The Nova Scotia Power Cybersecurity Transparency Act requires Nova Scotia Power Incorporated to prepare and submit an annual cybersecurity report to the House of Assembly that is tabled by May 31 each year. The report must summarize cybersecurity investments, list adopted standards, disclose breaches and impacts, and identify emerging risks and planned responses.
The bill creates a confidentiality carve- out allowing the Minister of Cyber Security and Digital Solutions to permit redactions of technical details in the public report, while mandating that an unredacted version be provided confidentially to the House Standing Committee on Natural Resources and Economic Development. It also makes failure to comply a contravention of the Public Utilities Act, authorizes administrative penalties up to $25,000 per day, and bars the Utility from passing penalties or certain incident-related costs to customers if it failed to comply.
At a Glance
What It Does
The bill mandates an annual, public cybersecurity report from Nova Scotia Power with specific content requirements, allows limited redaction with ministerial consent, and requires a confidential unredacted submission to the legislative committee. It creates enforcement by declaring noncompliance a contravention of the Public Utilities Act and permits daily administrative penalties.
Who It Affects
Directly affects Nova Scotia Power Incorporated, the Minister of Cyber Security and Digital Solutions, the House Standing Committee on Natural Resources and Economic Development, and the regulatory Board that enforces the Public Utilities Act. Indirectly affects ratepayers and cybersecurity vendors who supply services to the Utility.
Why It Matters
The bill ties public accountability to operational security for a provincially regulated electricity utility, changes the oversight posture of the legislature toward cyber incidents, and attaches financial consequences that the Utility cannot pass to customers under certain conditions.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The Act imposes a recurring public-reporting obligation on Nova Scotia Power. Each year the Utility must prepare a report covering four categories: a summary of cybersecurity investments in infrastructure, staffing and training; the cybersecurity standards, frameworks or guidelines it follows; a disclosure of cybersecurity breaches (nature, dates, operational and customer impacts, and remedial measures); and an assessment of emerging risks with planned responses.
The report must reach the Speaker in time for tabling by May 31 or be filed with the Chief Clerk if the House is not sitting.
To balance transparency with operational security, the bill authorizes the Minister of Cyber Security and Digital Solutions to permit the Utility to withhold specific technical details from the public version if disclosure would create an undue risk. That redaction is limited by the requirement that a full unredacted version still be submitted, confidentially, to the House Standing Committee on Natural Resources and Economic Development for review.
The Committee must hold an annual hearing and may call witnesses, including Utility representatives, to explain the report's contents.Enforcement proceeds through the Public Utilities Act: the bill makes noncompliance with its requirements or with the standards the Utility reports a contravention. The designated Board may impose administrative penalties of up to $25,000 per day.
The Act also places two non-recovery constraints on rate setting: the Utility may not pass penalties on to customers via rates, and if the Utility failed to comply with the Act or its reported standards, it may not recover costs, losses, damages or expenditures from a cybersecurity incident through rates. Finally, the Governor in Council may make regulations to add reporting requirements or clarify application, leaving space for further technical or procedural rules to be prescribed later.Taken together, the mechanics create a loop of public disclosure, confidential legislative oversight, and financial consequences intended to drive stronger cybersecurity practices while preserving certain operational secrets.
The law assigns explicit compliance risk to the Utility and formalizes a legislative role in reviewing sensitive security information that previously sat largely within executive and corporate purview.
The Five Things You Need to Know
The Utility must submit an annual cybersecurity report to the Speaker for tabling by May 31 each year or file it with the Chief Clerk if the House is not sitting.
Required report contents are: a summary of cybersecurity investments; the standards, frameworks or guidelines the Utility follows; full disclosure of all cybersecurity breaches with impacts and remedies; and an assessment of emerging risks and planned responses.
The Minister of Cyber Security and Digital Solutions can consent to withhold specific technical details from the public report, but the Utility must provide an unredacted version to the House Standing Committee on Natural Resources and Economic Development.
Noncompliance is a contravention of the Public Utilities Act and exposes the Utility to administrative penalties of up to $25,000 per day, imposed by the Board.
The Utility cannot recover administrative penalties through customer rates, and it cannot recover costs, losses or damages from a cybersecurity incident through rates if it failed to comply with the Act or the standards it reported.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Short title and definitions
Sections 1 and 2 set the Act's short title and define key terms the rest of the bill relies on, including 'Committee' (the House Standing Committee on Natural Resources and Economic Development), 'cybersecurity breach', 'cybersecurity investment', and 'Utility' (Nova Scotia Power Incorporated). Those definitions frame the scope of reporting and enforcement: for example, 'cybersecurity breach' is defined broadly to include unauthorized access or disruption that could compromise service delivery, customer data or system integrity, which captures both IT and operational technology incidents.
Mandatory annual cybersecurity report and contents
Section 3 obliges the Utility to prepare an annual report and prescribes four discrete categories of content—investments, adopted standards, breach disclosures, and risk assessments/plans—and fixes the tabling mechanism and deadline (May 31). Practically, the Utility must set up internal processes to collect financial, operational and incident data on a timetable aligned with provincial budgeting and legislative cycles; it also must articulate the standards it follows, which creates an accountability link between stated practices and later enforcement.
