Quick answer: CI Fortify is joint guidance published July 28, 2026 by CISA, the Australian Signals Directorate’s ACSC, the FBI, the UK’s NCSC, and the Canadian Centre for Cyber Security. It requires critical infrastructure operators to be able to isolate vital OT systems from all other networks during a cyber incident – and keep delivering essential services while disconnected. For most OT environments, the gap is not the plan but the engineering: flat networks have no pre-built isolation points to execute. On July 28, 2026, CISA – together with the Australian Signals Directorate’s ACSC, the FBI, the UK’s NCSC, and the Canadian Centre for Cyber Security – published joint guidance titled CI Fortify: Advice for Isolating Vital Systems. The message is blunt: critical infrastructure operators must be able to disconnect vital operational technology from corporate networks, the internet, and third parties during a cyberattack or geopolitical crisis, and keep delivering essential services while disconnected.This is not abstract preparedness language. The agencies name the backdrop explicitly: state-sponsored actors pre-positioning inside critical infrastructure – Volt Typhoon sat undetected in victim networks for at least five years – and ransomware crews who have learned that manufacturers, hospitals, and utilities pay faster when production is down.The question the guidance forces every OT operator to answer is uncomfortable: if you had to isolate your plant network in the next ten minutes, could you? Would you know where to cut, who authorizes it, and what breaks when you do? For most organizations, the honest answer is no. That gap – between an isolation plan on paper and an isolation capability that has been engineered and tested – is exactly what CI Fortify is trying to close. What does CI Fortify actually require?Strip away the framework language and the guidance lays out a six-step path:Identify vital systems – the minimum OT and enabling systems required to keep delivering the critical serviceIdentify critical customers and upstream dependenciesSet criticality and trust levels across networks and hostsMap every connection to vital systems: corporate IT, vendor remote access, cloud platforms, internet-facing services, other operatorsBuild separation and isolation points in advance, with authorization and trigger criteria defined before the incidentCreate and test a graduated isolation plan – full-system exercises, not partial tests, because partial tests miss the shared dependencies (identity services, DNS, historians, licensing) that fail the moment you cut the boundaryThe guidance holds up physical isolation as the most effective protection – but concedes in the same breath that full physical disconnection is impractical for organizations that depend on carrier networks, cloud services, or geographically distributed facilities. That describes most modern manufacturing. For those environments, the agencies recommend hardening OT boundaries, removing unnecessary corporate dependencies, and maintaining the ability to progressively restrict access as threat conditions escalate.That escalation model has a name in the guidance: graduated isolation. First cut remote workers and vendors. Then corporate connectivity. Then connected systems, and eventually all external links – with trigger criteria for each step defined in advance, and complete isolation of the most vital systems as the target state. Why does graduated isolation fail on a flat network?Graduated isolation presupposes that the graduations exist. On a typical brownfield OT network, they don’t. On paper, most plants still describe themselves in Purdue model terms – neatly layered levels with controlled conduits between them. In practice, decades of IT/OT convergence have produced flat environments where the HMI, the historian, the engineering workstation, the vendor jump box, and hundreds of unmanaged devices share broadcast domains. The “isolation points” the guidance calls for would have to be improvised during the incident – emergency firewall rules, VLAN surgery, cable pulls – executed from tribal knowledge at 2 a.m. while the attacker is already moving.The guidance itself rates administrative controls like VLANs and access lists as “minimally effective” – interim measures on the road to real isolation, not something to rely on long-term. And the reasons are the ones every operator already knows: they are static, error-prone at scale, and were never designed to contain a threat that is actively pivoting. An isolation plan that depends on hand-editing access lists during an active intrusion is a plan for discovering your hidden dependencies the hard way.The engineering problem: how do you give an OT environment real, pre-built, instantly executable isolation points – without ripping out the network, without agents on devices that can’t take them, and without a segmentation project that stalls at the first change-control meeting? How does a ransomware kill switch make graduated isolation executable?This is where zero trust device segmentation changes the equation. Zscaler places enforcement at the local gateway: every device on the OT network is isolated into its own segment of one, and every east-west flow is evaluated against identity- and context-based policy – agentless, with no re-architecture of the plant network and no static ACL sprawl.On top of that enforcement fabric sits the Ransomware Kill Switch, and it maps almost one-to-one onto CI Fortify’s graduated isolation model. Rather than improvising containment mid-incident, operators pre-stage policy sets at escalating severity levels: at elevated