Topic starter
23/10/2026 12:47 am
TL;DR: Bill C-8 turns critical infrastructure cybersecurity into an evidence problem, Corelight argues, not just a protection problem. Network telemetry and defensible records become part of how operators satisfy incident reporting and accountability demands.
Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “Canada Raises the Bar for Critical Infrastructure Cybersecurity. Is Your Network Ready?”.
Key questions
Q: Why do legitimate credentials and encrypted traffic increase risk in regulated environments?
A: Because they let malicious activity blend into normal operations while hiding much of the content that traditional controls rely on.
Q: How do security teams know if AI SOC investigations are reliable?
A: They should compare AI determinations with senior analyst conclusions across a representative alert sample, then track evidence completeness, false escalations, and time-to-determination.
Q: What breaks when critical infrastructure operators cannot prove what happened during an incident?
A: They lose the ability to defend scope, timing, and accountability when regulators or executives ask for evidence.
Practitioner guidance
- Define evidence requirements for regulated cyber reporting Map Bill C-8 obligations to the exact records your teams must preserve for incident detection, containment, and reporting across critical systems.
- Prioritise network telemetry in hybrid and OT environments Expand passive monitoring where endpoint coverage is limited, especially in industrial and IoT segments where command-level evidence matters most.
- Correlate identity events with network activity Join authentication, privilege, and session data to network evidence so legitimate credentials can be evaluated in context rather than assumed benign.
Bottom line: Bill C-8 turns critical infrastructure cybersecurity into an evidence problem as much as a protection problem.
Glossary terms: High-Fidelity Network Telemetry, Evidence Continuity Gap, Defensible Telemetry, Passive Monitoring
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Visibility debt is now a governance problem, not a tooling preference. Bill C-8 and the CCSPA make it harder for critical infrastructure operators to rely on fragmented monitoring and post-incident reconstruction. The legislation pushes accountability onto the operator, which means evidence quality becomes a board-relevant control issue. Practitioners should treat telemetry coverage and defensibility as part of operational resilience.
A question worth separating out:
Q: Which control matters most when OT and IoT traffic must be monitored without disruption?
A: Passive network monitoring matters most because it preserves operational stability while still exposing commands, protocols, and parameters that can affect physical systems. That is especially important in converged environments where the same incident can involve enterprise identity, industrial control traffic, and device behaviour. The goal is continuous visibility without introducing operational risk.
👉 Read our full editorial: Canada's Bill C-8 makes critical infrastructure evidence-driven
This post was modified 6 days ago by NHI Mgmt Group