CISA’s CI Fortify rewrites the disconnection playbook for critical infrastructure

Editor’s Note: CISA’s May 5 release of CI Fortify reframes critical infrastructure resilience around an assumption many operators are not ready to plan against: that during a geopolitical conflict, third-party vendors, telecom links, business networks, and cloud platforms will be unreliable, and adversaries will already be inside. The agency now wants water utilities, power operators, pipelines, and the rest of the nation’s 16 critical infrastructure sectors to be able to keep delivering essential services for weeks or months while disconnected from the digital scaffolding most security and legal-hold programs depend on.

Cybersecurity, data privacy, regulatory compliance, and eDiscovery professionals should read CI Fortify as the federal continuity-of-operations posture catches up to years of intelligence reporting on Volt Typhoon and Flax Typhoon. The implications for vendor risk diligence, preservation defensibility under FRCP Rule 37(e), and incident response retainer SLAs are immediate. Watch for CISA’s regional offices to operationalize the program through targeted assessments, for sector risk management agencies to translate doctrine into sector-specific playbooks, and for state-level activity— such as New York’s March 11 water rule—to fill funding and reporting gaps that Washington does not.

Industry News – Cybersecurity Beat

CISA’s CI Fortify rewrites the disconnection playbook for critical infrastructure

ComplexDiscovery Staff

The federal government is now urging U.S. water plants, electric utilities, pipelines, and other essential services to be ready to keep running for weeks or months without their vendors, telecom links, business networks, or cloud platforms. That is the planning baseline behind CI Fortify, a new initiative the Cybersecurity and Infrastructure Security Agency unveiled Tuesday that asks critical infrastructure operators to treat isolation from the rest of the digital economy as a survivable, exercised state — not a worst-case theoretical event.

Acting CISA Director Nick Andersen framed the guidance as a doctrine shift rather than a checklist. “CI Fortify is timely, actionable guidance that helps organizations protect their networks and critical services from cyber threat actors that aim to degrade or disrupt infrastructure,” Andersen said in CISA’s May 5 announcement. He added that operators in a geopolitical crisis must be able to isolate vital systems from harm, keep them running in that state, and quickly restore any systems an adversary may have compromised.

What CI Fortify asks of operators

The initiative calls on operators across the nation’s 16 critical infrastructure sectors to invest in two capabilities: isolation and recovery. Isolation means proactively cutting third-party, vendor, telecommunications, and business-network connections while sustaining essential services in a degraded communications environment. Recovery means thoroughly documenting systems, maintaining tested backups, and being able to revert to manual operation or replace compromised components when isolation alone is not sufficient. CISA wants both capabilities planned under the explicit assumption that, in a conflict scenario, third-party connections will be unreliable and that threat actors will already have some access to operational technology networks. CI Fortify is voluntary guidance and an assessment posture rather than a sector-wide binding rule; CISA cannot compel operators to participate, though sector risk management agencies, state regulators, and insurers may, over time, translate elements of the doctrine into enforceable expectations.

That second part — assumed adversary presence — is the assumption that has changed the conversation. For years, sector guidance treated nation-state pre-positioning as a possibility worth defending against. CI Fortify tells operators to plan as though the pre-positioning has already succeeded. The framing tracks years of intelligence community assessments warning that the People’s Republic of China-attributed Volt Typhoon has lodged itself inside non-military U.S. critical infrastructure, the better to disrupt civilian services in a Taiwan-related crisis. CISA’s posture on May 5 reflects that view publicly and operationally.

The agency has already begun targeted assessments under a pilot phase, working with operators in sectors that support defense, public health and safety, and economic continuity. Andersen declined to name the specific organizations participating, according to reporting from CyberScoop and Cybersecurity Dive. CISA’s 10 regional offices, along with their protective security and cybersecurity advisers, will carry much of the fieldwork as the program expands. The agency has also signaled that the assessments will look different sector by sector, according to Federal News Network’s coverage — water utilities have one set of priorities for restoring service after isolation, while energy and transportation operators face faster, more granular decisions about which loads or which cargo to keep moving. CI Fortify reflects a wider, internationally aligned approach rather than a strictly U.S. effort. Australia’s national cyber agency, the Australian Signals Directorate’s Australian Cyber Security Centre, published its own CI Fortify guidance on Oct. 13, 2025 — about seven months before CISA’s release — calling for Australian operators to be able to isolate vital operational technology systems from the internet, other networks, and third parties for up to three months while continuing to deliver essential services. CISA’s May 5 announcement positions the U.S. program as a parallel Five Eyes-aligned effort on operational technology resilience rather than a unilateral U.S. launch.

Industry split on doctrine and dollars

Industry response has split between agreement on the doctrine and skepticism on the economics. Richard Forno, associate director of the University of Maryland Baltimore County Cybersecurity Institute, told Cybersecurity Dive that building infrastructure that can operate cleanly without being connected to the rest of the world is so expensive that many operators will balk. “To do what they are proposing requires having a ton of resources on hot standby, which costs money,” Forno said. “Companies are, in many cases, not going to spend the money to ensure that they can unplug and seamlessly transition.” Operational-technology security vendors have been broadly supportive of the doctrine. “If organizations don’t have control within the environment, then isolation on its own is not enough,” said Duncan Greatwood, chief executive of Xage Security, framing a problem set Xage’s identity-and-access products are positioned to address. Executives at Xona Systems and Elisity offered similar framing on resilient remote access and segmentation, each highlighting the capabilities of their respective platforms.

