Guillaume LapointeThe U.S. Department of Homeland Security's cybersecurity arm — the Cybersecurity and Infrastructure Security Agency (CISA) — released two major frameworks in May 2026 that have direct consequences for Canadian companies doing business with American partners, clients, or government agencies. If your organization operates in sectors like utilities, transportation, healthcare, financial services, or manufacturing with any U.S. touchpoints, these rules are now your problem too.
What CISA Just Launched — and Why Canada Is Watching
On May 6, 2026, CISA unveiled its CI Fortify initiative: a sweeping directive requiring organizations across 16 critical infrastructure sectors to develop isolation and recovery plans against geopolitical cyberattacks. The initiative explicitly targets supply chain vulnerabilities — which means U.S. prime contractors are expected to push these requirements down to their vendors, including Canadian ones.
Simultaneously, CISA released CPG 2.0 — updated Cross-Sector Cybersecurity Performance Goals aligned with the NIST Cybersecurity Framework 2.0. While technically voluntary for non-U.S. entities, CPG 2.0 compliance is increasingly demanded by U.S. federal contractors as a condition of doing business. Canadian companies bidding on U.S. government contracts or partnering with American defence, utilities, or healthcare organizations will face pressure to demonstrate alignment.
The third pillar is the CIRCIA final rule, which mandates that organizations in those 16 critical sectors report cyber incidents to CISA within 72 hours of discovery. Canadian subsidiaries of U.S. parent companies, or Canadian firms that hold U.S. contracts and operate infrastructure on American soil, may fall within CIRCIA's scope.
Which Canadian Businesses Are Actually Affected?
The honest answer: more than most realize. The 16 CISA-designated critical infrastructure sectors include:
- Energy and utilities (pipelines, electricity distribution)
- Financial services and banking
- Healthcare and public health
- Transportation and logistics
- Information technology and communications
- Manufacturing (defence supply chain)
- Water systems
Canadian companies with operations, clients, data, or contracts in any of these sectors on the U.S. side of the border should treat these frameworks as directly applicable. The mechanism is usually contractual: your U.S. partner's agreement will be updated to require CISA-aligned practices, and you will be required to certify compliance.
For companies that don't have direct U.S. operations but store or process data belonging to American customers or clients, the CISA frameworks — combined with existing U.S. privacy and data security regulations — create a layered compliance environment that requires careful mapping.
What CPG 2.0 Compliance Actually Requires
CISA's Cybersecurity Performance Goals are organized around concrete, measurable controls. CPG 2.0 introduces several updates that were not in the original 2022 version:
Identity and access management: Multi-factor authentication is no longer optional for privileged accounts — it is an explicit CPG 2.0 baseline. Remote access must be secured with MFA across all entry points.
Asset inventory and management: Organizations must maintain a current, complete inventory of all hardware and software assets, including cloud environments. This is a common gap for mid-sized Canadian businesses that have grown organically without formal asset management practices.
Vulnerability management: CPG 2.0 requires organizations to patch or mitigate known exploited vulnerabilities within defined timelines aligned with CISA's Known Exploited Vulnerabilities catalogue.
Incident response planning: A documented, tested incident response plan is required — not just policies, but actual tabletop exercises and post-incident reviews.
Supply chain risk management: Organizations must assess their own vendors for cybersecurity risk — creating a cascading compliance requirement that flows through supply chains.
For many Canadian SMEs, achieving CPG 2.0 alignment from scratch represents a significant gap assessment, remediation, and documentation exercise. For larger enterprises, the priority is mapping existing controls against the CPG 2.0 framework and identifying where new investments are needed.
CIRCIA Reporting: Does It Apply to You?
The CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act) final rule creates mandatory breach notification obligations to CISA. The 72-hour reporting window for significant cyber incidents — and the 24-hour window for ransomware payments — applies to "covered entities" in the 16 designated sectors.
Whether a Canadian company qualifies as a covered entity depends on its specific activities and infrastructure. A Canadian utility that operates electricity distribution assets in a U.S. state is almost certainly a covered entity. A Canadian cloud services provider with U.S. government clients may be. A Canadian manufacturer that sells components to a U.S. defence contractor probably is not — unless it holds classified information or operates in a dedicated facility.
Determining CIRCIA applicability requires a careful legal and technical analysis of the company's activities, contracts, and infrastructure footprint. This is not a determination to make informally.
What to Do Now
The window to prepare is narrow. CISA has indicated that enforcement under CIRCIA will accelerate through 2026 and into 2027 as the final rule takes effect. Canadian businesses should take these steps immediately:
Conduct a CISA scope analysis. Identify whether your business falls within any of the 16 critical sectors and what your U.S. nexus is. Review contracts for cybersecurity compliance clauses.
Perform a CPG 2.0 gap assessment. Map your current controls against the updated framework. Identify high-priority gaps, particularly around MFA, asset inventory, and incident response.
Review your incident response plan. If it hasn't been tested in the last 12 months, it's out of date. CIRCIA's 72-hour window requires that you can detect, assess, and report quickly.
Update vendor agreements. If you are a prime contractor with U.S. customers, you will need to flow CISA requirements to your subcontractors.
Consult a cybersecurity professional. Compliance mapping, gap remediation, and incident response planning are specialized work. An experienced IT security consultant can accelerate the process and ensure your documentation meets audit requirements.
The U.S. Department of Homeland Security's expanded cybersecurity requirements are not staying south of the border. For Canadian businesses with any American footprint, 2026 is the year to get ahead of these obligations — or face the risk of losing contracts, triggering liability, or being caught unprepared when an incident occurs.
Expert Zoom connects Canadian businesses with qualified IT and cybersecurity professionals who understand both the CISA framework and the Canadian regulatory environment. Getting the right expert advice now is faster and cheaper than remediating a breach later.
