CI Fortify – Advice for isolating vital systems

A Coordinated International Playbook

The release of CI Fortify is the latest in a string of joint advisories that CISA has issued alongside the FBI and foreign cyber agencies, this time with the Australian Signals Directorate's Australian Cyber Security Centre taking a leading role. According to the publication, additional international partners contributed to the document, signaling that hardening critical infrastructure is now being treated as a shared Allied responsibility rather than a domestic compliance exercise. The multi-agency authorship matters because isolation decisions for things like power grids, water systems, and transportation networks often cross borders through supply chains, telemetry, and remote-vendor access, and a guidance that is consistent across jurisdictions is more usable for multinational operators.

What 'Isolation' Actually Means in Practice

The advisory focuses on operational technology and the IT systems that enable it, the hardware and software that run physical processes rather than office work. It calls on organizations to identify which systems are truly vital, map every connection those systems have to corporate, vendor, and internet-facing networks, and then put separation points in place so those connections can be cut cleanly. The end state is the ability to operate in isolation for an extended period, meaning the plant keeps running on its own, without remote support, cloud analytics, or external patching channels, for as long as a crisis lasts. That is a meaningfully higher bar than simply installing a firewall; it implies pre-positioned spare parts, local-only monitoring, paper or air-gapped backups, and rehearsed manual procedures.

Geopolitical Crisis as the Trigger

The language of the guidance frames isolation as a response to both cyber incidents and geopolitical crises, a pairing that reflects how threat actors and nation-state pressure increasingly target critical infrastructure as a lever of statecraft. Recent CISA publications listed alongside this one, including advisories on Russian intelligence services targeting commercial messaging apps and on hardening automatic tank gauge systems, show a consistent posture of preparing operators for adversary actions that fall short of full war but still threaten continuity of service. By publishing this advice, the U.S. and its partners are effectively pre-approving the concept of a 'graceful disconnect' for operators who might otherwise hesitate to sever network links during a fast-moving incident. The trade-off is real: isolation reduces attack surface but also cuts operators off from threat intelligence, vendor patches, and remote diagnostics, so the guidance implicitly asks executives to plan for that loss before they are forced into it.