Signal 01 · · CCN Intelligence
Quebec Led Canada on Cybersecurity. Is the Country Now Losing Momentum?
In 2022, Quebec made an important decision that helped elevate cybersecurity within Canadian public administration. By establishing the Ministère de la Cybersécurité et du Numérique, it became the first Canadian province to create a dedicated ministry bringing cybersecurity and digital transformation together under a distinct political mandate. The initiative recognized that cybersecurity was no longer simply a technical responsibility managed by information technology departments, but a strategic issue connected to economic resilience, public services, critical infrastructure and the protection of citizens. Four years later, Quebec is moving away from that model. The government is transferring cybersecurity and digital affairs into the Treasury Board structure, with approximately 2,000 employees affected and legislative changes still required to formally abolish the ministry. The restructuring is intended to improve government administration and coordination, particularly around technology investment, procurement and digital project governance. The implications extend well beyond Quebec. At a time when artificial intelligence is receiving increasing political attention and cyber threats are becoming more complex, the decision raises an important national question: are Canadian governments strengthening cybersecurity leadership, or allowing it to become less visible within broader administrative structures? CCN believes Quebec's original initiative represented an important step forward in recognizing cybersecurity as a strategic government responsibility. While there are legitimate reasons to strengthen Treasury Board oversight, the province's decision creates an opportunity for a broader Canadian discussion about dedicated cybersecurity leadership, institutional expertise, political accountability and the relationship between cybersecurity and artificial intelligence.
What happened
Quebec's restructuring represents a significant change in how the province organizes political and administrative responsibility for cybersecurity and digital transformation. Rather than maintaining a dedicated ministry with its own political identity, these responsibilities are being incorporated into the Treasury Board structure. The formal legislative changes have not yet been completed, and the effectiveness of the new arrangements will depend on how authority, expertise and accountability are ultimately distributed. The original ministry, established in January 2022, was a pioneering Canadian initiative. It brought cybersecurity and digital transformation together under dedicated ministerial leadership and created a recognizable institutional counterpart for other governments, industry, academic institutions and cybersecurity specialists. Its creation reflected the growing importance of protecting government systems and public information while modernizing digital services. The restructuring follows broader concerns about the governance of government technology projects in Quebec. In May 2026, the Autorité des marchés publics recommended returning central governance of digital projects to Treasury Board while strengthening the technical expertise and advisory role of the cybersecurity ministry. This distinction is important because the recommendation recognized the need for stronger administrative oversight without necessarily calling for the elimination of dedicated cybersecurity leadership. The government's approach creates the possibility of closer integration between cybersecurity requirements, financial oversight, procurement and project delivery. However, it also raises questions about whether cybersecurity will retain the same political visibility and institutional authority. Reaction from the cybersecurity community has reflected these concerns. Former senior Quebec cybersecurity official Steve Waterhouse has questioned the timing and potential consequences for institutional momentum and international visibility. Former minister Gilles Bélanger has expressed reservations about the implications for cybersecurity strategy. The Syndicat de professionnelles et professionnels du gouvernement du Québec has raised concerns about consultation and the preservation of internal expertise. These reactions do not establish that Quebec's cybersecurity capabilities have already been weakened. They do, however, identify important issues that the new governance structure will need to address.
