CISA Launches ‘CI Fortify’ to Bolster Critical Infrastructure Against Nation-State Cyber Threats
CISA has introduced the 'CI Fortify' initiative to help critical infrastructure operators maintain essential services during cyberattacks, warning that nation-state actors have already embedded themselves within U.S. operational technology networks.
The Cybersecurity and Infrastructure Security Agency (CISA) has launched a new initiative titled "CI Fortify," aimed at preparing operators of U.S. critical infrastructure for potential cyber conflict with nation-state adversaries. The agency warns that hostile actors have already established persistent footholds within telecommunications and operational technology (OT) networks, positioning themselves to disrupt essential services if geopolitical tensions escalate SecurityWeek.
The CI Fortify program operates on the premise that in a conflict scenario, traditional support structures—including internet connectivity, third-party vendors, and external service providers—may become unreliable or unavailable. CISA emphasizes that adversaries are not merely conducting espionage but are actively preparing to cripple the OT systems that underpin national defense, public health, and economic stability SecurityWeek.
At the core of the new guidance are two primary operational capabilities: isolation and recovery. Isolation requires organizations to develop the ability to deliberately sever connections between their OT environments and broader business networks or the public internet. By doing so, operators can prevent the lateral movement of an attack and maintain a "degraded state" of operations that allows for the delivery of essential services for weeks or months without external support SecurityWeek.
Recovery, the second pillar of the initiative, focuses on resilience when isolation is insufficient. CISA advises operators to maintain comprehensive documentation of their system architectures, ensure the integrity of up-to-date backups, and conduct regular drills for restoring compromised components. In extreme scenarios, this includes the ability to transition to manual, non-digital operations to bypass compromised automated systems SecurityWeek.
Industry experts have largely welcomed the shift in focus, noting that traditional perimeter defenses are often insufficient against sophisticated actors who exploit trusted connections and compromised credentials. Duncan Greatwood, CEO of Xage Security, noted that while isolation is a critical component of continuity, it must be paired with granular internal control to be effective. He emphasized that threats often move through existing, trusted pathways long before a formal crisis response is triggered SecurityWeek.
This initiative arrives as CISA continues to highlight the increasing risks to OT environments, including recent warnings regarding vulnerabilities in serial-to-IP converters, EnOcean SmartServer flaws, and the exposure of hundreds of internet-facing VNC servers SecurityWeek. By formalizing the CI Fortify program, CISA is urging operators to move beyond standard security hygiene and toward a posture of "survivability," ensuring that critical systems remain functional even when under active, sustained cyber assault.