CISA Launches CI Fortify to Bolster Critical Infrastructure Resilience

The Cybersecurity and Infrastructure Security Agency (CISA) launched CI Fortify on Tuesday, an initiative to help critical infrastructure owners and operators maintain essential services during large-scale cyberattacks and geopolitical crises. 

The effort provides guidance on isolating vital systems, operating in a degraded environment, and recovering compromised systems. CISA is also offering targeted assessments to help operators identify barriers to isolation and recovery. 

CISA said the initiative is aimed at preparing critical infrastructure entities for conflict scenarios that could disrupt telecommunications, vendors, and upstream dependencies. The agency is prioritizing defense-related critical infrastructure, but said support will extend across sectors. 

“In a geopolitical crisis, the critical infrastructure organizations Americans rely on must be able to continue delivering – at a minimum – crucial services. They must be able to isolate vital systems from harm, continue operating in that isolated state, and quickly recover any systems that an adversary may successfully compromise,” CISA Acting Director Nick Andersen said in a statement.  

Speaking during a media briefing, Andersen said the initiative spans multiple federal departments and agencies. Some of the agencies coordinating with CISA include sector risk management agencies – such as the Transportation Security Administration, Environmental Protection Agency, and Department of Energy – and others that rely heavily on certain critical infrastructure, such as the Department of Defense. 

Internationally, coordination to bolster critical infrastructure resilience is occurring with Five Eyes partners, because, as Andersen put it, “this challenge is borderless and [calls] for fundamental emergency planning that makes sure that services can be delivered even during a crisis.” 

While Andersen told reporters that CI Fortify generally does not include elections infrastructure in its planned work, other support will be made available for elections infrastructure owners and operators with the upcoming midterms elections season.  

U.S. critical infrastructure has been a favored target for cyber threat actors. Previous large-scale attacks led to disruption in services – such as the Colonial Pipeline ransomware attack that halted fuel distribution across the East Coast – and other smaller-scale, ongoing attacks have threatened critical infrastructure.  

Cyber officials and experts have long-highlighted ongoing vulnerabilities in critical infrastructure sectors, such as water and state and local systems, where limited resources and aging technology increase risk. Threats from China, especially from Salt Typhoon, have also continued to loom, in addition to those posed by Iran with the ongoing war in the Middle East.