CISA and ACSC Blueprint OT Isolation

Cybersecurity authorities in the United States and Australia have launched a collaborative framework intended to help operators of critical infrastructure decouple essential operational technology (OT) from broader, potentially compromised networks. The joint directive from CISA and the Australian Cyber Security Centre (ACSC) focuses on creating a viable pathway for organizations to maintain core services even when external connectivity is severed.

Designing a Path for Isolation

The guidance centers on the implementation of CI Fortify – Advice for isolating vital systems, a strategic approach that demands a comprehensive audit of an organization's digital topology. Before any isolation can occur, operators must first catalog all systems supporting critical services and define the specific trust levels for every network segment. By grouping these assets into distinct zones, security teams can apply more rigorous controls and manage risk with greater granularity.

A critical component of this strategy involves identifying every connection point, including those linking to corporate infrastructure, cloud environments, and peer networks. The documentation process requires that these dependencies be recorded and updated on a regular basis, as the act of isolating a system is not without operational consequences.

In response to persistent threats, CI operators should have the capability to isolate vital OT and enabling systems from all other networks to ensure continuity of critical services. Isolating vital OT and enabling systems can disrupt the ability of malicious cyber actors to achieve their goal, contain active incidents, and allow for safe rebuilding of compromised systems.

— CISA and the ACSC

Infrastructure Separation Requirements

The guidance emphasizes that effective isolation requires more than just logical barriers; it necessitates the creation of robust physical separation points. According to the advisory, physical isolation acts as a foundational requirement to ensure that vital systems remain functional even if the surrounding corporate network is fully compromised. By building these specific isolation points into the architecture, operators can create the capacity to transition into a siloed state during a crisis or active security event.

Managing the Operational Trade-offs

Transitioning to an isolated state introduces new, distinct challenges for operators that must be accounted for in their planning. Because isolation can disrupt system-to-system communication, organizations are urged to coordinate with peers and partners to manage dependencies. Furthermore, operating in a disconnected environment introduces secondary security risks, including:

• A lack of timely patching for critical systems
• Reduced visibility into external environments
• An increased threat of malware infection via removable media

Implications for System Resilience

For organizations operating within the critical infrastructure sector, this guidance suggests that isolation is shifting from a theoretical backup plan to a necessary operational capability. While the ability to disconnect improves an entity's odds of containing an active intrusion, it necessitates a heavy investment in manual process management and long-term maintenance strategies. By adopting these recommendations, organizations may find themselves better positioned to maintain critical services, though they will concurrently need to account for the resulting loss of external management and visibility tools. For additional technical resources on these defensive measures, officials point to the CI Fortify: Strengthening Resilience Across Critical Infrastructure page.