Confidentiality carve-out and legislative access
Section 4 allows the Minister to approve withholding specific technical details from the public report when disclosure would create an undue security risk. It balances that public redaction with a mandatory submission of a full unredacted report to the Committee for confidential review. That creates a secure parliamentary oversight channel while leaving final determinations about what stays public in the Minister's hands—an administrative gatekeeping role that will require procedures for classification, secure handling, and dispute resolution if the Committee demands information the Minister withholds.
Annual Committee hearing and witness power
Section 5 requires the Committee to hold an annual hearing on the report and empowers it to summon witnesses, including Utility representatives. This formalizes legislative scrutiny of cybersecurity posture and incident management. The Committee's access to an unredacted report strengthens its ability to question technical choices, though the statute does not spell out protocols for handling classified material at hearings, which raises operational questions the Committee and Clerk will need to resolve.
Enforcement, penalties and rate-recovery prohibitions
Section 6 makes contraventions of the Act or the reported standards a breach of the Public Utilities Act and authorizes the Board to impose administrative penalties up to $25,000 per day. It also bars the Utility from recovering such penalties through customer rates and prevents recovery of incident-related costs through rates where the Utility failed to comply. Those provisions create both carrot-and-stick incentives: they make noncompliance financially painful and explicit, while leaving ordinary cybersecurity investments and planning costs recoverable subject to normal regulatory review unless otherwise restricted by regulation or Board decisions.
Regulatory authority
Section 7 gives the Governor in Council authority to make regulations prescribing additional reporting requirements or clarifying the Act's application. This leaves the door open for the Executive to add technical reporting detail, timelines, or definitions without amending the statute and is likely where procedural rules (secure handling of unredacted reports, classification criteria, or template report formats) will be established.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Residential and commercial ratepayers — gain stronger transparency around cybersecurity posture and a statutory bar preventing the Utility from passing through penalties or certain incident-related costs to customers if the Utility failed to comply.
- Legislative oversight (House Standing Committee on Natural Resources and Economic Development) — obtains routine, confidential access to unredacted cybersecurity reports and formal hearing power to question the Utility, increasing legislative visibility into critical infrastructure risk.
- Provincial cyber-policy apparatus (Minister of Cyber Security and Digital Solutions) — acquires an explicit gatekeeping role over sensitive disclosures, giving the Minister leverage to balance transparency and security and to shape how technical details are protected.
- Cybersecurity vendors and professional services firms — stand to benefit from increased procurement of security investments and from Utility demand for reporting, auditing and remediation services as the Utility builds the capabilities to comply.
Who Bears the Cost
- Nova Scotia Power Incorporated — faces compliance costs to collect, redact and present data annually, potential multi-day penalties up to $25,000 per day for noncompliance, and the financial risk of irrecoverable incident costs if found noncompliant.
- The regulatory Board — will need capacity to adjudicate contraventions, apply daily administrative penalties, and integrate this new enforcement pathway into rate-setting and oversight work, creating administrative burden and possible need for additional resources.
- The Minister's office and Committee staff — must design and operate secure processes for reviewing unredacted reports, manage classified material handling, and respond to potential disputes between executive, legislative and utility actors.
- Ratepayers indirectly — while penalties and some incident costs cannot be recovered if the Utility is noncompliant, customers could still bear the cost of permitted cybersecurity investments through regular rate mechanisms unless the Board disallows specific items.
Key Issues
The Core Tension
The central tension is between public accountability and operational security: the province wants transparent reporting and legislative oversight of a critical utility to protect customers and ensure preparedness, but exposing too much technical detail risks creating new vulnerabilities; giving a single ministerial office the power to redact information mitigates that risk but concentrates discretion and may undermine independent oversight or provoke under-reporting.
The Act trades increased public and legislative oversight for explicit confidentiality mechanisms, but leaves several operational questions unanswered. It does not specify standards the Utility must meet, only that it report the standards it follows; that creates an enforcement hinge where the Utility's own stated frameworks become the baseline for compliance—an approach that rewards clarity but could incentivize vague or permissive reporting.
The Minister's authority to permit redactions protects operational security, yet concentrates discretion in an executive office without a statutory appeal path for the Committee or a clear definition of 'undue risk.' That raises the prospect of inconsistent application or friction between executive and legislative priorities.
Enforcement mechanics create meaningful financial exposure but rely on administrative procedures that the bill does not flesh out. The statute authorizes daily penalties and links contraventions to the Public Utilities Act, but it does not stipulate procedural safeguards for penalty assessments, nor does it define how the Board should weigh factors like industry-standard compliance or the reasonableness of the Utility's practices.
The ban on rate recovery for penalties and certain incident costs intensifies the stakes of enforcement decisions and could produce conservative reporting behavior or litigation over whether an incident's costs are recoverable when compliance is disputed.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.