A new bill in Canada seeks to force organizations in critical sectors like banking and transportation to implement cybersecurity programs, and immediately report any detected security breaches. Part of the proposed Critical Cyber Systems Protection Act, the law is intended to help protect Canadians from cyberattacks related to systems that people can’t avoid using or engaging with.
Specifically, the bill will force those in critical sectors to not only report the incidents to their regulators, but also keep detailed records of each incident, their overall cybersecurity program, and efforts taken to reduce their risks to a supply chain or third-party vulnerabilities.
Says Daniel Michaluk, a cybersecurity, privacy and information management lawyer at Borden Ladner Gervais, to Canadian Lawyer magazine of the information required to be captured as part of the bill, “That information base may be useful to law enforcement in protecting everybody. That’s the direct, potentially positive impact of the bill, that law enforcement will be better at helping others and fighting cybercrime.”
The response to the bill, however, is not universally positive, with some questioning whether the bill goes far enough. Says Christian Leuprect, a professor at Queen’s University and senior fellow in security and defense at the Macdonald Laurier Institute, to IT World Canada, “There’s nothing particularly innovative here. What we’re doing with this legislation our major partners have already done and are significantly further ahead in many cases than we are.”
