CISA, ASD Issue Joint OT Isolation Guidance

On July 28, CISA and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), with the FBI and international partners, published CI Fortify: Advice for Isolating Vital Systems. The guidance helps critical infrastructure operators prepare to isolate operational technology (OT) and its supporting systems during a serious cyber incident while keeping essential services running.

The practical challenge is that an emergency network cut can contain an intrusion but also interrupt safety and control functions. CI Fortify calls for preparation before that decision is made under pressure. Its central actions are to identify critical assets and their connections, build effective separation points, and create graduated isolation plans that operators test regularly. It also describes temporary measures for organizations that cannot physically isolate systems, while identifying physical isolation as the more risk-effective option.

For an OT owner, this becomes a set of concrete planning questions: Which control and enabling systems are vital to continued service? Which external, corporate, and vendor connections must be cut first? What process remains safe when those links are unavailable? Who has authority to isolate each segment, and how will operators communicate if enterprise systems are down?

The plan should be specific to the process, not just a generic network diagram. Operators need documented isolation points, known dependencies, a safe sequence for disconnecting systems, and a tested way to keep essential operations running. A tabletop can expose ownership and communication gaps; technical exercises are needed to confirm the isolation points work as designed. Keep an accessible copy of the procedure outside the systems it is intended to protect.

The release frames CI Fortify as preparedness guidance. It does not identify a particular incident as the reason for publication or name a threat actor. Its value is operational: it gives infrastructure teams a shared planning task before an intrusion forces an improvised choice between containment and service continuity.