// THE WEEKLY STUDY · OCTOBER 12, 2026

The weekly Study: field answers, CPCSC Level 2 timing, and Bill C-8 penalties

Eight short field answers, the corrected CPCSC Level 2 window, and what the CCSPA penalty caps actually say.

This is the first issue. Once a week it collects what changed on hans.study: CPCSC and compliance first, then IT and OT network security, then physical security.

This week I re-checked the site against primary sources and corrected what had moved. The CPCSC Level 2 dates changed, the CMMC class deviation dates were off by 7 weeks, and the Bill C-8 penalty figures came from the first-reading text. Each correction carries a dated note on its page.

Compliance and CPCSC

NL-01 CPCSC update · October 12

CPCSC updates log, October 12, 2026

Corrections. Level 2 timing: PSPC's September 29 program overview says Levels 2 and 3 are under development and gives no date, so the hub no longer shows spring 2027 as a set date and now cites PSPC's April 2027 to March 2028 timeline instead. Level 1 MFA wording now shows both PSPC's criteria and its narrower how-to wording.

Read the log →

NL-02 Pick

CPCSC, explained

Level 2 timing corrected: PSPC's timeline says April 2027 to March 2028, and its latest overview gives no date.

NL-03 Pick

Bill C-8 and the CCSPA

The penalty caps, corrected to the royal-assent text: $500,000 for an individual and $15,000,000 in any other case.

Also worth reading

NL-04 Pick

Questions I get asked in the field

Eight short answers: ransomware response, OT scanning, control networks, break-glass accounts, and shared logins.

All issues