Why it matters for Canada
Quebec's decision has national implications because the province was an early Canadian leader in recognizing cybersecurity as a responsibility deserving dedicated ministerial attention. Its original initiative offered a model that other jurisdictions could examine as they considered how to coordinate cybersecurity, digital transformation and government accountability. Canada now faces increasingly complex cybersecurity challenges involving critical infrastructure, healthcare, public services, digital identity, artificial intelligence, cloud computing and interconnected technology supply chains. Cyber incidents can create physical, operational and economic consequences, making cybersecurity relevant to public safety, economic policy, business competitiveness and national security. Despite these growing responsibilities, cybersecurity governance remains distributed across federal, provincial, territorial and municipal organizations. Public safety agencies, central government departments, technology organizations and individual ministries all have important roles, but coordination becomes more difficult when threats and responsibilities cross institutional boundaries. Quebec's restructuring should encourage Canadian governments to examine whether their existing leadership structures provide sufficient strategic visibility, operational authority and accountability. The question is not whether every jurisdiction requires a dedicated cybersecurity ministry. It is whether cybersecurity leaders have the authority, resources and access to senior decision makers necessary to protect public systems and coordinate across government. The relationship between cybersecurity and artificial intelligence is particularly important nationally. Canada is investing in AI research, computing infrastructure, commercialization and adoption. These investments will depend on secure systems, reliable digital infrastructure, effective information governance and public confidence. Dedicated political leadership for AI reflects its economic and technological importance. However, cybersecurity should not become less visible as governments expand their AI portfolios. The two areas require distinct expertise and responsibilities, supported by effective coordination. For Canadian businesses, government cybersecurity governance also influences procurement requirements, supplier standards, technology investment, public sector partnerships and confidence in digital infrastructure. Companies benefit from governments that maintain strong internal expertise, establish predictable security expectations and act as knowledgeable purchasers of technology. Quebec's original initiative helped elevate cybersecurity within Canadian public administration. Its restructuring now creates an opportunity to consider how that progress can be preserved and strengthened across the country.
What CCN sees
CCN recognizes Quebec's establishment of a dedicated cybersecurity ministry in 2022 as an important contribution to Canadian cybersecurity leadership. The province acknowledged earlier than most Canadian jurisdictions that cybersecurity deserved a distinct place in government decision making, reflecting its growing importance to economic security, public trust and the continuity of essential services. Moving away from that model raises legitimate concerns about whether cybersecurity will retain the same level of political visibility and institutional authority. While closer integration with Treasury Board may improve procurement, financial oversight and project governance, those benefits should not come at the expense of specialized cybersecurity leadership. CCN would have preferred to see Quebec preserve a distinct and highly visible cybersecurity leadership function, potentially through a dedicated deputy minister responsible for cybersecurity, working alongside the minister responsible for artificial intelligence and digital affairs. Such an arrangement could combine the administrative strengths of Treasury Board with a clearly identifiable executive responsible for cybersecurity strategy, government resilience, coordination across departments and engagement with the broader cybersecurity community. A dedicated cybersecurity deputy minister would need clearly defined authority, direct access to senior government decision makers and sufficient resources to influence investment, procurement, security standards and operational preparedness. The objective would not be to create another administrative layer, but to ensure that cybersecurity has an accountable strategic leader whose responsibilities extend across government. This proposal is not an argument against artificial intelligence leadership. Canada needs strong leadership in both cybersecurity and AI, particularly because trusted AI adoption depends on secure systems, reliable infrastructure and effective information governance. Cybersecurity should not have to compete with artificial intelligence for strategic attention, nor should it be treated solely as a supporting function of digital transformation. CCN also believes that governments should evaluate cybersecurity governance through measurable results rather than organizational titles alone. The preservation of specialized personnel, clarity of decision making authority, effectiveness of incident response, integration of security into procurement and improvement of public service resilience are more meaningful indicators of progress than the number of departments or ministries. Quebec's experience presents an opportunity for other Canadian governments to examine their own arrangements. Dedicated cybersecurity leadership, whether at the ministerial, deputy minister or senior executive level, can help ensure that cybersecurity remains connected to economic policy, critical infrastructure, national security and public accountability. There is also an important institutional lesson. Building specialized cybersecurity expertise, operational capabilities and trusted relationships takes years. Governments should carefully assess the value of these assets before restructuring organizations that have developed them. Administrative savings and improved oversight are legitimate objectives, but they should be considered alongside the costs of potential disruption, lost expertise or reduced strategic coordination. Quebec's original initiative demonstrated that cybersecurity had earned a place at the highest levels of government. Its restructuring should not lead Canada to lose sight of that achievement. Instead, it should encourage governments to strengthen the authority, expertise and accountability required to protect an increasingly digital economy. The central question is not whether Quebec should retain a particular ministry or organizational title. It is whether the province, and Canada more broadly, will provide cybersecurity leaders with the authority, resources and visibility necessary to protect citizens, support businesses and strengthen national resilience. Quebec helped put cybersecurity leadership on Canada's political agenda. The challenge now is ensuring that the country builds on that progress rather than allowing cybersecurity to become less visible at precisely the moment its importance is growing.
