Canadian Cyber Incident Response Centre

Canadian Cyber Incident Response Centre
Hoice · CC BY-SA 4.0 · source
Name	Canadian Cyber Incident Response Centre
Native name	CCIRC
Formation	2010
Type	Government agency
Headquarters	Ottawa, Ontario
Parent organization	Communications Security Establishment
Jurisdiction	Canada

Canadian Cyber Incident Response Centre

The Canadian Cyber Incident Response Centre operates as a national cybersecurity coordination body within Canada, providing incident response, threat analysis, and advisories to protect critical information infrastructure. It interfaces with federal departments including Public Safety Canada, Global Affairs Canada, and Treasury Board Secretariat, as well as provincial partners such as Ontario, Quebec, and British Columbia, and international allies like United States, United Kingdom, and Australia.

History

Established in 2010, the centre evolved from earlier initiatives such as the Canadian Security Intelligence Service-linked cyber programs and legacy units within Communication Security Establishment structures. Early ties formed with Royal Canadian Mounted Police cyber units and with academic programs at University of Toronto, McGill University, and University of British Columbia. The centre expanded capacity following high-profile incidents including attacks similar to those affecting Sony Pictures Entertainment, Equifax, and Target Corporation, leading to increased coordination with North Atlantic Treaty Organization and participation in exercises with NATO Cooperative Cyber Defence Centre of Excellence. Throughout its history the centre has worked alongside agencies like Public Safety Canada, Innovation, Science and Economic Development Canada, and international bodies such as United Nations Office on Drugs and Crime.

Mandate and Responsibilities

The centre’s mandate covers incident response coordination, vulnerability advisories, and risk reduction for networks that support Bank of Canada, Canadian Broadcasting Corporation, and provincial health systems like Alberta Health Services and Ontario Health. Responsibilities include sharing intelligence with partners including Five Eyes, Interpol, and European Union Agency for Cybersecurity; publishing alerts relevant to entities such as Royal Bank of Canada, Toronto Stock Exchange, and Air Canada; and supporting regulatory compliance linked to statutes like the Personal Information Protection and Electronic Documents Act and procurement frameworks from Treasury Board Secretariat.

Organizational Structure

Reporting within the Communications Security Establishment, the centre is organized into operations, intelligence, and outreach divisions. Leadership liaises with ministers in Public Safety Canada and coordinates with enforcement units such as the Royal Canadian Mounted Police National Division and the Canada Border Services Agency on cross-border cybercrime. Specialized teams collaborate with academic labs at Carleton University and University of Waterloo, and with private sector incident response firms including Deloitte, CrowdStrike, and Microsoft.

Operations and Services

Operational activities include 24/7 incident handling, threat intelligence dissemination, vulnerability assessments, and tabletop exercises modeled on scenarios used by National Institute of Standards and Technology and North American Electric Reliability Corporation. Services extend to notifying affected stakeholders like Hydro-Québec, Municipalities of Toronto, and major telecommunications providers such as Rogers Communications, Bell Canada, and Telus. The centre issues technical guidance referencing standards from ISO/IEC 27001, tools developed by MITRE ATT&CK, and collaboration channels used by FIRST members.

Partnerships and Collaboration

Partnership networks span federal bodies including Health Canada, Innovation, Science and Economic Development Canada, and Canada Revenue Agency; provincial cybersecurity centres in Alberta, British Columbia, and Saskatchewan; and international partners such as United States Department of Homeland Security, National Cyber Security Centre (UK), and Australian Cyber Security Centre. Collaboration extends to private-sector coordinators like Canadian Bankers Association, technology firms like Amazon Web Services and Google Cloud, and standards organizations including International Organization for Standardization and Internet Society.

Incidents and Response Examples

The centre has coordinated responses for incidents affecting sectors including finance, energy, and healthcare, aligning with actions taken during events comparable to the WannaCry and NotPetya outbreaks. It has provided advisory support during breaches impacting institutions similar to Capital One and incident response exercises mirroring scenarios used by Cybersecurity and Infrastructure Security Agency. Casework often involves coordination with Royal Canadian Mounted Police, international partners such as FBI, and private responders like Mandiant.

Policy, Legislation, and Governance

The centre operates within policy frameworks set by Public Safety Canada and governance mechanisms tied to the Communications Security Establishment Act and privacy rules under Personal Information Protection and Electronic Documents Act. It supports regulatory alignment with frameworks such as the Digital Privacy Act and engages in consultative processes with parliamentary committees including the House of Commons standing committees on national security and Senate of Canada committees. Governance includes audit and oversight interactions with agencies like the Office of the Auditor General of Canada and ethics guidance aligned with Treasury Board Secretariat policy.

Category:Cybersecurity in Canada