(TLP:CLEAR) Isolating OT Is Only Half the Plan: Building Communications Continuity after Disconnection

Summary: Recent CISA-led guidance, “CI Fortify – Advice for Isolating Vital Systems,” directs critical infrastructure operators to prepare in advance to disconnect vital operational technology from corporate, internet-facing, and untrusted networks during a cyber incident or crisis, and to keep essential services running while isolated. For water and wastewater utilities, that means pumps continuing to run, operators coordinating shifts, and regulators receiving updates even after the network is cut. A recent BlackBerry blog post builds on that guidance and raises a practical gap the isolation planning often overlooks: the communications infrastructure a utility depends on frequently runs on the same network it just disconnected.

The core premise is straightforward. A utility that can isolate its network but cannot reach staff, confirm who acknowledged an alert, coordinate manual operations, or brief external partners has traded one failure mode for another. The post frames communications continuity as part of the isolation plan rather than an afterthought and outlines a phased approach: first establish reliable multi-channel alerting to replace manual call trees, then stand up an out-of-band coordination channel that does not run through the isolated network, and finally bring the small set of response devices under proper identity, access, and update controls.

Analyst Note: The value here for the water sector is less about any single vendor product and more about a question worth answering before an incident forces it: if a utility isolated its operational technology tonight, could its team still coordinate the response by morning? Attacks against water systems have already produced loss of monitoring, loss of control, boil-water notices, and extended periods of manual operation. In each of those scenarios, the ability to reach the right people and coordinate securely is what separates a controlled response from a chaotic one.

Manual call trees – still common at many utilities – tend to fail precisely when they are needed most, during overnight hours, severe weather, or when staff are already stretched. The related concern is trust in the fallback channel itself. A backup channel that runs on the same infrastructure being isolated, or on a device that may already be compromised, is not a reliable fallback.

WaterISAC encourages members to treat communications continuity as a planning priority alongside network isolation. Practical steps members can consider include:

• Confirm that alerting can reach employees, contractors, mutual aid partners, and external stakeholders across multiple channels at once, with the ability to track who acknowledged.
• Establish and rehearse an out-of-band coordination channel that does not depend on the network being isolated, including a path to reach state partners and CISA.
• Identify the limited set of devices response leaders will rely on during an isolation event and bring them under management.
• Run a drill that isolates systems, notifies the response population, coordinates manual operations, and produces a record of who was contacted and when.

That last record matters beyond the incident itself. During an after-action review or regulatory inquiry, documentation of who was reached, through which channel, and when they responded becomes the evidence a utility uses to account for its actions.

Original Source: https://www.blackberry.com/en/secure-communications/insights/blog/90-day-communications-continuity-plan-water-utilities

Additional Reading:

• CI Fortify – Advice for Isolating Vital Systems
• CI Fortify: Strengthening Resilience Across Critical Infrastructure

Related WaterISAC PIRs: 6, 8, 12