QSA's Week in ICT & Cybersecurity (#36, 2025)

Data security incident impacts federal MFA provider; Ottawa expands AI research and workforce funds; Canada, Spain formalize secure info exchange; US DoD finalizes CMMC rules for contractors; Major US organizations pledge AI education funding.

QSA's Week in ICT & Cybersecurity (#36, 2025)

Good morning! This is Queen Street Analytics' weekly roundup of regulatory developments, legislative discussions, political announcements and other government-related news concerning ICT, cloud computing, digital infrastructure, social media platforms, digital privacy, AI, cybersecurity, blockchain, and Web3. Every Monday, we break down the most important updates in this space in under five minutes.

Want to track other GR news in adjacent industries? Don’t miss this week’s updates in Finance.

Dates: 2025-09-07 to 2025-09-13

📋 In This Week's Newsletter

• 🏛️ House of Commons Committee Meetings
• 🇨🇦 Canadian Federal GR News
• 🇺🇸 US Federal GR News
• 🗺️ Canadian Provincial GR News
• 📚 What We're Reading This Week


House of Commons Committee Meetings

  • Access to Information, Privacy and Ethics Committee to Hold Dual Briefing Sessions: On September 15, the Access to Information, Privacy and Ethics Committee will conduct a televised briefing with Conflict of Interest and Ethics Commissioner Konrad Winrich von Finckenstein and the Information Commissioner Caroline Maynard. Meetings will run from 11:00 a.m. to 1:00 p.m. in Room 415, Wellington Building.
  • Science and Research Committee to Review Criteria for Federal Research Funding: On September 17, the Science and Research Committee will examine how criteria for awarding federal funding affects research excellence. Witnesses include David Freeman (Simon Fraser University), Dr. Yuan Yi Zhu (Leiden University), Dr. Malinda Smith (University of Calgary), Martin Normand (Association des collèges et universités de la francophonie canadienne), and Ken Doyle (Tech-Access Canada), from 4:30 p.m. to 6:30 p.m. in Room 430, Wellington Building.

Canadian Federal GR News

Federal Data Security Incident Impacts Multi-Factor Authentication Provider for Key Government Services

The Treasury Board of Canada Secretariat confirmed a non-material privacy incident involving the multi-factor authentication service provided by 2Keys Corporation, affecting Canada Revenue Agency, Employment and Social Development Canada, and Canada Border Services Agency user accounts. Between August 3 and 15, 2025, a vulnerability introduced through a routine software update allowed malicious actors to access phone numbers linked to CRA and ESDC and email addresses for CBSA users who utilized the MFA service. The incident led to phishing attempts with fraudulent text messages. 2Keys responded swiftly by patching the vulnerability, and the MFA service has since resumed operation. External cybersecurity firms continue to support the investigation. The government states there is no evidence that other personally identifiable or sensitive information was compromised. Users have been reminded to maintain vigilance for suspicious messages.

Sources: Announcements: www.canada.ca
lists-ad
Get your updated contact lists from Queen Street Analytics. Subscribe here!

Government Invests $28.7 Million in AI Research Capacity and Clean Energy Workforce Development

On September 9, the Government of Canada committed over $28.7 million through the Sustainable Jobs Training Fund and the Canadian Sovereign AI Compute Strategy. The Alberta Machine Intelligence Institute (Amii) will receive more than $9 million over three years for the 'AI Pathways: Energizing Canada's Low-Carbon Workforce' project, providing AI and machine learning training for approximately 5,000 energy workers nationwide. The funding targets skill development for careers in wind, solar, geothermal, and hydrogen energy sectors, with options for online and in-person training sessions. An additional $19.7 million will expand computational resources for Amii's AI research, facilitating development, deployment, and commercialization of advanced AI models. The funding is intended to increase Canadian capacity in AI research and product innovation across multiple sectors.

