CISA Released CI Fortify on May 5. The Initiative Pushes Water Utilities, Transportation, Energy, and Other Critical Infrastructure Operators to Plan for Geopolitical Crisis Cyber Attacks That Could Sever Connections to Internet, Telecommunications, and Vendor Service Providers for Weeks to Months. Acting CISA Director Nick Andersen Confirmed Pilot Assessments Are Already Underway. The Two Planning Objectives Are Isolation and Recovery. Water Districts in California Reading This Have a Quarter of Work to Do.

WHAT CISA ACTUALLY PUBLISHED

CI Fortify is a guidance document and operational initiative released by CISA on May 5, 2026. The framing is explicit and uncompromising. U.S. critical infrastructure operators face constant intrusion attempts from nation-state cyber threat actors. These adversaries are pre-positioning across critical infrastructure to disrupt and destroy operational technology in a wider geopolitical conflict. Telecommunications infrastructure access could be leveraged to take out phone and internet services. The expected scenario is not theft of data but degradation of service delivery during a national security event.

The initiative is modeled on a CI Fortify program Australia, a Five Eyes partner, launched in 2025. The shared framing across both programs reflects a coordinated intelligence community assessment that China's pre-positioning activity, often referenced as Volt Typhoon in prior public disclosures, has reached a level where the operational response is to prepare for the disruption rather than to prevent the access.

CISA's guidance has two emergency planning objectives. The first is isolation. Operators should proactively disconnect from third-party and business networks to prevent OT cyber impacts and sustain essential operations in a degraded communications environment. The goal is not to shut down. The goal is to identify the minimum essential service delivery target, identify the OT and supporting infrastructure required to meet that target while isolated, and maintain business continuity plans and engineering processes that allow safe operations for weeks to months while disconnected from third-party support.

The second objective is recovery. Operators should document how their systems operate, maintain backups of critical files, and practice the replacement of compromised systems or the transition to manual operations in case isolation alone is insufficient. The framing assumes that some systems will be compromised, that recovery will need to occur while still operating in isolation, and that the practice of manual operations is a discipline that requires regular exercise rather than a theoretical fallback.

Acting CISA Director Nick Andersen confirmed during a press briefing that the agency has already kicked off the first targeted assessments under a pilot phase. The pilot prioritizes defense critical infrastructure: dams, radars, weapon systems, satellite communications, and facilities directly supporting military operations. The pilot will expand to other critical infrastructure sectors as CISA's regional offices hire additional staff. CISA's ten regional offices, with protective security advisors focused on physical and traditional security and cybersecurity advisors focused on cybersecurity, will be the primary delivery mechanism for the CI Fortify assessment program.

WHAT ISOLATION ACTUALLY MEANS FOR A WATER UTILITY

The CISA guidance is sector-agnostic by design. Water utilities, transportation, energy, healthcare, and other critical infrastructure operators each have to translate isolation and recovery into their specific operational reality. The translation is where the work actually lives. For a mid-size Southern California water district serving fifty thousand to two hundred thousand customers, isolation has several specific operational implications that the guidance document does not spell out.

Isolation means the SCADA system cannot reach the vendor's cloud-based monitoring platform. Most modern SCADA deployments at mid-size water utilities have moved to vendor-managed cloud monitoring over the past five years because the operational economics favor it. Vendors provide remote operator dashboards, predictive maintenance analytics, and centralized log aggregation through internet-connected platforms. During a CI Fortify isolation scenario, every one of those connections has to be severable on demand. The utility has to have the local engineering capability to operate SCADA, perform maintenance, and review operational status without the vendor cloud layer. Most utilities have not exercised this capability in recent memory.

Isolation means the chemical dosing controls cannot phone home to the vendor's licensing server. Some industrial control systems require periodic connectivity to vendor licensing infrastructure to remain operational. During an extended isolation period, those licensing checks fail. The control system enters degraded mode, refuses to operate, or relies on grace periods that may be measured in days rather than the weeks to months CISA's guidance contemplates. Identifying which systems have phone-home licensing dependencies is the first practical translation work. The remediation work is to negotiate license terms that survive isolation, deploy local license servers, or replace systems that cannot tolerate the disconnection requirement.

Isolation means the customer billing system, which usually runs on commercial cloud SaaS like ServiceNow, Oracle, or sector-specific products, becomes unreachable. The utility can continue treating and delivering water. It cannot bill, cannot answer customer service calls through its normal channels, cannot process payments, and cannot update customer records. The service delivery mission continues. The business operations mission stops. CISA's guidance explicitly says the goal of isolation is essential service delivery, not full operations. The practical work for a water district is to identify which business operations are deferred and for how long, and to communicate that posture to the board and the customer base in advance rather than during a crisis.

