CISA Urges Critical Infrastructure to Isolate Systems From Networks

Key Takeaways

• CISA, alongside international partners, has released new guidance for critical infrastructure organizations.
• The “CI Fortify” framework provides actionable steps to isolate vital systems during cyberattacks or geopolitical events.
• The recommendations emphasize operational continuity for essential services, even if primary networks are compromised.
• The initiative marks a strategic shift towards resilience-focused security, acknowledging that breaches are increasingly inevitable.

The Cybersecurity and Infrastructure Security Agency (CISA), in a collaborative effort with the Australian Signals Directorate’s Australian Cyber Security Center (ASD’s ACSC), the Federal Bureau of Investigation (FBI), and other international allies, has issued new joint guidance aimed at bolstering the resilience of critical infrastructure (CI) entities.

This “CI Fortify” guidance offers practical recommendations designed to enable organizations to quickly isolate their essential systems during active cyber incidents or periods of geopolitical instability.

A central tenet of the CI Fortify framework is the imperative to maintain critical services even when primary networks face compromise. This includes ensuring that crucial operational technology (OT) systems—those underpinning sectors such as energy, water, transportation, and healthcare—can function independently of corporate IT networks and external connections.

CISA and Partners Unveil Checklist for CI System Fortification

These protective measures are consistent with broader frameworks for operational technology, which are designed to safeguard legacy industrial assets.

The document outlines a systematic methodology for identifying and prioritizing “vital systems,” defined as assets indispensable for safety, service delivery, or national security. Organizations are encouraged to meticulously assess dependencies, encompassing both upstream and downstream systems, to fully comprehend how disruptions could propagate throughout their operations.

The joint advisory provides a checklist of technical and operational steps to prepare organizations for emergency isolation:

• Asset Mapping: Identify all critical assets and delineate system interdependencies across both IT and OT environments.
• Separation Points: Establish clear and defined points of separation between vital systems and less critical network segments.
• Isolation Mechanisms: Implement robust isolation mechanisms, such as air-gapping, network segmentation, or controlled disconnection procedures.
• Manual Fallbacks: Develop and rigorously test manual fallback procedures to ensure continued operations without reliance on digital dependencies.
• Personnel Readiness: Ensure that all relevant personnel are comprehensively trained to execute isolation protocols swiftly and effectively during emergencies.

Furthermore, the guidance stresses the importance of having pre-configured isolation plans that can be activated rapidly, thereby minimizing delays in decision-making during active incidents.

Example Use Case: Consider a power grid operator facing a ransomware attack. By pre-establishing segmentation controls and manual override capabilities, the operator could isolate its supervisory control and data acquisition (SCADA) systems from corporate IT networks. This would allow for the continued delivery of electricity while incident response teams work to contain the threat within non-critical systems.

This guidance arrives amidst a global surge in cyberattacks targeting critical infrastructure, including evolving campaigns against industrial control systems often driven by advanced persistent threat (APT) groups and geopolitical tensions. Such campaigns frequently exploit weak segmentation between IT and OT environments, facilitating lateral movement and widespread disruption. By advocating for isolation as a core defensive strategy, CISA and its partners aim to restrict attacker access and reduce the “blast radius” of incidents.

The guidance is aligned with broader secure-by-design and resilience-focused initiatives promoted by international cybersecurity agencies.

The CI Fortify framework represents a significant paradigm shift from purely preventive security models to approaches centered on resilience. Instead of assuming that breaches can always be averted, the guidance prepares organizations to operate effectively even in the event of a compromise.

For cybersecurity leaders, this underscores the necessity of integrating isolation planning into incident response strategies, OT security architectures, and overarching business continuity planning. As regulatory pressures intensify across critical sectors, adopting such frameworks may also aid in complying with emerging mandates for resilience.

Organizations can access the full guidance through CISA and ASD ACSC official resources to commence the implementation of these critical isolation strategies.

What You Should Do

• Review and understand the CI Fortify guidance document thoroughly.
• Conduct an exhaustive assessment to identify all vital systems within your organization and map their interdependencies across IT and OT networks.
• Develop and implement clear separation points and robust isolation mechanisms for critical assets.
• Create and regularly test manual fallback procedures to ensure operational continuity without digital reliance.
• Train all relevant personnel on emergency isolation protocols and incident response procedures.
• Integrate isolation planning into your incident response, OT security, and business continuity strategies.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.