"periods of cyber duress," CISA officials warned, describing the goal of a new effort to keep essential services running even as networks are degraded or core systems are compromised.
CISA launches "CI Fortify" to push resilience
The Cybersecurity and Infrastructure Security Agency unveiled "CI Fortify" on Tuesday — an initiative that pairs new guidance with operational support for critical infrastructure owners and operators. CISA Acting Director Nick Andersen framed the program as a call-to-action for infrastructure providers to invest in resilience measures before incidents expose operational gaps. The stated aim is to ensure continued delivery of essential services during what the agency calls "periods of cyber duress."
Isolation: severing dependencies and hostile pathways
CI Fortify emphasizes isolation as a core capability. The guidance urges operators to prepare to disconnect operational technology networks from business networks and to cut ties with third-party dependencies at a moment’s notice — specifically naming cloud providers, vendors and telecommunications services. CISA officials also note that isolation is intended to sever adversarial command-and-control pathways that attackers use to control compromised systems.
Recovery: backups, offline options and manual operations
The second pillar of the framework is recovery. CISA stresses restoring critical systems while isolated, using pre-tested backup processes, offline capabilities and, when necessary, manual operations. The agency emphasizes regular testing and exercises to validate those recovery capabilities before a crisis occurs so that fallback procedures are reliable under stress.
Regional staffing, pilots, and interagency coordination
CISA said it has already begun pilot assessments with infrastructure operators and will offer additional assessments; the agency added that scope and approach will vary depending on sector-specific risks and operational requirements. Andersen would not say which specific organizations will be initial partners. To support the program, CISA plans to hire more than 300 positions, with a focus on strengthening regional field operations and technical expertise tied to industrial control systems and operational technology. Regional personnel are expected to play a central role across the 10 regions recognized by the Federal Emergency Management Agency. The rollout is also expected to involve coordination with other federal agencies and sector partners, particularly to assist smaller operators that may lack the resources to implement isolation and recovery capabilities on their own.
What this means for technologists, smaller operators, and federal partners
- Technologists and security teams: The initiative places operational-technology defenders on notice to design isolation-capable architectures and to rehearse recovery paths — pre-tested backups, offline fail-safes and manual procedures — rather than relying solely on live networks or third-party services.
- Smaller operators and sector partners: CISA anticipates offering assessments and partnering to fill capability gaps, but the agency acknowledges that some operators will need interagency or sector assistance to stand up isolation and recovery functions they cannot resource themselves.
- Federal and regional personnel: The planned hiring of more than 300 staff and the deployment of regional teams tied to FEMA’s 10 regions signal that CISA expects hands-on, geographically dispersed support to implement CI Fortify, contingent on the agency’s ability to fill those roles and sustain outreach.
The initiative is being rolled out at a time when CISA itself is navigating leadership instability and resource constraints. CISA officials acknowledged that multiple prolonged funding lapses this year forced the agency into a reactive posture, limiting proactive services such as vulnerability scanning and stakeholder engagement — pressures that the CI Fortify effort must be lived up to in practice, not just on paper. The agency has framed CI Fortify as a direct response to warnings that nation-state actors are prepositioned inside critical systems and are seeking access with the intent of disrupting services such as water, electricity and communications.
CI Fortify lays out clear operational goals — isolation and recovery — but its impact will depend on which operators join the pilot assessments, whether CISA can hire and deploy the planned regional teams, and how quickly smaller operators can be brought to a baseline where they can disconnect, restore and operate under duress. CISA and its partners have set a destination; the unanswered specifics, including initial partner names and staffing timelines, will determine whether the program changes outcomes when systems are tested.
https://www.govinfosecurity.com/cisa-ci-fortify-aims-to-keep-services-running-under-attack-a-31602
