# When the Network Goes Dark: CISA's New Playbook for Keeping Critical Infrastructure Alive
## The Threat
The scenario haunting every critical infrastructure security team isn't a ransomware note on a workstation — it's the moment when an operator reaches for a control interface and nothing responds. CISA and the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC), joined by the FBI and a coalition of international partners, released CI Fortify – Advice for Isolating Vital Systems this week, tackling precisely that scenario: what happens when a cyber incident or geopolitical crisis forces your operational technology environment to run blind, severed from everything it normally depends on.
The guidance isn't a response to a single breach. It's a recognition that the threat posture facing water utilities, energy grids, transportation networks, and industrial control systems has shifted from "attackers trying to steal data" to "adversaries positioning to disrupt or destroy." The distinction matters enormously for how defenders architect their networks. You don't harden for exfiltration the same way you harden for operational denial.
What makes this guidance notable is its explicit framing around *extended* isolation — not the brief, frantic disconnection that follows an incident, but a deliberate, pre-planned capability to run critical systems autonomously for days or weeks. Most organizations have never seriously stress-tested that capability. Most find out they can't do it when they actually need to.
## Severity and Impact
This advisory is guidance rather than a vulnerability disclosure, so there is no single CVE. The table below maps the threat classes CI Fortify is designed to mitigate.
| Threat Class | Severity | Primary Vector | Target Systems | Notable Context |
|---|---|---|---|---|
| OT Network Intrusion | Critical | Internet-facing IT/OT bridging | SCADA, ICS, DCS | State-sponsored actors pre-positioned in CI networks |
| Supply Chain Compromise | High | Third-party vendor access | Enabling systems, HMIs | SolarWinds-era persistence techniques applied to OT |
| Geopolitical Disruption / Crisis | Critical | Physical + cyber combined | All CI sectors | Escalating tensions driving worst-case planning |
| IT-OT Lateral Movement | High | Flat or poorly segmented networks | PLCs, RTUs, engineering workstations | Common in legacy OT environments |
| Extended Denial of Connectivity | High | ISP/backbone disruption or deliberate cutoff | Cloud-dependent OT monitoring | Underestimated in resilience planning |
## Affected Sectors
CI Fortify targets operators across all critical infrastructure sectors, with the highest urgency for environments where operational continuity is non-negotiable:
The guidance explicitly addresses both operational technology (OT) systems and the enabling systems those OT environments depend on — Active Directory, DNS, authentication infrastructure, historian servers — which are frequently overlooked in resilience planning.
## Mitigations
The CI Fortify guidance structures its recommendations around four core capabilities organizations must build *before* a crisis, not during one:
1. Identify and prioritize vital systems
2. Map and reduce external connections
3. Implement effective separation points
4. Practice isolated operations
Additional recommendations include applying Zero Trust principles to OT access, maintaining offline copies of system documentation and backups, and coordinating with sector-specific agencies on sector-tailored implementation.
## References
---
## HackWire Analysis
The timing here is not incidental. CISA released this guidance in the same quarter that Russian intelligence services were confirmed to be actively targeting commercial messaging applications used by critical infrastructure personnel, and just two months after a focused push to harden automatic tank gauges — systems that sit exposed on public internet addresses in fuel storage facilities across the country. There is a through-line: the adversary has already done the reconnaissance. CI Fortify is an acknowledgment that the next move is disruption, and that defenders need to be able to absorb a hit and keep running.
What this guidance gets right — and what most incident response playbooks miss — is the emphasis on *pre-planned* isolation capability. The failure mode in real incidents isn't that operators don't know what to do; it's that the infrastructure to execute isolation doesn't exist when they need it. Firewalls haven't been configured for manual override. Out-of-band communication channels have expired certificates or dead batteries. The backup historian is two years out of date. Vendors no longer know the offline credentials.
The harder conversation this guidance prompts, but doesn't fully surface, is about procurement and budget cycles. Building genuine isolation capability for an OT environment means spending money on redundant communication paths, offline authentication systems, and regular exercises — none of which generate obvious short-term ROI. For water utilities and municipal power operators operating on thin margins with aging infrastructure, this isn't an engineering problem; it's a political one.
The organizations most at risk are mid-size utilities and regional operators who are too large to be ignored by sophisticated adversaries, but too small to have a dedicated OT security team running tabletop exercises quarterly. That gap is where the next serious CI incident is most likely to originate.
— HackWire Editorial
---
## Related Coverage