I can't respond specifically. I'm like Professor Kitchen in my ability to answer these details. The key agency to provide information and notification is probably the Communications Security Establishment, CSE, but I don't know in detail how much they have moved in this area, because their work has always been dealing with the electronic world.
One of the dangers here—and I agree with Professor Kitchen that this is information—is stepping over the line with the government trying to regulate and to force on private companies certain procedures or certain systems. You could imagine a central system. That's going to be problematic because of the private sector issues involved, so care needs to be taken there.