Your controllers answer anyone who can reach them.
In October 2025, Canada’s cyber agency reported tampering with internet accessible control systems at a water facility, a Canadian oil and gas company and a grain drying silo on a Canadian farm. Our free 2026 OT Security Guide shows the checks to run on your plant floor and the questions your customers will ask.
Get the free 2026 OT Security Guide
10 page PDF. Download it right away, with a copy sent to your inbox.
We use these details to send the guide and, if you ask for one, to prepare your quote. Prefer to talk? Call (647) 948-6768.
Three control systems, reached from the internet
On October 29, 2025, the Canadian Centre for Cyber Security issued alert AL25-016 after multiple reports of incidents involving internet accessible industrial control systems:
Water pressure values were tampered with, resulting in degraded service for its community.
An automated tank gauge was manipulated, triggering false alarms.
Temperature and humidity levels were manipulated, resulting in potentially unsafe conditions if not caught on time.
The alert notes that organizations may not be direct targets, but may become victims of opportunity when their systems can be reached from the internet. Its advice starts with an inventory of the devices that can be reached from the internet, and a VPN with two factor authentication instead of direct exposure.
Bill C-8, in four lines
- Bill C-8 became law on June 15, 2026 and created the Critical Cyber Systems Protection Act.
- It comes into force in phases, on dates the federal government fixes by order.
- Designated operators in energy, telecommunications, finance and transportation must manage cyber risk, including risk from their supply chains and third party products and services, and report incidents to the Communications Security Establishment within 72 hours at most.
- If you supply or service those operators, expect questions about your own OT security.
Source: Parliament of Canada, Bill C-8 as assented to. Our full guide: Bill C-8 and your business.
The 2026 OT Security Guide for Canadian Plants
Written for plant managers, controls engineers and owners, in plain English.
- What the 2025 alert means for a plant like yours.
- Bill C-8 for suppliers: what operators will ask you, and when.
- The ten point plant floor checklist, with a simple score.
- The questions a customer or insurer is likely to ask about your OT security, and what a strong answer contains.
- How an OT security assessment is scoped to your site.
The OT security assessment
When the checklist shows gaps, an OT security assessment from our team looks at your plant floor and gives you a plan your team can act on.
Questionnaire-based OT security assessment
We send you a short questionnaire, review your answers and send back the gaps to close first.
On-site OT security assessment
Our team assesses your plant on site, with a scope set for your site. You get a fixed quote after a short scoping call.
Every plant is different. Every OT security assessment is scoped to your site, and you receive a report written for your plant. What it covers depends on what we find, so no two reports are the same.
Our work follows IEC 62443 and NIST SP 800-82, the standards OT teams already work with.
How it works
- Read the guide and score your plant against the ten points.
- Book a scoping call. For a small office, we send the free questionnaire. For a plant, you get a fixed quote for an on-site assessment, in writing.
- Your OT security assessment and your report, planned around your production and written for your site.
A Toronto team on your plant floor
- A Toronto team that answers the phone: (647) 948-6768.
- We design and deploy Advenica data diodes for one way protection of plant data, as shown on our data diode explainer.
- Our Toronto-based team assesses your plant and designs an IEC 62443-aligned OT security architecture on Fortinet and Advenica technology: Purdue-model segmentation, industrial DMZ, OT-aware firewalls, deny-by-default conduits, secure remote access, data diodes for critical one-way data flows, and 24/7 OT network monitoring.
- Managed security after the OT security assessment, if you want us to keep watch.
Frequently asked questions
What is an OT security assessment?
An OT security assessment reviews the operational technology that runs your plant, such as controllers, operator screens and the networks between them. It shows which of these systems can be reached, and what to close first. Every OT security assessment is scoped to the site.
Is Bill C-8 in force today?
Bill C-8 became law on June 15, 2026. The Critical Cyber Systems Protection Act comes into force in phases, on dates the federal government fixes by order, with the details set by regulation.
We are not a designated operator. Why would this apply to us?
Designated operators must manage cyber risk from their supply chains and third party products and services. If you supply or service one, your customer is likely to ask how your own systems are protected.
Will an OT security assessment disrupt production?
The work is planned around your production, and anything that could affect a live process is agreed with your team first.
Do we need an asset inventory before we start?
No. We start from what you have, whatever state it is in.
How is an OT security assessment priced?
For a small office, the questionnaire-based assessment is free. An on-site assessment is a fixed quote, set after the scoping call. The main factors are the number of sites, how connected they are, and whether a device list already exists.
Is the guide really free?
Yes. The 2026 OT Security Guide for Canadian Plants is a free 10 page PDF. You can download it right away, and a copy is sent to your inbox.
Start with the guide. Our team in Toronto closes the gaps.
Start with the free guide, or ask for a quote today.
Or call (647) 948-6768