Isolation means the district's email system, which is almost certainly Microsoft 365 or Google Workspace, is unreachable. Internal coordination shifts to whatever in-environment alternative the utility has built. Most have not built one. The recommended posture is to maintain an internal email server, an internal chat system, or at minimum a documented out-of-band communication tree using cell phones, radios, or other comms that do not depend on the same telecommunications infrastructure CI Fortify says will be unreliable.

Isolation means the district's IT support contracts with managed service providers, vendor remote support agreements, and emergency response retainers are all unreachable. The utility has to have local engineering staff capable of restoring systems, diagnosing failures, and making operational decisions without remote support. For mid-size districts that have moved to lean IT staffing over the past decade, often relying heavily on MSP relationships, this is the gap that requires the most significant operational change. The decision is whether to maintain higher in-house engineering capability than the operational economics favor, or to accept that isolation periods produce degraded technical response that the district has to plan for.

WHAT RECOVERY ACTUALLY REQUIRES

Recovery in CI Fortify framing is not the same as recovery in standard backup and disaster recovery practice. The standard backup discipline focuses on data restoration after a system failure. CI Fortify recovery assumes systems may need to be rebuilt or replaced while the utility is still isolated, while threat actors may still have access to the network, and while normal vendor support is unreachable.

The practical work is documentation. Every operational system in the utility's environment needs a documented operating procedure that allows a local engineer with general competence to bring the system back online without referencing external sources. SCADA configurations, control logic, network topology, chemical treatment parameters, billing system schemas, and pump control sequences all need to be documented in a form that survives the loss of the vendor's documentation portal. Many utilities discover during their first practical exercise that the documentation they rely on is hosted in vendor portals reachable only over the internet that CI Fortify assumes will be unavailable.

The practical work is backups. Local, air-gapped, recently tested backups of every operational system. The threat model is that adversaries may have access to the OT network and may have been pre-positioned for an extended period. Backups stored on systems the adversary can reach are not backups. Backups that have not been tested for restoration in the past quarter are not backups. The discipline is to maintain physically isolated backup media on a documented rotation, restore tests on a documented schedule, and full-system bring-up exercises at least annually.

The practical work is manual operations capability. The water utility has to be able to operate without SCADA. Manual valve operation, manual chemical dosing, manual reservoir level monitoring, manual pump control. The transition from automated to manual operation is a procedure that has to be practiced by the operators who will execute it, not just documented in a runbook. The transition affects staffing requirements (manual operations require more operator presence), training requirements (operators have to be qualified on manual procedures), and safety procedures (manual chemical dosing has different safety controls than automated). For most mid-size utilities, the last time manual operations were exercised at scale is during initial commissioning or during a specific planned outage. CI Fortify is asking for the capability to be maintained as a continuously refreshed operational competency.

THE VENDOR SUPPORT GAP

CISA's guidance explicitly calls on industrial automation control system vendors, managed service providers, and security vendors to support critical infrastructure operators in CI Fortify planning. The specific asks are pointed. Vendors are asked to remove barriers to isolation and recovery, particularly contractual or licensing dependencies that prevent operators from executing emergency measures. Vendors are asked to clearly communicate how their systems behave during telecommunications outages, particularly for highly connected OT components. Managed service providers and integrators are asked to assist operators with engineering and planning work to support isolation, local backup collection, and communication dependency documentation.

The vendor support gap is the most operationally significant constraint on CI Fortify implementation. Most ICS vendor contracts were written before isolation was a contemplated operating mode. License terms typically require periodic connectivity. Support contracts typically require remote access. Software updates typically require download from vendor servers. The contractual surface of these dependencies was never designed for the threat model CI Fortify describes.

The practical work for a water district is to inventory every vendor relationship that produces a dependency on third-party connectivity, then to renegotiate contract terms, deploy local infrastructure, or replace systems that cannot tolerate the isolation requirement. This work is not theoretical. The federal procurement cycle on critical infrastructure is now going to incorporate CI Fortify compatibility as a procurement criterion, which means vendors that cannot demonstrate isolation tolerance will lose competitive position over the next two to three years. Districts that begin the inventory and renegotiation work this quarter will be well positioned. Districts that wait until CISA's regional office calls will be reactive.

Atarus's position across multiple recent engagements has been that vendor risk management programs typically underweight scenarios where the vendor relationship itself becomes the failure mode. The Trellix breach Atarus covered on May 4 demonstrated vendor compromise. The Canvas / Instructure breach on May 5 demonstrated vendor-mediated data exposure. CI Fortify takes the vendor risk argument one layer deeper: vendor connectivity itself, even when functioning normally, is the vulnerability during a national security event. The operational implication is that the practitioner work on vendor risk extends from "what happens if the vendor is compromised" to "what happens if the vendor is unreachable for months."

INDICATORS AND TIMELINE

WHAT WATER DISTRICT CIOs SHOULD DO THIS QUARTER