posture, lock down known-abused lateral-movement protocols across the site; escalate further and cut vendor and third-party remote access; at the most severe posture, disable communication to entire network segments – a production line, a plant floor – in a single action, while permitted critical flows continue.Read against the guidance’s own vocabulary:Isolation points stop being physical locations someone must find and become documented policy constructs, executable in secondsGraduated isolation stops being a sequence of emergency change requests and becomes a severity dial with pre-defined, pre-tested consequences at each levelAuthorization and triggers become access controls and automation logic rather than a phone tree – the kill switch is API-addressable, so SIEM, SOAR, and EDR tooling can trigger containment the moment detection confidence crosses a thresholdTesting stops being an annual disruption and becomes routine: because isolation is policy, you can exercise it, observe what breaks, fix the dependency, and re-run – the iterative loop the guidance says partial testing never achievesOne boundary worth stating plainly: CI Fortify asks for two capabilities – isolating vital systems quickly, and operating in that isolated state for an extended period. A kill switch is a decisive answer to the first, compressing containment from hours of improvisation into seconds of execution – and those first hours usually decide whether an incident is an outage or a catastrophe. Sustained fully disconnected operation is an architecture and operations planning question that no single control resolves. Whether it is achievable is something every operator has to verify against their own environment – the identity services, historians, and licensing dependencies that only surface when you actually exercise the boundary – not against a reference architecture. Where should OT operators start?The sequence CI Fortify prescribes is the right one, and modern device segmentation accelerates each step: automatic discovery and classification to identify vital systems and expose the connection map you didn’t know you had; identity-based policy to define isolation points without re-architecting the network; severity-based kill switch policies to make graduated isolation executable; and routine, low-risk testing to find dependencies before an adversary does.The agencies have told operators, in plain language, to be ready to disconnect. The organizations that fare best won’t be the ones with the thickest isolation binder. They’ll be the ones for whom isolation is a button that has already been tested.Ready to see what pre-engineered isolation looks like in your environment? Request an OT architecture workshop to map your vital systems, connections, and isolation points against the CI Fortify model.
[#item_full_content] Quick answer: CI Fortify is joint guidance published July 28, 2026 by CISA, the Australian Signals Directorate’s ACSC, the FBI, the UK’s NCSC, and the Canadian Centre for Cyber Security. It requires critical infrastructure operators to be able to isolate vital OT systems from all other networks during a cyber incident – and keep delivering essential services while disconnected. For most OT environments, the gap is not the plan but the engineering: flat networks have no pre-built isolation points to execute. On July 28, 2026, CISA – together with the Australian Signals Directorate’s ACSC, the FBI, the UK’s NCSC, and the Canadian Centre for Cyber Security – published joint guidance titled CI Fortify: Advice for Isolating Vital Systems. The message is blunt: critical infrastructure operators must be able to disconnect vital operational technology from corporate networks, the internet, and third parties during a cyberattack or geopolitical crisis, and keep delivering essential services while disconnected.This is not abstract preparedness language. The agencies name the backdrop explicitly: state-sponsored actors pre-positioning inside critical infrastructure – Volt Typhoon sat undetected in victim networks for at least five years – and ransomware crews who have learned that manufacturers, hospitals, and utilities pay faster when production is down.The question the guidance forces every OT operator to answer is uncomfortable: if you had to isolate your plant network in the next ten minutes, could you? Would you know where to cut, who authorizes it, and what breaks when you do? For most organizations, the honest answer is no. That gap – between an isolation plan on paper and an isolation capability that has been engineered and tested – is exactly what CI Fortify is trying to close. What does CI Fortify actually require?Strip away the framework language and the guidance lays out a six-step path:Identify vital systems – the minimum OT and enabling systems required to keep delivering the critical serviceIdentify critical customers and upstream dependenciesSet criticality and trust levels across networks and hostsMap every connection to vital systems: corporate IT, vendor remote access, cloud platforms, internet-facing services, other operatorsBuild separation and isolation points in advance, with authorization and trigger criteria defined before the incidentCreate and test a graduated isolation plan – full-system exercises, not partial tests, because partial tests miss the shared dependencies (identity services, DNS, historians, licensing) that fail the moment you cut the boundaryThe guidance holds up physical isolation as the most effective protection – but concedes in the same breath that full physical disconnection is impractical for organizations that depend on carrier networks, cloud