Sources: Announcements: www.canada.ca

Canada and Spain Sign General Security of Information Agreement

Ministers Joël Lightbound (Government Transformation, Public Works and Procurement) and Anita Anand (Foreign Affairs) have announced the signing of a General Security of Information Agreement (GSOIA) with Spain. The new binding agreement enables exchange of classified and sensitive information between governments and authorized contractors, replacing a prior interim non-binding arrangement from 2011. The GSOIA is designed to improve Canadian access to Spanish defense markets, enable technology transfer, and create a framework for secure information flow supporting joint operations and intelligence. The agreement was signed in Madrid by Canadian Ambassador Jeffrey Marder and Spain's Secretary of State for the National Intelligence Center.

Sources: Announcements: www.canada.ca

Atlantic Canadian Firms Showcase Innovation at DSEI 2025 in London

Over 30 Atlantic Canadian defense and aerospace firms joined the Canadian Pavilion at Defence and Security Equipment International (DSEI) 2025 in London this week. Coordinated by the Atlantic Canada Aerospace and Defence Association (ACADA) with support from the Atlantic Canada Opportunities Agency and the region's four provinces, the delegation aims to expand export opportunities and establish new international partnerships in defense technology. Participating companies leveraged the Market Entry Development Program to build European market strategies. This trade mission is funded under the Atlantic Trade and Investment Growth Agreement, directly aligning with federal and provincial targets for export growth and innovation in the defense and ICT sectors.

Sources: Announcements: www.canada.ca

Upcoming Announcement: Support for AI Research and Workforce Training

Ministers Patty Hajdu (Jobs and Families), Evan Solomon (Artificial Intelligence and Digital Innovation), and Eleanor Olszewski (Emergency Management and Community Resilience) are scheduled for a September 9 announcement at Amii in Edmonton. The event will address federal investments in AI research capacity and workforce training, with specific mention of initiatives targeting energy sector skill development and AI technology adoption. Government representatives have indicated a focus on partnerships involving industry, higher education, and economic agencies. Details will be made public during a livestreamed media event.

Sources: Announcements: www.canada.ca

Federal Reskilling, Workforce Alliances, and Job Bank Reforms Address Impact of Trade Tariffs

On September 8, the Government of Canada provided a backgrounder on recent workforce measures targeting industries affected by trade tariffs and global market disruptions. Measures include a $450 million investment over three years through the Labour Market Development Agreements to fund worker retraining, an additional $382 million over five years for new Workforce Alliances, and a $1.6 billion, five-year extension of 20 extra weeks of EI income support for long-tenured workers. The Job Bank is being modernized with a $50 million investment, integrating AI-driven job matching, automated application feedback for skills gaps, and the launch of a new online national training platform in partnership with the private sector. All job postings that involve AI in the selection process will indicate this information on listings.

Sources: Announcements: www.canada.ca

US Federal GR News

DoD Finalizes Cybersecurity Maturity Model Certification (CMMC) Rule for Defense Contractors

The U.S. Department of Defense published a final rule in the Federal Register amending the Defense Federal Acquisition Regulation Supplement (DFARS) and codifying requirements for CMMC compliance by defense contractors and subcontractors. Effective November 10, 2025, the rule requires contractors with information systems processing Federal contract information (FCI) or controlled unclassified information (CUI) to maintain a specified CMMC level, post their assessment status and unique identifier in the Supplier Performance Risk System (SPRS), and complete annual affirmations of compliance. Flow-down provisions apply to subcontractors that also handle FCI or CUI. After a three-year phased implementation, all relevant contracts (excluding those solely for commercially available off-the-shelf items) must incorporate these requirements. Offerors lacking a current CMMC affirmation at the required level will not be eligible for award. The final rule also introduces new definitions, reporting obligations, and clarifies the process for integrating CMMC requirements across contract types.

