CI Fortify: Strengthening Resilience Across Critical Infrastructure

U.S. critical infrastructure (CI) operators face constant intrusion attempts from nation-state cyber threat actors. These adversaries aim for more than espionage. To win a wider geopolitical conflict: 

• They have successfully pre-positioned across critical infrastructure to disrupt and destroy the operational technology (OT) running the United States.
• They could leverage access to telecommunications infrastructure to take out phone and internet services. 

CI owners and operators must fortify their systems to allow vital services in the United States to sustain essential operations during a geopolitical conflict. Investing in isolation and recovery capabilities today is essential to maintaining service delivery during a future crisis, when an adversary may disrupt communications and manipulate control systems.

In a geopolitical crisis, the critical infrastructure organizations Americans rely on must be able to continue delivering—at a minimum—crucial services. They must be able to isolate vital systems from harm, continue operating in that isolated state, and quickly recover any systems that an adversary may successfully compromise." - Nick Andersen, CISA Acting Director 

What is CI Fortify?

“CI Fortify” is an allied initiative bolstering public health and safety, defense critical infrastructure, continuity of the economy, and national security by ensuring operators are prepared to sustain essential operations during a geopolitical conflict. For planning purposes, operators should assume that in a conflict scenario third-party connections–such as telecommunications, internet, vendors, service providers, and upstream dependencies–will be unreliable and that threat actors will have some access to the OT network.  Isolation and Recovery are emergency planning objectives that can mitigate this threat within the next few years. 

Isolation 

Isolation includes proactively disconnecting from third-party and business networks to prevent OT cyber impacts and sustain essential operations in a degraded communications environment. The goal is to ensure essential service delivery occurs during an emergency rather than completely shutting down. This involves:

• Identifying critical customers, such as military infrastructure and lifeline services, and setting a service delivery target based on their needs.
• Determining vital OT and supporting infrastructure to meet that target in isolation.
• Updating business continuity plans and engineering processes to allow for safe operations for weeks to months while isolated.
• Tracking CISA and Sector Risk Management Agency (SRMA) communications to know when to isolate. Subscribe to updates from CISA.

Recovery

Recovery includes documenting systems, backing up critical files, and practicing the replacement of systems or the transition to manual in case isolation fails and components are rendered inoperable. It also includes addressing communications dependencies for recovery, such as licensing servers or business network connections. 

Operators should share and discuss this page with their managed service providers, system integrators, and vendors to help understand their communications dependencies and potential workarounds. 

Parallel Benefits

Regardless of the source for any disruption, these emergency planning efforts will leave operators with more resilient infrastructure that is easier to defend and keep running. Emergency planning for communication outages:

• Serves operators in sustaining essential operations across all disruptions, not only cyber incidents, but also weather and safety events.
• Prevents further access and cuts off command and control to compromised systems.
• Reduces recovery time and incident response costs across all disruptions, natural disasters, routine component failure, and staff turnover, by maintaining system documentation that eliminates the need to recreate networks from scratch. 

Call to Action for Non-Operators

All cybersecurity professionals have a role to play in protecting critical infrastructure and the well-being of their local community. Together, we can fortify America’s infrastructure and ensure our nation’s resilience in the face of evolving threats.