Bill C-8 and critical infrastructure: is your visibility ready?

TL;DR: Canada's Bill C-8 and the CCSPA move critical infrastructure from guidance to mandatory cybersecurity obligations, making visibility, incident evidence, and third-party risk control central to compliance, according to Corelight. For practitioners, the shift means network telemetry and defensible investigation records become governance requirements, not just security enhancements.

Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “Canada Raises the Bar for Critical Infrastructure Cybersecurity. Is Your Network Ready?”.

Key questions

Q: What breaks when critical infrastructure operators cannot prove what happened during an incident?

A: They lose the ability to defend scope, timing, and accountability when regulators or executives ask for evidence.

Q: Why do legitimate credentials and encrypted traffic increase risk in regulated environments?

A: Because they let malicious activity blend into normal operations while hiding much of the content that traditional controls rely on.

Q: How do security teams know if AI SOC investigations are reliable?

A: They should compare AI determinations with senior analyst conclusions across a representative alert sample, then track evidence completeness, false escalations, and time-to-determination.

Practitioner guidance

• Define evidence requirements for regulated cyber reporting Map Bill C-8 obligations to the exact records your teams must preserve for incident detection, containment, and reporting across critical systems.
• Prioritise network telemetry in hybrid and OT environments Expand passive monitoring where endpoint coverage is limited, especially in industrial and IoT segments where command-level evidence matters most.
• Correlate identity events with network activity Join authentication, privilege, and session data to network evidence so legitimate credentials can be evaluated in context rather than assumed benign.

Bottom line: Bill C-8 turns critical infrastructure cybersecurity into an evidence problem as much as a protection problem.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →