CISA-ASD Guidance Maps Sustained ICS Isolation
The joint guidance treats isolation not as a short-term containment measure but as an extended operational state operators must rehearse before a crisis begins.
TL;DR
CISA and the Australian Signals Directorate released joint guidance directing critical infrastructure operators to map which systems must keep running when networks go dark. "CI Fortify, Advice for isolating vital systems" walks through identifying critical OT and mapping dependencies, then building separation points so an operator can disconnect from unreliable third-party connections and sustain operations in isolation. The guidance assumes adversaries will have some access to the OT network when a crisis hits and that telecom, internet, and vendor connections won't be trustworthy. Operators who haven't pre-mapped those boundaries face a hard problem under fire.
The guidance, published under the CI Fortify initiative CISA launched in May 2026, doesn't treat isolation as a containment step within a standard incident response playbook. It treats it as the operating assumption: at some point during a crisis, the internet, telecom, vendors, and upstream dependencies will be unreliable, and the adversary will already have some foothold in the OT network. The organization's job is to have pre-identified which systems are vital and mapped every connection to them, building separation points that let it cut itself free and keep running.
That's a heavier lift than it sounds. Most ICS environments run on legacy hardware and proprietary protocols that were never designed with this kind of segmentation in mind. CISA has acknowledged this for years. The 2023 guidance on segregating ICS-OT architectures noted that these systems were built for safety and reliability, not security. The CI Fortify guidance pushes operators past the traditional IT/OT network divide and toward a model where even within the OT zone, critical functions are separable from everything else.
The recovery half is equally demanding. Operators are told to practice restoring compromised systems while still isolated. They have to rehearse manual and local operations. The guidance gives them a few years to get there.
For the municipal water utility or the defense contractor running a plant floor, the Monday question is whether anyone has actually identified which systems qualify as vital and what dependencies they have. Mapping those connections and testing cutover procedures isn't something that happens during an incident. It's pre-work that, until now, most CI operators had no formal federal framework telling them to prioritize. Now they do.
Published ·Deep Fathom