CI Fortify Guidance: Isolating Vital OT Systems

CI Fortify is joint cybersecurity guidance, led by the Australian Signals Directorate (ASD) and co-published by CISA, NCSC-UK and the Canadian Centre for Cyber Security, that shows critical infrastructure operators how to isolate vital operational technology (OT) and enabling systems from all other networks, keep critical services running while disconnected, and rebuild those systems from trusted sources.

Key Takeaways

• Five Eyes backing: The July 28, 2026 joint advice, CI Fortify: Advice for Isolating Vital Systems, was led by ASD and co-published by CISA, NCSC-UK and CCCS, with FBI support and a feedback contact at New Zealand's NCSC.
• Two core capabilities: CI Fortify asks operators to isolate vital OT and enabling systems for up to 3 months while sustaining critical services, and to rapidly rebuild those systems from known-good sources.
• Six-step critical path: The joint advice sequences the work from identifying vital systems to building and testing a graduated isolation plan whose end state is total isolation.
• Logical separation is interim only: The guidance treats VLANs, MPLS, IP access lists and software-defined networking as interim measures, not a long-term substitute for physical or cryptographic isolation.
• OPSWAT supports both capabilities: The MetaDefender Platform supports isolation readiness through segmentation, unidirectional transfer and removable media control, and supports trusted rebuild by scanning and sanitizing backup and recovery assets.

In July 2026, ASD led the release of CI Fortify: Advice for Isolating Vital Systems, joint guidance that shows critical infrastructure operators how to separate vital OT from every other network and keep essential services running while disconnected. The advice builds on the CI Fortify guidance ASD first published in October 2025, and it now carries the weight of the wider Five Eyes community.

CISA (Cybersecurity and Infrastructure Security Agency), the UK's NCSC (National Cyber Security Centre) and the CCCS (Canadian Centre for Cyber Security) co-published the advice, with support from the FBI (Federal Bureau of Investigation). The document also lists a feedback contact for New Zealand's NCSC, giving operators in all five Five Eyes countries a route to engage.

The message is consistent across agencies: connectivity can no longer be assumed trustworthy during a major cyber incident. According to the CI Fortify joint advice (2026), state-sponsored cyber actors routinely target critical infrastructure to conduct espionage or to pre-position for disruptive and destructive effects in a crisis or conflict, while cybercriminals continue to target operators for extortion and ransomware.

Operators need to be able to disconnect, keep the critical service running and rebuild with confidence. This article breaks down what the joint advice asks for and how OPSWAT's MetaDefender Platform supports its two core capabilities: isolation readiness and trusted rebuild.

What is CI Fortify?

CI Fortify is a critical infrastructure resilience program built around two capabilities: isolating vital OT and enabling systems from all other networks, and rapidly rebuilding them when trust in the environment is lost. ASD introduced it for Australian operators in October 2025, and the July 2026 joint advice made it shared Five Eyes guidance.

According to ASD's CI Fortify guidance (2025), operators should be able to isolate vital OT and enabling systems from the internet, other networks and systems for 3 months while maintaining critical services. The same guidance asks operators to be able to rebuild those systems completely, using offline, known-good and tested backups of firmware, configuration and processes.

Each partner agency entered CI Fortify through its own program. Canada's Cyber Centre launched CIREN in April 2026, CISA launched its CI Fortify initiative in May 2026, and NCSC-UK published its guide to preparing for severe cyber threat for CNI (Critical National Infrastructure) operators. The July 2026 advice is the shared, practical isolation guide that sits beneath all of them.

Where CI Fortify Stands Across the Five Eyes

What are the Six Steps of the CI Fortify Critical Path to Isolation?

The joint advice sets out a six-step critical path to isolation. Each step produces the evidence the next one depends on, from a defined set of vital systems to a tested, graduated isolation plan.

