Canada’s Bill C-8 makes critical infrastructure evidence-driven

At a glance

What this is: This is Corelight's analysis of how Canada's Bill C-8 and the CCSPA turn critical infrastructure cybersecurity into a regulated accountability problem, with visibility and evidence at the centre.

Why it matters: It matters because operators in regulated sectors will need provable detection, investigation, and reporting capabilities that can support both operational resilience and compliance expectations.

Context

Bill C-8 changes the operating model for Canadian critical infrastructure by turning cybersecurity from advisory guidance into enforceable obligations. For operators in telecommunications, finance, energy, and transportation, the governance gap is no longer whether controls exist in principle but whether the organisation can show what happened, what was affected, and what was done.

The article's central security problem is evidence quality: modern attackers exploit encrypted traffic, unmanaged devices, cloud environments, and legitimate credentials precisely because those conditions weaken traditional controls and reduce investigative certainty. In that setting, network evidence becomes more valuable because it is harder for an adversary to alter after the fact, and that has direct implications for IAM, third-party access, and incident accountability.

Key questions

Q: What breaks when critical infrastructure operators cannot prove what happened during an incident?

A: They lose the ability to defend scope, timing, and accountability when regulators or executives ask for evidence. In practice, that weakens incident reporting, slows containment decisions, and makes it harder to distinguish malicious activity from normal operational change. The failure is not just technical. It is a governance gap where the organisation cannot substantiate its own cyber claims.

Q: Why do legitimate credentials and encrypted traffic increase risk in regulated environments?

A: Because they let malicious activity blend into normal operations while hiding much of the content that traditional controls rely on. When access looks authorised and traffic cannot be inspected at a useful level, security teams must depend on higher-integrity evidence sources to confirm what was actually done. That is why identity and network telemetry need to be analysed together.

Q: How do security teams know if AI SOC investigations are reliable?

A: They should compare AI determinations with senior analyst conclusions across a representative alert sample, then track evidence completeness, false escalations, and time-to-determination. Reliability is not a vendor claim. It is a measurable alignment between the AI's reasoning and the team's own investigation standard.

Q: Which control matters most when OT and IoT traffic must be monitored without disruption?

A: Passive network monitoring matters most because it preserves operational stability while still exposing commands, protocols, and parameters that can affect physical systems. That is especially important in converged environments where the same incident can involve enterprise identity, industrial control traffic, and device behaviour. The goal is continuous visibility without introducing operational risk.

Technical breakdown

Why visibility becomes a control requirement under Bill C-8

Bill C-8 and the CCSPA shift the burden from informal cyber readiness to demonstrable protection of critical systems. In practice, that means operators need evidence that can support detection, incident reporting, third-party oversight, and auditability across environments that include cloud, on-premises, and operational technology. Visibility is not just about logging more events. It is about preserving trustworthy telemetry that can answer who did what, to which system, and with what outcome, even when credentials are legitimate or traffic is encrypted.

Practical implication: treat network evidence as part of your compliance control set, not as a secondary monitoring function.

How high-fidelity network telemetry supports investigation and AI validation

High-fidelity network telemetry captures protocol context, session behaviour, and command content in a form that is more defensible than many endpoint-only or summary log sources. That matters when investigations must reconstruct timeline, scope, and intent, and it becomes even more important when AI-assisted SOC workflows are used. If the underlying data is thin, AI can accelerate a bad conclusion. If the evidence is rich, AI can support better triage, faster verification, and more defensible reporting. This is especially relevant where legitimate credentials and encrypted traffic obscure traditional indicators.

Practical implication: validate AI-assisted findings against raw network evidence before you rely on them for incident decisions or regulatory reporting.

Why IT, OT, and IoT convergence changes monitoring assumptions

Critical infrastructure environments increasingly combine enterprise IT, industrial control systems, and IoT devices, but those layers do not behave the same way. Passive network monitoring is important here because it avoids operational disruption while still exposing specialised industrial protocols such as Modbus, DNP3, BACnet, ENIP, and S7comm. That gives defenders visibility into commands and parameters that can affect physical operations, not just digital systems. In converged environments, the attack surface includes both identity abuse and process manipulation, so monitoring has to detect unauthorised actions before they influence safety or availability.

Practical implication: extend monitoring into OT and IoT traffic so that unauthorised commands are visible before they become operational incidents.

Threat narrative

Attacker objective: The attacker aims to operate inside critical infrastructure environments without being clearly observed, making detection, attribution, and incident reconstruction harder.

