(TLP:CLEAR) CISA, Partners Publish OT Isolation Guidance: “CI-Fortify – Advice for Isolating Vital Systems”

Summary: On Monday, CISA, the Australian Signals Directorate (ASD), and other federal and international partners released joint guidance, “CI Fortify – Advice for Isolating Vital Systems”, led by ASD. The guidance provides critical infrastructure operators with practical steps to isolate vital OT systems from all other networks during a crisis or disruption and to continue operating in isolation for an extended period.

The document walks operators through a repeatable path: identifying vital systems and critical customers, categorizing networks by criticality and trust, mapping every interconnection and potential isolation point, building physical and cryptographic separation, and creating and testing a graduated isolation plan. It also addresses post-isolation monitoring and the residual risks of running isolated, such as systems falling out of patch and reduced external visibility.

Analyst Note: State-sponsored actors like Volt Typhoon have shown sustained interest in pre-positioning within U.S. water and other critical infrastructure networks, making the ability to disconnect and continue operating a practical resilience requirement rather than a theoretical one. For many utilities, complete physical isolation at every site is not feasible, so the guidance’s emphasis on hardening OT boundaries, eliminating hidden IT-to-OT dependencies (i.e., shared Active Directory, DNS, time sync, virtualization, and backup services), and treating any carrier link as hostile is especially relevant.

WaterISAC encourages members to use this document as a planning resource. Members can:

• Map and document every connection into OT environments, including vendor and remote access.
• Identify and remove IT-to-OT dependencies that would break isolation.
• Build and periodically test a graduated isolation plan tied to the incident response plan.
• Store an offline hard copy of isolation plans.

Original Source: https://www.cisa.gov/resources-tools/resources/ci-fortify-advice-isolating-vital-systems

Additional Reading:

• CISA Joins Australia and Others to Publish Guidance to Isolate Operational Technology and Enabling Systems in Critical Infrastructure
• CISA CI Fortify Initiative
• (TLP:CLEAR) WaterISAC Advisory – PRC-sponsored Volt Typhoon Activity and Supplemental Living Off the Land Guidance

Related WaterISAC PIRs: 12