1. Identify vital systems and networks. Define the minimum set of systems and networks required to deliver the critical service.
2. Identify critical customers. Set a service delivery target based on what dependent services need, such as megawatts of power or gallons of water per day.
3. Identify common levels of criticality and trust. Group hosts into segments and zones with similar criticality and threat exposure.
4. Map connections and potential isolation points. Record every link to corporate systems, vendor remote access, the internet, cloud environments and peer networks, with owners and recovery targets.
5. Build effective separation and isolation points. Remove shared infrastructure and dependencies so vital systems can operate alone.
6. Create and test an isolation plan. Use a graduated plan with trigger criteria defined in advance, and test isolation of all vital systems, not just one.

The guidance illustrates step 6 with a fictitious electrical transmission company. Its graduated plan first disables remote worker access to OT, then on-premises remote access, then all connections between non-OT and OT environments, then lower-priority peer OT connections, and finally isolates the OT environment and vital systems completely.

What Does CI Fortify Ask OT Operators to Do?

CI Fortify asks operators to design physical separation and the ability to isolate into vital systems, remove the shared dependencies that would break isolation, and keep verifying that the boundary holds. Where full isolation is not achievable, the guidance asks operators to harden the OT boundary and build the ability to rebuild rapidly.

• Separation is not isolation. Physical separation means no shared active infrastructure between OT and non-OT networks. Isolation is the ability to disconnect and keep operating. Both must be designed in.
• Complete isolation stays the target. A graduated plan can remove access step by step, from remote workers to peer connections, but it must end in total isolation of the most vital systems. Keep an offline, hard-copy version of the plan.
• Dependencies break isolation. Shared hypervisors, storage, backup, Active Directory, DNS, DHCP, certificate services and NTP (Network Time Protocol) or PTP (Precision Time Protocol) sources can all fail when the link to corporate networks is cut.
• Treat carrier networks as untrusted. Where sites rely on carrier links, encrypt with a dedicated device rather than encryption built into OT equipment, such as MACsec for Layer 2 and IPsec for Layer 3.
• VLANs and MPLS are interim measures. VLANs, MPLS, access lists and software-defined networking provide logical separation only. They should not be the long-term answer.
• Verify isolation continuously. Inspect routing tables, run reachability tests and alert if the boundary is crossed.
• Plan for the risks of isolation. Systems fall out of patch, external visibility drops and removable media becomes a malware path across the air gap.
• Where full isolation is not possible, build the ability to rebuild vital systems rapidly, harden the OT boundary, and consider data diodes or cross domain solutions for controlled data flows.

How CI Fortify Ranks Separation Controls

The joint advice does not treat every separation control as equal. The table below summarizes where each control sits in the guidance and what it means in practice.

Designed for Isolation: A Mindset That Predates Modern OT Security

Long before industrial cybersecurity became a discipline, many operational environments were built to survive lost connectivity. Early telecommunications networks assumed limited external dependency, and recovery relied on known-good offline backups and controlled rebuilds. CI Fortify asks critical infrastructure to recover that mindset.

The operational test is simple. If connectivity to external networks had to be severed immediately, could the critical service still run safely at a minimum operating state? If trust in the environment were lost, could vital systems be rebuilt quickly, without improvisation?

Why OT Isolation Readiness Matters Beyond Security Teams

OT isolation readiness is an operational capability, not only a security control, because isolating OT interrupts business processes that have grown around connectivity. Isolation touches the whole organization:

• Operational continuity
• Vendor access and remote maintenance models
• Cross-domain automation and integrations
• Incident response processes
• Governance and regulatory reporting

Resilience planning needs clear operational ownership, documented manual processes and defined decision authority. For CISOs (Chief Information Security Officers), engineering leaders and operators, readiness means being able to answer four questions:

• Which systems stay operational under isolation
• Which services degrade or fail
• Which tasks must be performed manually
• How quickly trust can be restored through rebuilds

A Practical Starting Point: The One-Page Resilience Control Map

A one-page resilience control map turns CI Fortify from guidance into an operating artifact. The goal is a single page and gaps list that supports planning, investment decisions and audit conversations.

