If you supply anything to a bank, a telecom, a utility, a hospital or a large transport company, a new clause is coming your way, and it is not really about you. Canada's Bill C-8 received Royal Assent in June 2026, placing cybersecurity duties on designated operators of critical cyber systems. One of those duties is managing supply-chain risk, and there is only one way an operator discharges that duty: by pushing requirements down to its suppliers. This guide is about being on the receiving end of that.
Who this actually affects
The legislation's direct obligations land on designated operators in sectors like telecommunications, banking, energy, nuclear, interprovincial transport, and clearing and settlement. Those operators must run a documented cyber security programme, report significant incidents to the Cyber Centre within a defined window, and address risks associated with their supply chains and third-party services.
Your small business is almost certainly not a designated operator. You are the supply chain. If you provide IT services, software, consulting, logistics, maintenance, cleaning with building access, or professional services to one of those organizations, their obligation becomes your contract clause. The same dynamic has been running for years through other channels, which is why a security questionnaire shows up from large clients who are not regulated at all. Bill C-8 makes it systematic in the sectors it covers.
What they ask for, in rough order of frequency
- Multi-factor authentication on everything, especially email and anything that touches the client's systems or data.
- Named security ownership. A person accountable for security, by name. Not a department, which you do not have, just a named human.
- Incident notification within a fixed window, often 24 to 72 hours, and usually to the client as well as to any regulator. This is the clause most likely to be breached by accident, because it starts the clock at discovery.
- Access control and offboarding evidence. Who on your team can reach their data, and proof that access is removed when people leave.
- Patching and supported software. Expect a direct question about whether you run anything past end of support.
- Backups and tested recovery, increasingly with a question about whether the restore has actually been tested rather than configured.
- Your own subcontractors. The flow-down flows down again. If you use a cloud tool to deliver the work, it is in scope.
- Insurance, with a minimum coverage figure and sometimes a requirement to name them.
- Audit or evidence rights, ranging from an annual questionnaire to a right to request documentation.
How to answer without over-promising
The temptation on a tender is to tick every box. Resist it, for a plain commercial reason: these answers become contractual representations, and a false one converts an incident into a breach of contract. Three rules keep you safe.
Answer what is true today. If you do not have something, say so, and say when you will. In practice buyers accept a dated commitment far more often than people expect; what they cannot accept is discovering later that an answer was aspirational.
Scope your commitments to the engagement. There is a large difference between we encrypt all company data at rest and client data for this engagement is stored in the following system, which encrypts at rest. The second is verifiable, narrower, and easier to keep true.
Negotiate the timelines you cannot meet. A 24-hour notification duty on a four-person firm with no monitoring is a promise you will break. Ask for notification within 24 hours of confirmed discovery, or propose 72. Buyers negotiate these clauses regularly. Suppliers rarely ask.
Get ahead of it with a reusable pack
Most of the work is answering the same twenty questions repeatedly, so write it once. A usable pack holds: a one-page security overview, your current answers to the common controls with dates where something is in progress, the named security owner, your subprocessor list, your insurance certificate, your incident response summary, and your most recent restore test date. Keep it in one folder, review it quarterly, and reuse it. Firms that have this respond to a tender in an hour. Firms that do not lose a week and answer worse.
Build it on the same questions you should be asking your own suppliers, because the exercise is identical in both directions and the answers mostly overlap.
Treat it as an advantage, not a tax
This is the part most small suppliers miss. Larger competitors have compliance teams and treat these requirements as routine overhead. For a small firm, being genuinely easy to assess is a differentiator: procurement people remember the supplier whose answers arrived complete, dated and honest, because it makes their own file defensible. A credible security pack has won work for businesses that were otherwise the smaller bid.
What this means for your business
The regulatory pressure in Canada is moving toward supply chains, and it will not stop with the sectors named in Bill C-8, because large customers copy each other's contract language. The small business response is not to build a compliance department. It is to get a handful of controls genuinely in place, write down honestly what is true, negotiate the two or three clauses you cannot meet, and keep the pack current. That converts a recurring scramble into a short standing task, and it is work we do with clients regularly.