1. Entry occurs through encrypted traffic, unmanaged devices, cloud environments, or legitimate credentials that allow activity to blend into normal operations.
2. Escalation happens when attackers use those trusted paths to move across critical cyber systems while reducing the usefulness of endpoint-only visibility.
3. Impact follows when operators cannot reconstruct scope, validate what changed, or report incidents with confidence because the evidence trail is incomplete.

Breaches seen in the wild

• Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.
• Poland ArcGIS password leak 2023: An ArcGIS login emailed in 2020 was published from stolen mail in 2023 and still worked, exposing Polish military and infrastructure maps.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Visibility debt is now a governance problem, not a tooling preference. Bill C-8 and the CCSPA make it harder for critical infrastructure operators to rely on fragmented monitoring and post-incident reconstruction. The legislation pushes accountability onto the operator, which means evidence quality becomes a board-relevant control issue. Practitioners should treat telemetry coverage and defensibility as part of operational resilience.

Network evidence is the most durable control layer when credentials are legitimate. The article correctly points to an adversary pattern that bypasses many traditional controls: misuse of authorised access, encrypted channels, and unmanaged endpoints. That means identity governance cannot stand alone. It must be paired with network-level corroboration so teams can tell the difference between permitted access and malicious use of permitted access.

Evidence-backed security operations will define the next phase of critical infrastructure defence. As AI-assisted SOC workflows and agentic AI become more common, the weak point is no longer model speed but evidence integrity. A SOC that cannot prove its conclusions will struggle under regulatory scrutiny and incident pressure. Practitioners should make verifiable telemetry the foundation for detection, investigation, and reporting.

Converged IT, OT, and IoT environments need a named control concept: the evidence continuity gap. When industrial protocols, enterprise identities, and cloud services are monitored in separate silos, the organisation loses continuity across the attack path. That gap is where compromise becomes hard to see and harder to explain. The practical answer is not more alerts, but more continuous, defensible evidence across the full operational stack.

What this signals

Evidence continuity gap: critical infrastructure programmes now need a continuous chain from identity event to network action to incident report. When those records live in separate tools, operators can detect activity but still fail to explain it under audit or during regulatory review.

Bill C-8 also signals that resilience programmes will be judged on proof, not intent. For IAM and PAM teams, that means session evidence, privileged activity, and third-party access records have to line up with what the network actually saw, or the control story will not hold.

For practitioners

• Define evidence requirements for regulated cyber reporting Map Bill C-8 obligations to the exact records your teams must preserve for incident detection, containment, and reporting across critical systems.
• Prioritise network telemetry in hybrid and OT environments Expand passive monitoring where endpoint coverage is limited, especially in industrial and IoT segments where command-level evidence matters most.
• Correlate identity events with network activity Join authentication, privilege, and session data to network evidence so legitimate credentials can be evaluated in context rather than assumed benign.
• Validate AI-assisted investigations against raw evidence Require analysts and automation to confirm conclusions using high-fidelity telemetry before findings are used in incident reports or executive updates.
• Test third-party visibility assumptions regularly Review whether external providers and managed connections still produce enough evidence for incident scope, accountability, and regulatory follow-up.

Key takeaways

• Bill C-8 turns critical infrastructure cybersecurity into an evidence problem as much as a protection problem.
• Operators that cannot preserve high-integrity network evidence will struggle to satisfy incident reporting and accountability expectations.
• The strongest response combines identity controls, passive monitoring, and defensible telemetry across IT, OT, and IoT.

Key terms

• High-Fidelity Network Telemetry: Network data captured with enough protocol, session, and content detail to support confident investigation and reporting. It helps defenders understand what happened, not just that something happened, which is critical when logs are incomplete, endpoints are blind, or actors use legitimate access.
• Evidence Continuity Gap: The break that appears when identity, network, endpoint, and operational records cannot be stitched into one reliable incident story. In regulated environments, this gap weakens auditability, delays response, and makes it harder to prove control effectiveness or accountability.
• Defensible Telemetry: Security data that is trustworthy enough to stand up under incident review, regulatory scrutiny, and executive challenge. It is collected and preserved in a way that limits tampering, preserves context, and supports a clear chain of evidence across systems.
• Passive Monitoring: A monitoring approach that observes traffic, events, or system behavior without installing intrusive agents or performing active scans. It is common in industrial environments because many legacy assets cannot tolerate modern IT security tooling without reliability or compatibility problems.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security practitioners build stronger controls around access, lifecycle, and evidence in modern environments.