← Back to Feed
Canada’s Bill C-8 is here: Why the 72-hour reporting rule will redefine critical infrastructure security
July 30, 2026 · Tenable Blog · Severity: CRITICAL
Canada's Bill C-8 mandates critical infrastructure operators to report cyber incidents within 72 hours and establish formal cybersecurity programs. Compliance requires unified visibility across IT and OT environments, with penalties up to $15 million CAD for failures.
Key Takeaways
- Bill C-8 introduces stringent 72-hour cyber incident reporting and heavy penalties for operators.
- Hybrid IT/OT discovery with safe active querying helps establish a required security baseline.
- Predictive VPR scoring prioritizes critical flaws threatening physical safety and uptime.