Key Takeaways
- Six-step blueprint: CISA and Five Eyes allies released official guidance for isolating operational technology (OT) during severe cyber threats.
- Zero connectivity goal: Strict separation between OT networks and corporate IT, eliminating shared routers, switches, and compute nodes.
- Practical execution: IT and OT admins must map dependencies, enforce dedicated encryption, and test isolation workflows before an incident occurs.
What is Changing?
The Cybersecurity and Infrastructure Security Agency (CISA), alongside Five Eyes international partners, published the CI Fortify guide. This framework provides a structured six-step blueprint designed to lock down critical infrastructure systems during an active cyberattack.
The core objective is establishing complete separation between operational technology (OT) networks and enterprise IT environments. To achieve this, CISA recommends eliminating shared infrastructure entirely, including switches, routers, and virtualized compute resources.
The 6-Step Isolation Roadmap
| Step | Action Focus | Technical Requirement |
|---|---|---|
| 1. Identify Essential Systems | Core Operations | Define the minimum set of assets required to maintain essential services. |
| 2. Map Connections | Network Visibility | Document all physical and logical interconnections between OT and corporate environments. |
| 3. Record Baselines | Technical Audit | Log firewall rules, router tables, and VPN configurations for every link. |
| 4. Enforce Zero Connectivity | Infrastructure Isolation | Remove shared hardware and segment networks using VLANs, MPLS, or hardware air gaps. |
| 5. Dedicated Encryption | Data Protection | Deploy hardware encryption across carrier links and secure Layer 2 and Layer 3 traffic. |
| 6. Test Isolation Drills | Operational Readiness | Run periodic disconnect simulations to avoid unexpected downtime during a real crisis. |
Why It Matters for System Administrators
For IT admins and OT engineers managing power grids, water facilities, or enterprise setups, this guidance transforms emergency response from reactive guesswork into an engineered procedure.
Organizations should pay close attention to shared infrastructure services that often create hidden bridging vulnerabilities:
- Active Directory: Ensure OT domain controllers do not share trust relationships with compromised corporate domains.
- DNS and PKI Services: Maintain localized or fallback resolution and certification services within the OT perimeter.
- Jump Hosts: Audit contractor access paths to ensure connections can be severed immediately.
Implementation Strategy: Phased Disconnect
Achieving complete physical isolation in distributed OT environments can be challenging. Where air-gapping is impractical, strong hardware encryption and dedicated carrier paths serve as the primary fallback.
Adopting a phased isolation sequence allows teams to mitigate risk without accidentally disrupting critical operations:
- Phase 1: Cut remote worker jump-host access and vendor support tunnels.
- Phase 2: Sever corporate remote links and non-essential synchronization processes.
- Phase 3: Execute full OT isolation, running operational systems autonomously.
Have you conducted an isolation test between your corporate IT and OT networks recently? Share your experiences or questions in the comments below.