Compliance Reference · Manufacturing · BC

Manufacturing Compliance in British Columbia: Safety, Environment, Trade, and IT Security Requirements

This is a reference guide for BC manufacturers summarising the federal, provincial, and sector-specific regulatory frameworks that shape worker safety, hazardous materials, export controls, and environmental obligations. Hexafusion is an IT services partner, not a trade compliance advisor or legal counsel. Confirm current obligations with WorkSafeBC, Transport Canada, Global Affairs Canada, and qualified counsel.

Federal regulatory framework

BC provincial framework

Manufacturing-specific regulators and statutes

• WorkSafeBC. The core provincial safety regulator for manufacturers, with OHS Regulation requirements covering machine guarding, confined space, ergonomics, fall protection, and chemical handling.
• WHMIS 2015. Federal and provincial framework for hazardous products in the workplace. Digital SDS libraries, label management, and training records are common IT systems here.
• Transportation of Dangerous Goods Act and Regulations. Covers shipping, labelling, documentation, and training for dangerous goods in transit. Retention of shipping documents is a key IT obligation.
• Export and Import Permits Act. Administered by Global Affairs Canada, with the Export Control List driving permit and record-keeping obligations.
• Controlled Goods Program. For manufacturers that examine, possess, or transfer controlled goods, the Program requires registration, security plans, visitor controls, and cybersecurity-relevant access controls.
• Environmental Management Act (BC). Emissions, effluent, waste, and contaminated site obligations. Digital environmental monitoring data becomes part of the compliance evidence set.
• Canadian General Standards Board. For manufacturers supplying the federal government, CGSB standards may apply to product quality and documentation.
• Industry-specific regulators. Food and beverage manufacturers also fall under the Canadian Food Inspection Agency and the Safe Food for Canadians Regulations.

Cross-cutting frameworks

• PCI DSS for card-based sales and e-commerce.
• NIST Cybersecurity Framework and CIS Controls including CIS Industrial Control System guidance.
• ISA/IEC 62443 for industrial control system security.
• SOC 2 as due diligence for cloud MES and ERP vendors.
• Cyber insurance underwriter expectations. Multi-factor authentication, endpoint detection and response, tested backups, phishing training, incident response plans, patching, and increasingly OT network segmentation and supply chain controls.

Manufacturers face compliance pressure from several directions at once: worker safety inspectors, environmental regulators, trade compliance auditors, customers imposing supply-chain security clauses, and cyber insurers pricing the increased risk of OT-reachable ransomware. The common thread is evidence. Inspectors and auditors all want to see that records exist, that they are protected, that they are retained, and that they can be produced on request. The same technical baseline (multi-factor authentication, endpoint detection and response, tested backups, phishing training, incident response plans, and documented patching) supports most of these audiences. OT-specific additions, including network segmentation between business and plant systems, monitoring of industrial control protocols, and vendor remote-access controls, address the manufacturer-specific risk that matters most to modern underwriters.

How IT controls map to the regulatory stack

• Retention schedules for safety, environmental, quality, and export records, aligned with WorkSafeBC, Environmental Management Act, and CRA expectations.
• Access logs on ERP, MES, and quality systems, with separation between production, engineering, and finance roles.
• Encryption at rest and in transit for engineering drawings, controlled goods data, and export documentation.
• Written breach response plan with OT-aware escalation paths, aligned to PIPEDA and BC PIPA.
• Tested backups and disaster recovery for ERP, MES, and engineering systems, with offline or immutable copies.
• MDR, EDR, MFA, and patching, plus IT and OT network segmentation.

Manufacturers that handle these controls well treat IT and OT as separate but coordinated domains. On the IT side, a familiar baseline of managed identities, MFA, endpoint detection and response, patched systems, and monitored cloud services applies. On the OT side, segmentation between business and plant networks limits lateral movement, monitored jump hosts govern remote access by vendors, and patching follows a change-controlled cadence that respects the realities of production windows. Engineering drawings, bills of material, and controlled goods documentation live in dedicated repositories with stronger access control than general file shares. Quality records are retained according to customer and regulatory expectations rather than general policy, and export records are tied to the specific permits and end-use statements they support.

Customer-imposed cybersecurity clauses are the newest pressure point. Large industrial buyers, government supply, and defence supply chains now routinely require suppliers to attest to specific cybersecurity controls, sometimes via a questionnaire and sometimes via third-party certification. Manufacturers that have already aligned to a recognised control catalogue (NIST CSF, CIS Controls, or ISO 27001) can respond to these requests without starting from scratch, and can usually satisfy multiple customers with a single evidence package.

Where Hexafusion fits

Hexafusion operationalizes the IT controls that support BC manufacturers' safety, trade, environmental, and privacy obligations. That includes ERP and MES infrastructure, IT and OT segmentation planning, engineering data protection, backup strategies for quality and export records, and written documentation that supports WorkSafeBC inspections, Controlled Goods Program reviews, and insurer underwriting. Our founder's PCI DSS Internal Security Assessor background informs how we structure control evidence.

We do not interpret the Defence Production Act, do not file environmental permits, and do not act as your trade compliance advisor. Those roles belong to qualified counsel, your environmental consultant, and your designated trade compliance officer.

Common questions from BC manufacturers at the intake stage include how to segment plant networks from business networks without breaking production reporting, how to provide remote support to equipment vendors without opening a ransomware vector, how to retain controlled goods and export documentation in a way that satisfies Global Affairs Canada, and how to respond to the cybersecurity questionnaires that large industrial buyers now include in procurement. Each question has a technical answer that flows from a well-governed IT and OT environment, which reduces the amount of improvisation needed when an inspection, customer audit, or insurer renewal arrives.

Related compliance resources

• WorkSafeBC
• Transport Canada, Transportation of Dangerous Goods
• Global Affairs Canada Export Controls
• Controlled Goods Program
• BC Environmental Management
• Office of the Information and Privacy Commissioner for BC
• Canadian Centre for Cyber Security

Frequently Asked Questions

Other compliance reference pages

• Construction compliance in BC
• Non-profit compliance in BC
• Accounting firm compliance in BC

Reviewed by Alex Barari, Founder, former PCI DSS Internal Security Assessor (ISA).