What leaders should consider
Government leaders across Canada should examine whether their cybersecurity governance structures provide sufficient strategic visibility, decision making authority and operational accountability. The question is not simply where cybersecurity sits on an organizational chart, but whether those responsible for protecting government systems can influence technology investment, procurement, digital transformation and critical infrastructure resilience. Quebec's restructuring should be assessed through the final legislative framework, the designation of senior cybersecurity leadership, the preservation of specialized teams and the allocation of authority between Treasury Board, cybersecurity officials and the minister responsible for artificial intelligence and digital affairs. These arrangements will determine whether the province can combine stronger administrative oversight with effective cybersecurity leadership. For other provincial and federal governments, Quebec's experience offers an opportunity to evaluate the benefits of dedicated cybersecurity leadership at the ministerial, deputy minister or senior executive level. Clear accountability, access to senior decision makers and the ability to coordinate across departments are essential regardless of the organizational model selected. Public sector technology executives should ensure that cybersecurity is incorporated into procurement, investment approvals, supplier assessments and digital project governance. They should also evaluate whether internal expertise is sufficient to manage complex technology environments and reduce unnecessary dependence on external suppliers. Business leaders and technology providers should monitor how changes in government governance affect procurement requirements, security standards, public sector partnerships and expectations for trusted technology deployment. The most important question for Canadian leaders is whether cybersecurity has the authority and attention required to protect an increasingly digital economy while supporting innovation, artificial intelligence adoption and public trust.
People to Watch
Alain Therrien, Quebec Treasury Board President, for the implementation of the new governance structure and the allocation of responsibilities within Treasury Board. Anne Nguyen, minister responsible for artificial intelligence and digital affairs, for the relationship between AI policy, digital transformation and cybersecurity responsibilities. Steve Waterhouse, cybersecurity specialist and former senior Quebec government cybersecurity official, for his perspective on institutional expertise, cybersecurity leadership and the consequences of restructuring. Gilles Bélanger, former Quebec cybersecurity minister, for his perspective on the original ministry's mandate and the implications of the government's decision. Senior cybersecurity leaders across federal, provincial and territorial governments, particularly those responsible for government security strategy, incident response and coordination across departments.
Organizations to Watch
Quebec Treasury Board Secretariat, for the final governance structure, accountability arrangements and integration of cybersecurity into procurement and digital project oversight. Ministère de la Cybersécurité et du Numérique, for the transition of responsibilities, personnel and specialized capabilities. Autorité des marchés publics, for recommendations and oversight relating to government technology procurement and digital project governance. Syndicat de professionnelles et professionnels du gouvernement du Québec, for developments affecting specialized government employees and internal expertise. Canadian Centre for Cyber Security, for national cybersecurity guidance, government coordination and operational resilience. Treasury Board of Canada Secretariat, for federal digital governance, cybersecurity policy and public sector technology management. Provincial and territorial cybersecurity organizations, for developments in governance models, dedicated leadership and intergovernmental cooperation. Key developments to monitor include the final legislation, appointment or designation of a senior cybersecurity authority, preservation of specialized personnel, allocation of budgets and decision making powers, continuity of incident response capabilities and publication of performance measures.
Source: https://www.legisquebec.gouv.qc.ca/fr/document/lc/M-17.1.1