Sources: U.S. Federal Announcements: www.federalregister.gov

Defense Department Seeks OMB Approval for New Cybersecurity Compliance Information Collection

The Defense Acquisition Regulations System submitted a proposal to OMB for a new mandatory information collection under DFARS Part 204, associated with contractor implementation of CMMC requirements. The reporting relates to affirmations and unique identifier updates for contractor information systems handling CUI and FCI. Announced September 10, the collection is estimated to affect 1,493 respondents with approximately 30,990 responses annually, totaling an estimated 2,582 annual burden hours. Public comments are being accepted through October 10, 2025. The requirement reinforces DoD’s verification of contractors’ cybersecurity status prior to award, exercise of options, or contract extension.

Sources: U.S. Federal Announcements: www.federalregister.gov

Major U.S. Organizations Commit to AI Education Initiatives

The U.S. White House announced coordinated commitments from a range of private-sector and nonprofit entities to advance AI education and workforce development. Notable initiatives include Google's $1 billion outlay for AI education, Microsoft and Amazon offering free AI tools and cloud credits, and IBM targeting 2 million reskilled learners by 2028. Other contributors include NVIDIA, HP, Apple, Meta, and OpenAI, each launching programs for K-12 or workforce AI upskilling, with financial commitments spanning from $5 million to over $30 million in training and certification resources. These programs are designed to equip students, teachers, and current workers with core AI skills for deployment across multiple sectors.

Sources: White House Announcements: www.whitehouse.gov

FCC Seeks Comment on Designated Entities Reporting and Wireless Medical Telemetry Service Coordination

The Federal Communications Commission opened a comment period on its information collection practices for designated entity compliance and wireless medical telemetry frequency coordination. For designating entities, 1,100 respondents must file eligibility and annual reports ensuring small business benefit integrity, with an estimated total burden of 7,288 hours and $2,223,375 in costs. Separately, a notice regarding frequency coordination for the Wireless Medical Telemetry Service anticipates 3,000 respondents and 15,000 annual burden hours, supporting interference-free deployment of medical telemetry systems. Both collections are under review as part of the FCC’s ongoing efforts under the Paperwork Reduction Act.

Sources: U.S. Federal Announcements: www.federalregister.gov

Coast Guard Announces AI Multicast Overlay Research Agreement Proposal

The U.S. Coast Guard published notice of its intent to enter a Cooperative Research and Development Agreement (CRADA) with VoiceBrain. The project will examine the use of AI-driven multicast overlays in operational communications platforms to identify and automate critical maritime notifications. The Coast Guard is accepting public comment and proposals from other potential research participants until October 10, 2025. The CRADA is structured to facilitate technology transfer to the private sector and other federal agencies, without direct funding from the Coast Guard.

Sources: U.S. Federal Announcements: www.federalregister.gov

Canadian Provincial GR News

BC Invests in Rural and First Nations High-Speed Internet Connectivity

Over 400 households in rural Vancouver Island and the central and northern BC coast will soon gain high-speed internet through seven projects led by CityWest and supported by the federal Universal Broadband Fund and First Nations Health Authority.

Sources: Provincial Announcement: news.gov.bc.ca

More Rural and Indigenous Communities on Vancouver Island to Receive High-Speed Connectivity

BC announced that about 750 additional households, including several First Nations, will access high-speed internet via new fibre infrastructure built with combined provincial, federal, and private-sector funding.

Sources: Provincial Announcement: news.gov.bc.ca

Alberta Awards Over $5 Million in Industry Skills Grants

Alberta is funding more than $5 million for industry-led training in aviation, construction, technology, and mechanical insulation sectors, aiming to develop transferable workforce skills and address persistent labor shortages.

Sources: Provincial Announcement: www.alberta.ca

Nova Scotia Backs Women-Led Businesses in Adopting Digital Tools

Nova Scotia committed $544,200 to the Centre for Women in Business’s EDGE initiative, supporting entrepreneurs to integrate digital and analytics capabilities outside the tech sector.

Sources: Provincial Announcement: news.novascotia.ca

What We're Reading This Week

.