1. Define the minimum operating state. For each critical service, set the minimum acceptable state that preserves safety and essential function, including the service delivery target for critical customers.
2. Identify vital OT and enabling systems. Not every system is vital. Assign a clear owner to each one that is.
3. Map isolation points and dependencies. Find where isolation can be enacted and which dependencies fail when it is. For example, losing an NTP source can cause millisecond-level clock drift that destabilizes high-availability clusters and triggers failovers.
4. Establish thresholds and authority. Define the triggers for partial and full isolation, link them to the incident response plan, and name who has authority to act.
5. Plan for manual operations. Map each manual task to an owner. Contact vendors in advance about workarounds, since vendor support will be in demand during a crisis.
6. Define minimum outbound telemetry. Decide what must still leave the isolated zone, such as safety monitoring, security alerts, logs and historian replication.
7. Validate rebuild readiness. Keep offline, tested, known-good backups of firmware, configurations and processes, verified free of the malware that caused the outage.
8. Document it on one page. Include critical services and minimum operating state, vital systems and owners, isolation points and dependencies, thresholds and authority, the manual operations plan, minimum outbound data and rebuild readiness gaps.

CI Fortify and the MetaDefender Platform

The MetaDefender Platform is OPSWAT's AI-powered cybersecurity platform for critical infrastructure protection, and it supports both CI Fortify capabilities: isolation readiness and trusted rebuild. Under isolation, the test is whether the business can sustain critical services safely. Under low trust, the test is whether it can rebuild vital systems at pace.

Over two decades, digital transformation has made industries more efficient and more connected. CI Fortify is a reminder that resilience also requires the ability to operate with less connectivity.

Enforce Segmentation and Sustain Isolation

MetaDefender Industrial Firewall is OPSWAT's industrial firewall designed to secure industrial networks through protocol-aware inspection, zone-based segmentation and real-time threat prevention. Built for ICS (industrial control systems), OT and SCADA (Supervisory Control and Data Acquisition) environments, it operates across Purdue Model Layers 2 through 3.5, closest to the physical process.

Firewall Learning Mode monitors normal traffic and generates policies that reflect legitimate operations, so isolation boundaries can be defined and enforced without disrupting production. Protocol-specific deep packet inspection covers Modbus, EtherNet/IP, S7Comm, DNP3, OPC-UA, BACnet, PROFINET and more, so only authorized, essential communications persist when isolation is enacted.

Ruggedized hardware suits harsh industrial environments, and native integration with MetaDefender OT Security adds intrusion detection and prevention with continuous asset visibility, even when external connectivity is cut. Support for IPsec and OpenVPN in recent releases enables encrypted communication across segmented or isolated networks when controlled vendor access or multi-site coordination is needed during recovery.

Control Data Flows Across Trust Boundaries

The joint advice names data diodes and cross domain solutions as the high-assurance way to keep some data moving during extended isolation. MetaDefender NetWall is OPSWAT's data diode and security gateway family, designed to enable secure data transfer between networks of different security classifications while defending critical environments from network-borne threats.

MetaDefender NetWall optical diode technology provides hardware-enforced unidirectional transfer, so no routable path exists back into the protected zone while safety-critical telemetry, patches and operational data flow in one direction. NetWall supports OT protocols such as Modbus, OPC, DNP3 and IEC 104, along with NTP forwarding, which helps preserve time synchronization when the corporate time source is cut off.

MetaDefender Diode X™ is OPSWAT's secure unidirectional file transfer solution, combining one-way transfer with Metascan™ Multiscanning and Deep CDR™ Technology for files that must cross a trust boundary. MetaDefender Managed File Transfer supports secure exchange between internal teams, contractors and segmented zones, and every file passes through Deep CDR™ Technology, Metascan Multiscanning and Proactive DLP™ Technology before entering a protected environment.

The guidance also stresses that diodes and cross domain solutions deliver high assurance only when designed, configured and maintained correctly, and recommends seeking expert advice before deployment.

Close the Removable Media Gap

The joint advice warns that isolated sites rely on removable media to cross the air gap, and that the machines used to check that media may stop receiving updates. MetaDefender Kiosk™ is OPSWAT's removable media security solution for preventing peripheral media threats from entering critical environments, scanning and sanitizing files before they reach a protected network.

