As reported by BleepingComputer, CISA and Australia's Australian Signals Directorate (ASD) have jointly released guidance directing critical infrastructure organizations to actively pre-plan the isolation of operational technology (OT) systems before a cyberattack forces their hand. This isn't simply another advisory — it represents a meaningful shift in how governments expect critical sector operators to approach resilience and cyber preparedness.

Key Insight: As reported by BleepingComputer, CISA and Australia's Australian Signals Directorate (ASD) have jointly released guidance directing critical infrastructure organizations to actively pre-plan the isolation of operational technology (OT) systems before a cyberattack forces their hand.

Why This Guidance Matters Now

The timing of this joint release is not accidental. Over the past 18 months, critical infrastructure has become the most targeted sector globally, with ransomware actors and nation-state groups deliberately pursuing OT environments — not just to steal data, but to cause operational disruption at scale. We've seen water treatment facilities, energy grids, and manufacturing plants brought to their knees not because attackers were necessarily sophisticated, but because defenders had no pre-rehearsed plan for isolation when systems began behaving abnormally.

The core message from regulators is clear: if you haven't planned for isolation before an incident begins, you are already behind. Attempting to make decisions about which systems to disconnect, which processes to maintain manually, and which communications to preserve during an active breach is a recipe for catastrophic operational failure.

"Isolation decisions made in the chaos of an active attack are rarely optimal. Pre-planned, exercised isolation procedures are the difference between a recoverable incident and a national-level emergency." — Shield53 OT Security Practice

Who Is Most Exposed

The sectors that should treat this guidance with the highest urgency include:

Who Is Most Exposed
Energy and utilities — grid operators and natural gas pipeline controllers remain priority targets for both criminal and state-sponsored actors
Water and wastewater treatment — historically under-resourced and often running legacy SCADA systems with minimal IT/OT segmentation
Healthcare and hospital networks — medical device integration increasingly blurs the IT/OT boundary
Transportation and logistics — port authorities and freight rail operators face growing exposure as digitization accelerates
Manufacturing — particularly those operating in defense supply chains or pharmaceutical production

The IT/OT Convergence Problem

Much of what makes isolation so difficult in practice is the decade-long trend of IT/OT convergence — connecting historically air-gapped industrial control systems to enterprise networks and the internet for efficiency gains. While this integration delivers real operational value, it has dramatically expanded the attack surface. When a ransomware payload crosses from the IT environment into the OT segment, the window for an effective isolation response collapses from hours to minutes.

Defenders must also contend with the availability vs. security tension that is endemic to OT environments. Unlike IT systems where a patch or shutdown might be tolerable, taking a turbine control system offline has immediate physical-world consequences. This is precisely why isolation runbooks must be developed in partnership with operations engineering teams — not handed down from a CISO's office in isolation (pun intended).

Shield53 Recommendations

What You Should Do Now

  • Conduct an OT asset inventory immediately. You cannot isolate what you cannot identify. Map every PLC, HMI, historian, and remote terminal unit on your network, including unexpected connections to corporate IT infrastructure.
  • Define and document "isolation zones" in advance. Determine which OT systems can operate independently in a degraded or manual mode, and document exactly what must happen to reach that state safely. This documentation must be accessible offline.
  • Develop and rehearse isolation runbooks. Tabletop exercises are insufficient — conduct live-fire isolation drills in non-production environments that mirror your actual OT architecture. Involve operations staff, not just security teams.
  • Establish out-of-band communication channels. If your primary network is compromised, how will your teams communicate isolation procedures? Establish backup communication protocols (radio, satellite, dedicated out-of-band management networks) before you need them.
  • Audit vendor and third-party remote access paths into OT environments. Many breaches enter OT through compromised vendor VPN credentials or remote support tools. Enforce just-in-time access with strict monitoring.
  • Engage with CISA's free resources. CISA offers no-cost OT/ICS vulnerability assessments and cybersecurity advisory services to critical infrastructure entities — take advantage of them.
  • Align with ICS-CERT and the NIST Cybersecurity Framework for OT. Ensure your incident response plan specifically addresses the OT-unique considerations outlined in NIST SP 800-82.

The Broader Strategic Implication

The fact that two governments felt it necessary to jointly issue this guidance signals something the industry should take seriously: regulators believe critical infrastructure operators are not sufficiently prepared to manage OT isolation decisions under real attack conditions. This is a policy signal that likely precedes more prescriptive regulatory mandates — particularly in the U.S. under evolving critical infrastructure security requirements and in Australia under the Security of Critical Infrastructure (SOCI) Act framework.

Organizations that treat this guidance as a checkbox exercise do so at their peril. The adversaries targeting critical infrastructure are patient, well-resourced, and increasingly capable of causing physical consequences. Isolation readiness isn't a defensive luxury — it is a foundational operational requirement.