Cybersecurity Policy Report, CISA Wants Critical Infrastructure to Operate When Communications Go Dark, (May 5, 2026)
Critical infrastructure operators are being asked to take steps that would enable them to continue delivering services during a cyber attack that cuts them off from communications networks.
The Cybersecurity and Infrastructure Security Agency today unveiled “CI Fortify,” an initiative that encourages critical infrastructure to develop “isolation and recovery capabilities.” The program aims to “help critical infrastructure (CI) entities across all sectors prepare to operate through a crisis or conflict, continuing vital service delivery even as their systems are under attack,” CISA said in a news release.
CI operators are being asked to invest in the ability to proactively disconnect “from third-party dependencies” and operate “without reliable telecommunications and internet,” CISA said. They should also prepare to rapidly restore “vital compromised systems while isolated.”
During isolation, CI operators should prioritize service delivery to other critical infrastructure and possibly engage in manual operations rather than rely on operational technology (OT), CISA advised.
“For planning purposes, operators should assume that in a conflict scenario third-party connections—such as telecommunications, internet, vendors, service providers, and upstream dependencies—will be unreliable and that threat actors will have some access to the OT network,” according to CISA’s guidance.
“The launch of this initiative comes at a pivotal time,” Nick Andersen, CISA’s acting director, told reporters today during a news conference.
“U.S. infrastructure is under constant threat from malicious nation-state supported cyber actors. These adversaries want persistent access to our vital systems and aim to disrupt essential services like safe drinking water, reliable electricity, and readily available communications,” Mr. Andersen warned.
“Threat actors have prepositioned themselves within critical infrastructure networks aiming to cause destructive effects to our nation's operational technology, telecommunications, and essential services during times of conflict,” he noted.
“When a cyber attack occurs, well-planned emergency capabilities help ensure the affected organization can still deliver critical services. Isolation involves proactively disconnecting from third-party dependencies and operating without reliable telecommunications and Internet. Recovery involves rapidly restoring vital, compromised systems while isolated,” he explained.
“A key part is testing recovery plans and practicing local and manual operations. The CI Fortify initiative’s objectives will result in a stronger, more resilient American infrastructure, capable of defending against a broad spectrum of threats and maintaining critical operations during emergencies,” Mr. Andersen said.
CISA intends to offer additional, more granular guidance on ways to isolate and recover while under “cyber duress,” he said, and it already has begun outreach to CI operators and assessments of their cyber defenses under a pilot program.
Mr. Andersen expressed confidence about CISA’s capacity to undertake the initiative following personnel cuts at the agency and a 77-day shutdown of the Department of Homeland Security that ended last week (CPR, May 1).
“Our current staffing plan allows for the increase of an additional 329 positions that our DHS leadership, including Secretary [Markwayne] Mullin, have provided support for moving forward as an initial tranche of additional hiring,” he reported.
“That’s really an indication of his continued support for this significant part of the DHS mission that CISA provides,” he added. “Especially in an area like this where it’s affecting critical infrastructure that not only touches on important elements like public health and safety, national security, defense critical infrastructure, and continuity of our economy, but it’s also just the infrastructure that Americans rely on every day just to live their lives and go to work and take care of their families.”
MainStory: TopStory FederalLegislation DataSecurity