The Point: CISA and partners recommend physical or tiered isolation plans for OT systems with regular full testing to protect against prolonged, stealthy intrusions.
CISA, the Australian ACSC, the FBI and international partners have published the “CI Fortify” guideline to equip critical infrastructure organizations against targeted attacks. The backdrop is years of undetected intrusions by state-sponsored groups such as Volt Typhoon and Salt Typhoon in US telecommunications networks and water utilities.
The guideline addresses a central security gap: attackers such as Volt Typhoon and Salt Typhoon have, according to agency statements, operated undetected in critical infrastructure networks for years. Major US telecommunications providers and water utilities, including American Water and a water facility in Kansas, were affected. The recommendations aim to ensure that organizations protect OT (Operational Technology) systems through structured isolation plans rather than having to improvise during an incident.
The core concept of the guideline is based on tiered isolation measures. First, organizations should identify the minimum required systems for critical services and document all connections to corporate networks, cloud services, service providers, and the Internet. Complete physical separation is cited as the most effective protection. If this is not practical — for example due to cloud dependencies — the agencies recommend hardened network boundaries and dedicated connections as alternatives.
For practical implementation, regular testing is critical: isolation plans must be tested in full and on a regular basis, as partial tests typically do not uncover hidden dependencies. Organizations should additionally maintain an offline copy of the plan and develop the capability to operate, monitor, and update OT systems manually during isolation until secure reconnection is feasible. This requires both personnel and technical preparations.
Source: www.it-daily.net · Published 29 July 2026
Lumi AI News — AI-assisted curation pursuant to Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.