System Brief // NA-CONTROL-ARCHITECTURE-2026-09
You Do Not Have a North American Security Program
Desmond Otieno Odhiambo \u00b7 ClearGlass Intelligence \u00b7 Burlington, Ontario \u00b7 Updated 18 September 2026
North America is a convenient phrase in a board deck. It is a dangerous phrase in a control environment. A shared Entra tenant is not a shared legal system.
A company that sells in Toronto and Chicago from one identity plane does not have a North American program. It has two clocks and one set of logs. The first question is: what changed, who changed it, where the data lived, and which clock started.
The false unity
Bill C-8 / CCSPA is law; designated-operator duties wait on in-force orders. CIRCIA clocks are in statute; the implementing rule is treated here as targeted, not published. CPCSC Level 1 is in select defence contracts. PIPEDA still governs private-sector privacy. CISA CPG 2.0 added Govern.
Four collision surfaces
Privacy vs cyber reporting. PIPEDA, CCSPA, and CIRCIA can fire on the same ransomware event with different thresholds and recipients.
CPCSC vs CMMC. Reuse controls. Do not reuse residency or the assessment body.
Agents. If an agent can retrieve or write, it is an identity, a transfer path, and an evidence obligation.
Govern. Named owners per notification path. Residency by data class. Agent inventory. Evidence that survives two auditors.
North American Control Architecture
- Decision register by data class.
- Identity and endpoint exposure reduction.
- Dual-clock incident object.
- Agent boundary with approval tokens and append-only logs.
- Control reuse with a residency and compulsion column.
| Clock | Trigger | Destination |
|---|---|---|
| PIPEDA | Real risk of significant harm | OPC + individuals, as soon as feasible |
| CCSPA | When designated and in force | CSE + regulator, period capped at 72 hours |
| CIRCIA | When final and applicable | CISA 72 hours / 24 hours for payment |
If counsel cannot fill those fields from this week's logs, the logging program is the incident.