services, or geographically distributed facilities. That describes most modern manufacturing. For those environments, the agencies recommend hardening OT boundaries, removing unnecessary corporate dependencies, and maintaining the ability to progressively restrict access as threat conditions escalate.That escalation model has a name in the guidance: graduated isolation. First cut remote workers and vendors. Then corporate connectivity. Then connected systems, and eventually all external links – with trigger criteria for each step defined in advance, and complete isolation of the most vital systems as the target state. Why does graduated isolation fail on a flat network?Graduated isolation presupposes that the graduations exist. On a typical brownfield OT network, they don’t. On paper, most plants still describe themselves in Purdue model terms – neatly layered levels with controlled conduits between them. In practice, decades of IT/OT convergence have produced flat environments where the HMI, the historian, the engineering workstation, the vendor jump box, and hundreds of unmanaged devices share broadcast domains. The “isolation points” the guidance calls for would have to be improvised during the incident – emergency firewall rules, VLAN surgery, cable pulls – executed from tribal knowledge at 2 a.m. while the attacker is already moving.The guidance itself rates administrative controls like VLANs and access lists as “minimally effective” – interim measures on the road to real isolation, not something to rely on long-term. And the reasons are the ones every operator already knows: they are static, error-prone at scale, and were never designed to contain a threat that is actively pivoting. An isolation plan that depends on hand-editing access lists during an active intrusion is a plan for discovering your hidden dependencies the hard way.The engineering problem: how do you give an OT environment real, pre-built, instantly executable isolation points – without ripping out the network, without agents on devices that can’t take them, and without a segmentation project that stalls at the first change-control meeting? How does a ransomware kill switch make graduated isolation executable?This is where zero trust device segmentation changes the equation. Zscaler places enforcement at the local gateway: every device on the OT network is isolated into its own segment of one, and every east-west flow is evaluated against identity- and context-based policy – agentless, with no re-architecture of the plant network and no static ACL sprawl.On top of that enforcement fabric sits the Ransomware Kill Switch, and it maps almost one-to-one onto CI Fortify’s graduated isolation model. Rather than improvising containment mid-incident, operators pre-stage policy sets at escalating severity levels: at elevated posture, lock down known-abused lateral-movement protocols across the site; escalate further and cut vendor and third-party remote access; at the most severe posture, disable communication to entire network segments – a production line, a plant floor – in a single action, while permitted critical flows continue.Read against the guidance’s own vocabulary:Isolation points stop being physical locations someone must find and become documented policy constructs, executable in secondsGraduated isolation stops being a sequence of emergency change requests and becomes a severity dial with pre-defined, pre-tested consequences at each levelAuthorization and triggers become access controls and automation logic rather than a phone tree – the kill switch is API-addressable, so SIEM, SOAR, and EDR tooling can trigger containment the moment detection confidence crosses a thresholdTesting stops being an annual disruption and becomes routine: because isolation is policy, you can exercise it, observe what breaks, fix the dependency, and re-run – the iterative loop the guidance says partial testing never achievesOne boundary worth stating plainly: CI Fortify asks for two capabilities – isolating vital systems quickly, and operating in that isolated state for an extended period. A kill switch is a decisive answer to the first, compressing containment from hours of improvisation into seconds of execution – and those first hours usually decide whether an incident is an outage or a catastrophe. Sustained fully disconnected operation is an architecture and operations planning question that no single control resolves. Whether it is achievable is something every operator has to verify against their own environment – the identity services, historians, and licensing dependencies that only surface when you actually exercise the boundary – not against a reference architecture. Where should OT operators start?The sequence CI Fortify prescribes is the right one, and modern device segmentation accelerates each step: automatic discovery and classification to identify vital systems and expose the connection map you didn’t know you had; identity-based policy to define isolation points without re-architecting the network; severity-based kill switch policies to make graduated isolation executable; and routine, low-risk testing to find dependencies before an adversary does.The agencies have told operators, in plain language, to be ready to disconnect. The organizations that fare best won’t be the ones with the thickest isolation binder. They’ll be the ones for whom isolation is a button that has already been tested.Ready to see what pre-engineered isolation looks like in your environment? Request an OT architecture workshop to map your vital systems, connections, and isolation points against the CI Fortify model.
