Cybersecurity and Bill C-26

The bill allows the federal government to share technical or confidential information, as necessary, to protect vital infrastructure. Specifically, the Cyber Centre would be able to:

1. Share its findings with designated operators belonging to the same sector.
2. Inform regulators of a designated operator's failure to implement a cybersecurity program.

If regulators request advice, guidance, or services from CSE, the regulator may provide to CSE any information, including confidential information, about the designated operator's cybersecurity program and mitigation of risk from the supply chain, or use of third-party products and services.

The bill allows the federal government to issue cybersecurity directions to designated operators to protect a critical cyber system as they see fit, mandating compliance and maintaining records of compliance.

These directives are set out as follows:

1. Identify the designated operators.
2. Specify the required cybersecurity actions to be employed.
3. Outline an implementation period.

Upon failure to comply, the bill allows each regulator to issue monetary penalties, with maximum penalties to be established by regulation at amounts of up to $1 million in the case of an individual, and up to $15 million in any other case.

Administrative monetary penalties may be issued for any violation of the CCSPA, including failing to report a cybersecurity incident and failing to comply with a cybersecurity directive.

Regulators will also have the authority to initiate regulatory proceedings leading to fines and possible imprisonment for non-compliance with the provisions of the CCSPA.

Security safeguards are meant to protect an organization's information assets from unauthorized disclosure, disruption, access, use, or modification. BDO recommends having the following key safeguards in place to ensure confidentiality, integrity, and availability of your organization's information assets:

1. Risk management programs – Build awareness of organizational risk by conducting assessments of your controls and processes, establishing risk registers, assigning roles and responsibilities to manage risk accountably, and developing operating standards that meet compliance requirements. Being risk aware is the first step on the road to cybersecurity maturity.
2. Secure platforms and architectures – Utilize secure cloud platforms with built-in security features that accelerate organizations' journey to security.
3. Continuous monitoring, detection, and response capability – Maximize your threat response capabilities and threat awareness by leveraging tools that provide detection capability with actionable alerting.
4. Offensive security – While having procedures and policies in place is important, testing organizational controls by running a simulated test is equally important. Controlled testing that employs a threat actor's tactics can help identify and remediate any weaknesses in your people, process, and technology controls.
5. Asset and vulnerability management – Build your IT asset inventory list and leverage tools to identify the vulnerabilities within your network. Removing vulnerabilities in priority assets reduces risk.
6. Incident response (IR) and data recovery (DR) procedures – It is not a matter of if one gets breached, but when. Having appropriate IR and DR plans with actionable steps, roles and responsibilities, and offline contact information helps speed your organization's containment and recovery times.
7. Threat awareness – Leverage cyber threat intelligence to protect your organization against common threats and threat actors who plan to attack or exploit your organization on the dark web.