A federal cybersecurity project's budget nearly doubled, then stalled. Now there's a $213.8M contract

Line up three numbers from one federal cybersecurity project and they look like a climbing price tag: $72.7 million, then $144.3 million, then a $213.8 million contract. But they aren't the same kind of number, so they can't be chained into "it tripled."

What the system does

The project is a Security Information and Event Management system, or SIEM. It pulls security records from across federal networks into one place, flags suspicious patterns and can trigger automatic responses.

Shared Services Canada (SSC), the department behind the government's core IT, runs it with the Communications Security Establishment's cyber centre.

The first two numbers: a project budget

The Auditor General's report, tabled Oct. 21, 2025, says SSC started the project in April 2017, to be done by March 2023. Its original budget was $72.7 million, revised to $144.3 million in May 2021.

It ran late, partly because finding a qualified vendor was hard. In June 2024 it was put on hold, "pending approval of additional funding."

The Auditor General found that the delay left monitoring gaps unresolved and "created cost inefficiencies." One example: analyzing the events SSC passed to the cyber centre cost about $16.9 million over three years, plus an estimated $13.8 million in 2024–25.

What the department said

At the public accounts committee on Jan. 26, 2026, an opposition MP asked how many millions had been spent. SSC's president didn't give a figure. He said the money "has only been on the procurement processes," and that the original plan was "overspecified." The main cost driver, he said, was a rule to keep data much longer than needed.

He added that the government has "always had" such a system, and still funds it.

The third number: a contract

On Feb. 6, 2026, SSC awarded Bell Canada a contract worth $213,776,012, running Feb. 24, 2026 to Feb. 23, 2031. The CanadaBuys notice lists it as competitive, chosen on the "highest combined rating of technical merit and price."

That's the value written into a five-year contract. It isn't the old project's budget, and it isn't money already spent. The record doesn't say whether it covers the same scope as the 2017 project, or how much will be paid.

The money Parliament votes on

Two smaller numbers are one-year spending requests: $13.3 million in the 2025–26 Supplementary Estimates (C) and $37.5 million in the 2026–27 Main Estimates, according to SSC's briefing to MPs. (The Main Estimates themselves don't list it separately.)

SSC says both come from funding announced in the 2022 Fall Economic Statement. A 2022 SSC briefing note put that at $205.1 million over five years starting in 2023–24, plus $40.9 million a year ongoing, "restricted solely" to this system. How that money relates to the $144.3 million budget, or to the 2024 pause, isn't explained.

What's next

SSC's 2026–27 Departmental Plan says a first piece, a central store of security logs, gets built this fiscal year, with full rollout over the next two. Its action plan targets approval to operate by March 31, 2027.

What we know, and what we don't

Established: the April 2017 start; the $72.7 million and $144.3 million budgets; the June 2024 hold; the Bell contract's value, dates and competitive award; the $13.3 million request; the Departmental Plan timeline.

Claimed: the $37.5 million 2026–27 request (from SSC's briefing; not broken out in the Main Estimates); SSC's account that spending went "only" to procurement, that the first requirements were overspecified, and that an interim system has always run.

Unknown: how much was spent before the pause; how the Bell contract's scope compares with the 2017 project; the full lifetime cost.

Spin check

Chaining unlike numbers: $72.7 million to $144.3 million is a budget that nearly doubled, and it's on the record. Tacking on $213.8 million to make it "tripled" mixes a budget with a contract value. Adding them up does the same. And none of them measures what was actually spent.

Bottom line

The project's budget nearly doubled, then it stalled. A five-year, $213.8 million contract is now signed. What the whole thing has cost, and will cost, hasn't been published.

Sources