The Cybersecurity and Infrastructure Security Agency (CISA) is preparing new guidance for critical infrastructure operators that focuses on recovering systems after a cyber incident. The agency is also urging critical infrastructure operators to test whether they can isolate systems and sustain essential services during disruptions.
During a CISA Live event on Sept. 21, Matthew Springer, acting deputy associate director of CISA’s Joint Cyber Defense Collaborative, said CISA and its Five Eyes partners are assessing organizations’ ability to isolate and recover systems and plan to turn those findings into practical recovery guidance.
“We are doing assessments currently on the ability of partners to isolate and recover,” Springer said. “We’ll take the body of that feedback and then put out some common sense best practices, lessons learned on how we make this more practical, implementable.”
The guidance will be offered under CI Fortify, an initiative CISA launched in May to help critical infrastructure owners and operators maintain essential services during large-scale cyberattacks and geopolitical crises.
Matthew Rogers, an industrial control systems expert within CISA’s Cybersecurity Division, said the goal of CI Fortify is to preserve a “minimum viable set of operations” during a cyber incident.
The initiative centers on isolation and recovery, including preparations for scenarios in which internet, phone, cloud, or third-party services are unavailable. CISA officials stressed that operators need to test those plans before an incident occurs.
“The reality is, if you haven’t tested it, you don’t really know if it’s going to work,” Rogers said.
“You might think things are working as intended with these short, isolated little tests, but until you test it for real on your whole system, you just don’t know,” he added.
Rogers said the forthcoming guidance will include tips and tricks to help organizations with recovery efforts.
The recovery guidance will build on guidance that CISA and its partners published in July focused on isolating vital systems.
CISA officials also urged organizations to identify the suppliers, customers, and other partners they depend on – and those that depend on them – and work through those relationships before a crisis.
“It’s going to raise some hard issues; of course it will,” Springer said. “But to Matt’s point, better we think through those now than in time of crisis.”
Rogers said organizations can start small, including testing whether employees can communicate using backup methods during an outage.
“You can take it slow. You don’t have to do everything all at once,” Rogers said.