CISA Urges Critical Infrastructure Operators to Isolate Vital OT Systems During Cyberattacks

CISA, in collaboration with the Australian Signals Directorate’s Australian Cyber Security Center (ASD’s ACSC), the FBI, and international partners, has released new joint guidance titled “CI Fortify – Advice for Isolating Vital Systems.”

This guidance aims to strengthen the resilience of critical infrastructure (CI) environments against escalating cyber threats. Published on July 28, 2026, it provides a comprehensive operational framework for isolating vital operational technology (OT) and enabling systems from enterprise and external networks.

This ensures that organizations can maintain essential services during cyber incidents, ransomware attacks, or geopolitical crises.

Infrastructure Operators to Isolate Vital OT Systems

The advisory highlights the increasing risk posed by state-sponsored actors who target CI for espionage and pre-positioning. It also addresses the activities of cybercriminal groups that exploit these environments for extortion and disruption.

To counter these threats, the guidance emphasizes the importance of developing the capability to operate critical systems in a fully isolated state. This approach limits adversarial lateral movement and supports incident containment and system recovery without negatively impacting core service delivery.

At the core of the CI Fortify model is a structured isolation strategy that begins with identifying vital systems, the minimum assets necessary to sustain critical services, and mapping their dependencies.

This includes identifying upstream providers and critical customers such as energy grids and water utilities. Organizations are encouraged to classify systems based on their criticality and trust levels, enabling effective segmentation into security zones corresponding to risk exposure.

A key component of the guidance is mapping all network interconnections to vital systems. This includes connections to corporate IT environments, vendor remote access channels, cloud platforms, and third-party networks.

Detailed documentation of these connections, including architecture diagrams, routing configurations, encryption mechanisms, and ownership, is essential for establishing effective isolation controls and ensuring visibility during crises.

The agencies strongly advocate for creating robust separation and isolation points, with physical isolation identified as the most effective defense.

This involves eliminating shared infrastructure between OT and non-OT environments and deploying dedicated communication paths, such as fiber pairs or CWDM wavelengths for distributed systems.

When full isolation is not feasible, organizations should implement strong cryptographic protections using technologies like IPsec, MACsec, or secure VPN architectures to ensure that all traffic over untrusted networks remains encrypted and tightly controlled.

The guidance also addresses operational challenges, including dependencies on shared services such as Active Directory, DNS, virtualization platforms, and backup systems, which can hinder effective isolation.

CI operators are encouraged to minimize these dependencies by building localized OT capabilities and ensuring independence from enterprise IT systems. Additionally, the use of data diodes and cross-domain solutions is recommended for controlled, high-assurance data transfer between isolated and non-isolated environments.

To operationalize isolation, organizations must develop and regularly test a graduated isolation plan aligned with their incident response procedures.

This plan includes predefined triggers to progressively disconnect access pathways, ultimately achieving full isolation of vital systems. Continuous monitoring of routing tables, network flows, and management planes is critical for validating the effectiveness of isolation and detecting unintended reconnections.

While isolation significantly enhances resilience, the guidance warns of associated risks, such as delayed patching, reduced visibility, and increased reliance on removable media. Therefore, CI operators must implement compensating controls and maintain offline recovery capabilities.

Overall, the CI Fortify guidance emphasizes that isolation is not a one-time measure but rather an evolving capability that requires sustained investment.

By adopting these practices, critical infrastructure organizations can reduce their attack surfaces, improve incident response, and ensure the continuity of essential services in an increasingly hostile threat landscape.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.