What this means for legal hold and incident response

For information governance, eDiscovery, and cyber-incident response professionals, the practical implications start with one observation: under CI Fortify planning assumptions, the third-party services that modern enterprise security and legal-hold programs depend on become unreliable inputs by design. Cloud-hosted endpoint detection and response telemetry, managed detection and response retainer SLAs, cloud-based eDiscovery review platforms, and managed-backup providers all sit on the wrong side of the isolation boundary. As of May 2026, that creates a tension that legal and compliance teams should track carefully. If an electric utility is expected to keep running while disconnected from its vendors, what happens to a litigation hold that depends on a vendor-hosted preservation tool? What happens to a cyber-incident investigation that needs cloud forensic data the moment the operator severs connectivity? These are no longer hypothetical exercises. Under Federal Rule of Civil Procedure 37(e), a custodian’s preservation duty is measured against “reasonable steps” given the circumstances; CI Fortify gives counsel a new reason to document, in advance, what reasonable preservation looks like for a regulated operator that may sit disconnected from its vendor stack for extended periods.

The CI Fortify announcement also falls during a consequential month for the broader U.S. critical infrastructure resilience push. On April 23, 2026, CISA, the FBI, the U.S. Department of Defense Cyber Crime Center and nine allied cybersecurity agencies — including the United Kingdom’s National Cyber Security Centre, Australia’s Australian Cyber Security Centre and counterparts from Canada, Germany, Japan, New Zealand, Spain and Sweden — issued advisory AA26-113A, warning that Chinese state-linked actors have shifted toward large-scale covert networks of compromised small-office, home-office routers and Internet of Things devices to pre-position offensive capability. The advisory called out Volt Typhoon’s KV Botnet and Flax Typhoon’s Raptor Train, the latter of which infected over 200,000 devices worldwide before disruption efforts in 2024. Two months earlier, on March 11, 2026, New York Gov. Kathy Hochul adopted what state officials describe as the first comprehensive cybersecurity rules for drinking water and wastewater systems in the United States, paired with a $2.5 million grant program to help smaller utilities pay for cybersecurity upgrades. CI Fortify joins that federal-state stack as a continuity-of-operations capstone — the federal layer that says, regardless of who pays for the controls, here is how the lights are supposed to stay on.

For practitioners moving from doctrine to action, several near-term moves matter. Vendor risk diligence questionnaires should include explicit isolation-readiness questions: can this vendor support an operator that voluntarily severs connectivity for an extended period without loss of preservation, telemetry, or recovery capability? Incident response retainers should be re-read to ensure assumptions about cloud-only delivery are accurate. Records management and legal hold programs should map every preservation dependency to its third-party host and identify which ones would degrade or disappear under a CI Fortify-style isolation event. Tabletop exercises that already include ransomware scenarios should add a “weeks-to-months disconnect” variant — both because CISA is now telling operators to plan for it, and because the CISA assessments coming through the regional offices will probe exactly this readiness.

The harder question: who pays

The harder question is one CI Fortify does not answer directly: who pays? Federal grant authorities for critical infrastructure cybersecurity remain limited compared with the scale of investment required for isolation and recovery. State programs like New York’s SECURE grants are a start, but they are sized for individual utility upgrades rather than sector-wide redesigns. Operators will likely look to their sector risk management agencies and to Congress for a clearer funding signal in the months ahead.

So, how should cybersecurity, information governance, and eDiscovery professionals read CI Fortify in the week it dropped? As a public statement, the federal government’s continuity-of-operations posture for the most sensitive parts of the U.S. economy now assumes the digital scaffolding many of us take for granted will not be there when we need it most. The question for legal, compliance, and security leaders is no longer whether to plan for that scenario, but how quickly their preservation, response, and governance programs can be retooled to operate when connections to their vendors go dark.

What does isolation-readiness look like in your preservation and incident-response playbook today, and what would have to change tomorrow if your most-relied-upon cloud vendor became, for planning purposes, unavailable for weeks?

News sources

• CISA Unveils New Initiative to Fortify America’s Critical Infrastructure (CISA)
• CI Fortify (CISA)
• CISA wants critical infrastructure to operate ‘weeks to months’ in isolation during conflict (CyberScoop)
• CISA urges critical infrastructure firms to ‘fortify’ before it’s too late (Cybersecurity Dive)
• CISA pushes critical infrastructure operators to prepare to work in isolation (CSO Online)
• CISA unveils CI Fortify to help secure critical infrastructure during conflicts (Nextgov/FCW)
• CISA tells critical organizations to prepare for cyber outages (Federal News Network)
• CISA ‘CI Fortify’ Aims to Keep Services Running Under Attack (GovInfoSecurity)
• New guidance to help fortify Australia’s critical infrastructure (Australian Cyber Security Centre)

Assisted by GAI and LLM technologies

Additional reading

• A 48-month federal benchmark resets the incident-response insider question
• Data collection in occupied territory: A closer read of Cyber Law Toolkit scenario 35
• Cyber Law Toolkit tests surveillance and data collection under occupation
• The router on the shelf is now a national security problem
• Invisible by design: NATO’s 2026 cognitive warfare paper and the crisis of discovery
• When Your Legal Tech Vendor Gets Breached: DocketWise Incident Exposes 116,666 Immigration Records and a Profession’s Blind Spot
• The DOJ’s Cyber FCA Playbook Is Working as Enforcement Triples and Shows No Signs of Slowing
• FTC’s OkCupid Action Reframes AI Training Data as a Consumer Protection Issue
• White House AI Framework Signals New Compliance Stakes for Legal, Cybersecurity, and eDiscovery
• The Gatekeeper’s Key: How the Conformity Assessment Unlocks the EU AI Market

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.