CISA and ACSC released joint guidance titled 'CI Fortify – Advice for isolating vital systems' to assist critical infrastructure operators in isolating OT and supporting systems from other networks. The guidance outlines processes for identifying critical systems and their connections, segmenting and zoning networks based on criticality and trust, and implementing physical and logical isolation points to limit threat actor access and contain incidents. It emphasizes the need for graduated isolation plans that maintain business continuity and the importance of monitoring isolation effectiveness. The document also discusses risks such as lack of patching and reduced external visibility during isolation and recommends accounting for these risks in operational planning.

The guidance addresses the risk of cyber threats to critical infrastructure OT systems by recommending isolation strategies that reduce exposure to malicious actors and contain active incidents. By isolating vital OT systems, organizations can maintain critical service continuity during cyber disruptions. However, operating in isolation may introduce operational challenges, including manual process triggers, interrupted communications with upstream dependencies, and increased risks from removable media and delayed patching. These factors must be managed to avoid unintended service degradation or security gaps.

This is a guidance document rather than a vulnerability with a patch. Organizations should follow the detailed steps in the CISA and ACSC guidance to isolate vital OT and supporting systems, including identifying critical systems and connections, segmenting networks, establishing physical isolation points, and developing graduated isolation plans. They should also monitor isolation effectiveness and address operational risks such as patching delays and removable media infection risks. Since this is a proactive resilience measure, no direct patch or fix applies. Organizations should consult the original guidance at CISA and ACSC for comprehensive implementation details.