AnalysisPublished 29 Jul 2026

US, Australia Release OT Isolation Guidance for Critical Infrastructure

Source SecurityWeek

Description

The US Cybersecurity and Infrastructure Security Agency (CISA) and Australia's Cyber Security Centre (ACSC) have jointly published guidance to help critical infrastructure organizations isolate operational technology (OT) and supporting systems. The guidance aims to enhance cyber resilience by enabling these systems to operate in isolation for extended periods, ensuring continuity of critical services during disruptions or crises. It details steps for identifying vital systems, segmenting networks, establishing physical and logical isolation points, and creating graduated isolation plans. The guidance also highlights operational and security risks introduced by isolation, such as reduced patching and increased removable media risks, advising organizations to manage these carefully.

Impact

The guidance addresses the risk of cyber threats to critical infrastructure OT systems by recommending isolation strategies that reduce exposure to malicious actors and contain active incidents. By isolating vital OT systems, organizations can maintain critical service continuity during cyber disruptions. However, operating in isolation may introduce operational challenges, including manual process triggers, interrupted communications with upstream dependencies, and increased risks from removable media and delayed patching. These factors must be managed to avoid unintended service degradation or security gaps.

Defensive guidance

This is a guidance document rather than a vulnerability with a patch. Organizations should follow the detailed steps in the CISA and ACSC guidance to isolate vital OT and supporting systems, including identifying critical systems and connections, segmenting networks, establishing physical isolation points, and developing graduated isolation plans. They should also monitor isolation effectiveness and address operational risks such as patching delays and removable media infection risks. Since this is a proactive resilience measure, no direct patch or fix applies. Organizations should consult the original guidance at CISA and ACSC for comprehensive implementation details.

Summary

CISA and ACSC released joint guidance titled 'CI Fortify – Advice for isolating vital systems' to assist critical infrastructure operators in isolating OT and supporting systems from other networks. The guidance outlines processes for identifying critical systems and their connections, segmenting and zoning networks based on criticality and trust, and implementing physical and logical isolation points to limit threat actor access and contain incidents. It emphasizes the need for graduated isolation plans that maintain business continuity and the importance of monitoring isolation effectiveness. The document also discusses risks such as lack of patching and reduced external visibility during isolation and recommends accounting for these risks in operational planning.

References

securityweek.com/us-australia-release-ot-isolation-guidance-for-critical-infrastructure/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 29 Jul 2026, 11:07 UTC

References

Community reviews