IC Technology & Cyber — 2026-07-29

CISA FBI and Five Eyes Partners Issue CI Fortify Guidance on Isolating Critical Infrastructure from State-Sponsored Cyber Threats

BLUFCI Fortify amounts to an official concession that state-sponsored intrusions in US critical infrastructure cannot be reliably evicted, leaving voluntary network isolation as the primary defensive option absent any enforcement mechanism.

CISA, the FBI and the Australian Signals Directorate's ACSC released joint guidance called CI Fortify, providing critical infrastructure operators with practical steps to isolate vital operational technology and enabling systems from other networks and sustain operations in isolation for an extended period 12. The guidance directs operators to identify critical customers and service delivery targets, map which OT assets and supporting infrastructure are needed to meet them, and update business continuity plans to operate safely while isolated for weeks to months 3. CISA also asked industrial automation control system vendors and suppliers to identify contractual or licensing blockers, such as issues tied to server connections, that could prevent operators from exercising isolation plans or acting during an actual emergency 3. The release follows ASD's own CI Fortify guidance issued in October 2025, which similarly instructs Australian operators to isolate vital OT systems for up to three months while maintaining critical services 3.

Analysis
CI Fortify pushes the operational burden onto asset owners and vendors rather than government responders: operators must map service-delivery targets to specific OT assets and rewrite continuity plans around monthslong isolation, while automation vendors face pressure to unwind contractual and licensing terms built on constant connectivity. The guidance concedes that Volt Typhoon-style prepositioning cannot be reliably detected or evicted in the near term, making isolation the fallback control, though no audit or enforcement mechanism accompanies the advisory and vendor adoption hinges on commercial incentives CISA cannot compel. Sourcing traces almost entirely to the joint CISA-ASD release, with outlet reporting repackaging that text rather than adding independent confirmation, and the timing may reflect scheduled alignment with ASD's October guidance rather than fresh intelligence on an imminent OT compromise.

5 sources

CI Fortify – Advice for isolating vital systems - CISA
CI Fortify – Advice for isolating vital systems - Cyber.gov.au (Australian Signals Directorate)
CISA tells critical infrastructure operators to plan for isolation - TechInformed
CISA shares advice on isolating vital systems during cyberattacks - BleepingComputer
CISA Releases Joint Guidance to Isolate Operational Technology and Enabling Systems in Critical Infrastructure - HSToday