CI Fortify tells operators to assume adversaries are inside
Federal recovery plans are built for hurricanes, not for a state actor already inside the OT network.
TL;DR
CISA's CI Fortify asks critical infrastructure operators to plan isolation and recovery around two assumptions: third-party connections will fail in a crisis, and adversaries already have access to OT networks. A Federal News Network commentary extends the framing to federal agencies, noting most continuity plans were written for natural disasters, not cyber-caused outages. The load-bearing change isn't another preventive control; it's tested restoration under an assumed-compromise condition.
CI Fortify, CISA's resilience initiative for critical infrastructure operators, reframes the problem from keeping adversaries out to keeping missions running after they get in. The guidance (https://www.cisa.gov/topics/industrial-control-systems/ci-fortify) asks operators to plan around two assumptions: third-party connections and vendor access will be unreliable in a conflict, and threat actors already have some access to the OT network. In that world, isolation and validated recovery become the operational objectives, not afterthoughts.
A Federal News Network commentary wants federal civilian agencies to import that framing. Most agency continuity plans, it argues, were written for floods and hardware failures, not for a state actor with persistent access inside OT.
The piece's darker citations, Volt Typhoon and the Shai-Hulud supply-chain worm, belong to the commentary, and CI Fortify itself is principles rather than a mandate. What survives the filter is the Monday question: has the recovery runbook ever been exercised under the assumption the adversary is already inside, or does it exist mostly on paper? Shutting down a compromised OT system can create the outage the plan was meant to avoid. Prevention buys time. It doesn't by itself keep the mission running.
Published ·Deep Fathom