The Canadian Centre for Cyber Security has published ITSP.20.001, Cyber security considerations for submarine cables, as part of its Practitioner series. The document is dated October 2026 and is available on the Cyber Centre's site at cyber.gc.ca.

The publication sets out the threats and vulnerabilities facing submarine cable networks and offers mitigations intended to support secure and resilient infrastructure for both domestic and international data flows. It is guidance, not legislation. The source material contains no deadlines, fines or compliance thresholds, and none should be read into it.

The Cyber Centre's framing is blunt. In Canada, submarine telecommunications cables connect coasts and islands, reach remote areas and carry international communication. They transmit many forms of data and, in the Centre's words, play an important role in supporting the country's cultural, economic, technological and national security interests. Demand is expected to grow as new technology makes it possible to connect places that were previously out of reach, including Arctic regions.

The document also names the problem that makes this guidance necessary. Redundancy is being built into cable paths, but cable infrastructure and distribution choke points remain potential points of failure with large consequences, and attractive targets for adversaries. Put less diplomatically: a cable on the seabed is a long, expensive and remarkably unsupervised piece of national infrastructure, and the landing stations and distribution points at either end are where the interesting people tend to show up. The Centre concludes that ensuring the security, resilience and integrity of this infrastructure is critical to maintaining stability and trust.

According to the table of contents, the publication opens with an introduction and a description of the threat surface, then moves into a threats and mitigations section organized into three groups:

• Policy and standards threats, covering policy and regulations and their associated mitigations
• Architecture threats, split into cyber architecture and physical architecture
• Supply chain threats and their mitigations

That structure matters because it tells readers where the Centre thinks the risk actually sits. It is not treating submarine cables as a purely physical problem of anchors and fishing trawlers. Cyber architecture gets its own subsection alongside physical architecture, and supply chain is treated as a threat category in its own right rather than a footnote.

Who is affected is also clear from the audience label. This is a Practitioner series document, aimed at the people who design, operate and defend cable systems and the networks that depend on them, rather than at executives or the general public. Operators of cable landing stations, carriers that lease capacity, cloud and content providers whose traffic rides these links, and the vendors that supply and maintain the equipment are the natural readership. Canadian organizations that assume their international connectivity is somebody else's problem may find the document a useful reminder that it is, at minimum, partly theirs.

What is not yet clear from the source material is the detail of the individual mitigations. The excerpt available to Identity at the Core covers the introduction and the table of contents, not the body of the threats and mitigations chapters. Practitioners should read the full text on the Cyber Centre site rather than rely on summaries, this one included.

The encouraging part, and there is one, is that the threat model has been written down for you by the national authority, free of charge, with a section heading for every conversation you have been trying to start with your network team. Identity and security teams don't need to wait for the detailed mitigations to act. Start with the cyber architecture angle: inventory every account, service identity and vendor remote access path that can reach the management plane of cable landing station equipment, optical transport systems and the monitoring tools around them, and confirm each one requires phishing resistant MFA and is logged somewhere you actually review. Check that physical access control at landing stations is tied to the same identity lifecycle as your logical access, so a departed contractor loses both badge and login on the same day. Finally, treat the supply chain section as a prompt to verify which third parties hold standing credentials into that infrastructure, and whether you could revoke them in an hour if you had to.