly, demand will extend beyond regulated entities to include third-party vendors and service providers that support critical infrastructure, broadening the overall need for skilled practitioners.

What skills and capabilities will organizations need to prioritize?

Organizations should expect to place greater emphasis on end-to-end cybersecurity capabilities, including:

  • Comprehensive risk assessments, particularly across supply chains and third-party relationships
  • Incident detection, response and reporting aligned to regulatory timelines
  • Governance and compliance programs that can demonstrate accountability

Beyond technical expertise, this approach will require stronger integration across legal, privacy and executive leadership functions. As regulations evolve, organizations will benefit from professionals who can operate at both strategic and operational levels.

How can organizations prepare now?

Organizations can begin preparing by evaluating their current cybersecurity maturity against expected regulatory outcomes. This preparation includes reviewing incident response processes, supply chain oversight and internal governance structures.

Equally important is investing in workforce development. Hiring and developing certified cybersecurity professionals remains critical, but preparation should also include continuous training, upskilling and closer alignment with academic and training institutions to ensure a sustainable talent pipeline.

Operational and Leadership Impact

What changes can critical infrastructure operators expect?

Operators in regulated sectors should anticipate increased oversight and more clearly defined compliance obligations. This aspect includes heightened expectations for managing third-party risk, maintaining detailed documentation and demonstrating readiness to respond to cyber incidents within defined timeframes, including the 72-hour reporting requirement outlined in the legislation.

In practice, these changes will require more formalized processes, improved coordination across teams and stronger investment in cybersecurity capabilities that can scale with regulatory expectations.

What will this impact mean for cybersecurity leaders?

Cybersecurity leaders, including CISOs, will play a more visible and accountable role under Bill C-8. Responsibilities will likely expand to include ensuring organizational readiness for regulatory compliance, overseeing incident reporting obligations and integrating cybersecurity risk more directly into enterprise risk management and executive decision-making.

This evolution reinforces the need for cybersecurity leadership to operate as a strategic function, bridging technical execution with business and regulatory priorities.

What Bill C-8 Implementation Means for ISC2 Members

How can cybersecurity professionals prepare for Bill C-8?

ISC2 members working in or supporting affected sectors can begin preparing now by taking practical steps to understand how Bill C-8 may shape future expectations. As regulations develop, members should monitor implementation guidance, review whether their organizations’ incident response and reporting processes are ready for potential new requirements and strengthen their understanding of third-party and supply chain risk.

Members can also use ISC2 chapters, webinars, professional networks and continuing professional education opportunities to build skills in governance, risk management, compliance, incident response and executive communication. These activities can help members stay informed, identify emerging skills needs and position themselves to support organizations as implementation requirements become more defined.

What role can members play in shaping cybersecurity policy?

Cybersecurity professionals bring critical, real-world insight into how policy translates into practice. Through engagement with industry groups, consultations and professional associations, members can help ensure that emerging requirements are both effective and operationally feasible.

Their input can inform policy decisions related to timelines, workforce capacity and implementation challenges, helping to align regulatory goals with the realities faced by organizations on the ground.

ISC2 Perspective

ISC2 continues to engage with governments, regulators and industry stakeholders worldwide to support effective, workforce-informed cybersecurity policy.

In Canada, ISC2 contributed to the development of Bill C-8 through testimony and policy engagement and looks forward to supporting its implementation as regulations are defined. Globally, ISC2 will continue to advocate for policies that recognize the importance of a skilled cybersecurity workforce and promote the adoption of professional standards that strengthen security outcomes across sectors.

For more information about ISC2 Advocacy, visit https://www.isc2.org/about/advocacy

Appendix:

 

Timeline of how long it took Bill C-8 to pass (formerly C-26).