Rebuild from Trusted Sources

Before any backup, firmware image, configuration file or software update is used to restore a compromised environment, it must be free of the malware that caused the incident. MetaDefender Storage Security scans stored files with multiple anti-malware engines at once using Metascan Multiscanning, neutralizes hidden threats in more than 200 file types with Deep CDR™ Technology, and performs file-based vulnerability assessments across on-premises, hybrid and cloud storage.

MetaDefender Storage Security integrates with SMB and NFS compatible NAS, NetApp, Dell EMC, Amazon S3 and Microsoft Azure. Periodic and real-time scanning keep backup integrity validated over time, not only at the point of storage.

How the MetaDefender Platform Maps to CI Fortify

Together, these solutions give operators a layered foundation for CI Fortify alignment: enforced segmentation, controlled data flows, protection from file-borne and network-borne threats, and recovery workflows built on verified assets.

When to Use the MetaDefender Platform for CI Fortify Alignment

• You are building a graduated isolation plan: MetaDefender Industrial Firewall defines and enforces isolation points without disrupting production traffic.
• Some data must keep moving during isolation: MetaDefender NetWall or MetaDefender Diode X fits when telemetry, historian data or files must cross the boundary in one direction only.
• Isolated sites depend on removable media: MetaDefender Kiosk scans and sanitizes media before it reaches a protected network.
• You need to prove rebuild readiness: MetaDefender Storage Security validates that backups, firmware images and configurations are free of malware before restoration.

Build Isolation Readiness Now

With the July 2026 joint advice, isolation readiness has moved from a regional recommendation to a shared Five Eyes expectation. Every step toward separation and isolation reduces attack surface, and the end state is clear: critical services that keep running when everything around them is disconnected.

Together, these solutions provide a layered, practical foundation for CI Fortify alignment: enforcing segmentation, controlling data flows across trust boundaries, protecting critical systems from file-borne and network-borne threats, and ensuring that backup and recovery workflows are built on verified, trustworthy assets.

For critical infrastructure operators navigating evolving cyber threats and resilience requirements, building an isolation-ready OT architecture is no longer optional—it is foundational.

Learn how OPSWAT solutions can help strengthen OT resilience and support CI Fortify principles—connect with an expert today.

Frequently Asked Questions About CI Fortify

What is CI Fortify?

CI Fortify is critical infrastructure resilience guidance that asks operators to isolate vital OT and enabling systems from all other networks and rapidly rebuild them from trusted sources. ASD introduced it in October 2025, and the July 2026 joint advice extended it across the Five Eyes.

Who published the CI Fortify isolation guidance?

ASD led CI Fortify: Advice for Isolating Vital Systems, released on July 28, 2026. CISA, NCSC-UK and the Canadian Centre for Cyber Security co-published it with support from the FBI, and New Zealand's NCSC is listed as a feedback contact.

Is CI Fortify mandatory?

No. The joint advice states that its "must" statements represent cyber security best practices and that operators should consult their jurisdiction's relevant regulatory and legally binding obligations. It is a practical planning benchmark rather than a regulation.

How long should vital OT systems be able to operate in isolation?

ASD's CI Fortify guidance sets a target of isolating vital OT and enabling systems for 3 months while maintaining critical services. Canada's CIREN initiative uses the same horizon, asking operators of essential services to be prepared to isolate systems for up to 3 months.

What is the difference between separation and isolation in CI Fortify?

Physical separation means OT networks share no active infrastructure, such as switches, routers or compute, with non-OT networks. Isolation is the ability to disconnect those systems and keep operating independently. Separation is a prerequisite for physical isolation.

Are VLANs enough to meet CI Fortify?

No. The joint advice describes VLANs, MPLS, IP access lists and software-defined networking as administrative or logical controls that provide minimally effective segregation. Operators can use them as interim measures but should not rely on them as a long-term solution.

Where do data diodes fit in CI Fortify?

Data diodes and cross domain solutions let some data flows continue between critical and non-critical networks during extended isolation, with higher assurance than standard gateways. The guidance recommends them where full isolation is not achievable and advises seeking expert support, since an incorrectly deployed diode can drop protocol handshakes.