CISA mandates OT isolation as supply chain breaches surge

By mid-2026, CISA’s CI Fortify initiative underscored the critical need for operational technology (OT) in critical infrastructure to function autonomously from business IT and third-party networks for extended periods—potentially weeks to months—during conflicts to thwart sophisticated state-sponsored cyberattacks. This strategy includes rigorous technical assessments and the development of recovery protocols such as backups and manual operation procedures, reflecting a proactive shift towards resilience that anticipates prolonged isolation rather than reactive incident response.

The threat landscape revealed alarming stealth capabilities of nation-state actors, notably the Chinese group Volt Typhoon, which infiltrated U.S. critical infrastructure networks undetected for over five years, exploiting hidden dependencies on corporate IT services like Active Directory and DNS. These dependencies cause most existing OT isolation plans to fail silently when networks are physically separated, prompting CISA to demand costly but essential pre-engineered standalone IT service instances within OT perimeters to ensure effective isolation and recovery—capabilities that must be rigorously built and rehearsed before any attack occurs.

Nation-state cyber adversaries targeting OT environments exhibit diverse motivations and tactics: Chinese groups such as Volt Typhoon and Salt Typhoon focus on long-term strategic embedding and espionage using legitimate administrative tools to evade detection, while Iranian actors pursue more tactical disruption and destruction. This spectrum of threats challenges CISOs who must defend against military-grade cyber operations without necessarily possessing specialized geopolitical expertise, complicating the defense of critical infrastructure sectors like energy grids.

While direct physical damage from cyberattacks on U.S. power grids has yet to materialize, evidence from Ukraine and Poland demonstrates that nation-state actors, including Russia, have successfully executed damaging OT attacks abroad, using cyber operations as proxies for warfare and influence. Within the U.S., attackers have gained unauthorized access and pre-positioned themselves without causing outages, highlighting a persistent threat. Meanwhile, polarized perceptions among state utility commissioners—from dismissing risks as hype to fearing catastrophic attacks—underscore the urgent need for balanced education and nuanced understanding of OT cybersecurity challenges, especially given the complexity of protecting distributed grid devices and the nuanced risks posed by Chinese-made power electronics.

By mid-2026, CISA’s CI Fortify initiative has crystallized a resilience-driven strategy urging critical infrastructure operators to prepare for extended operational technology (OT) isolation lasting weeks to months during conflicts. This approach mandates disconnecting OT from business IT and third-party networks to maintain continuity, supported by tested recovery protocols such as backups and manual operation procedures. CISA’s pilot assessments with organizations spanning national security, defense, public health, and economic sectors underscore the necessity of tailoring isolation and recovery frameworks to sector-specific operational realities.

CI Fortify’s core tenet is that OT isolation cannot be an ad hoc response; it must be pre-engineered and rigorously tested well before any attack. Recent analyses reveal that many existing isolation plans fail silently due to hidden dependencies on corporate IT services like Active Directory and DNS, which become unreachable once OT networks are physically isolated. To counter this, CISA advocates deploying standalone, isolated instances of these critical IT services within the OT perimeter—a costly but essential capital investment that many operators have historically deferred, exposing a significant vulnerability in resilience planning.

CI Fortify delineates two indispensable emergency capabilities: isolation and recovery. Isolation involves severing OT from corporate and external networks while maintaining operational control, and recovery focuses on restoring systems using pre-tested local procedures. Both capabilities require deliberate build-out and rehearsal prior to any incident, with the framework introducing precise terminology such as 'vital systems'—the minimum OT components needed to deliver critical services—and 'isolation points,' predetermined network boundaries where connectivity can be severed effectively. This structured approach enables operators to pre-identify and protect essential infrastructure with surgical precision.

Physical isolation emerges as the gold standard for protecting OT environments, defined as complete disconnection from all shared network and computing infrastructure. CI Fortify explicitly warns against relying on administrative controls like VLAN changes, which are prone to misconfiguration and insufficient to prevent lateral movement by adversaries. This emphasis on physical separation reflects a strategic shift towards uncompromising, hardware-enforced boundaries that significantly reduce attack surfaces and enhance resilience during prolonged conflict scenarios.

By mid-2026, Operational Technology (OT) cybersecurity has decisively ascended to a board-level priority, with executive leadership—particularly CISOs and CSOs—assuming direct responsibility in over half of organizations, a sharp rise from just 16% in 2022. This governance shift is underscored by the fact that 80-81% of organizations plan to place OT security under CISO oversight within a year, reflecting a consensus that OT risks are integral to enterprise risk management rather than siloed IT concerns. However, despite this elevated attention, many organizations still grapple with foundational challenges such as limited visibility, inadequate network segmentation, and immature incident response capabilities, which impede effective governance and risk mitigation.

The maturation of OT cybersecurity governance is accompanied by a more candid and realistic self-assessment of security postures, as organizations uncover previously hidden vulnerabilities through enhanced detection tools and broader team involvement. This recalibration is evident in the decline of respondents rating their OT maturity at the highest levels—from 49% in 2025 to 17% in 2026—and the rise in lower maturity levels, signaling a positive shift toward transparency and honest risk evaluation. Improved detection capabilities have paradoxically led to increased reporting of intrusions, with 71% of organizations now acknowledging one to nine incidents annually, illustrating that heightened visibility is driving governance to confront the true scale of threats rather than an actual surge in attacks.

Governance frameworks are evolving to emphasize integrated IT-OT security strategies, recognizing that fragmented operations obscure the full attack path and delay critical board-level decision-making. As highlighted in the case of Tenaga Nasional Berhad (TNB) in Malaysia, effective OT cybersecurity governance now entails continuous threat monitoring, risk assessments, and external resilience audits led by high-level officials such as the Chief Government Security Officer. This comprehensive oversight is vital given the expanding attack surface from digitalization—smart meters, automated controls, and third-party platforms—and the stringent requirements imposed by regulations like Malaysia’s Cyber Security Act 2024, which mandate coordinated leadership and compliance across critical infrastructure sectors.

Regulatory pressures and operational realities are further driving OT cybersecurity into the boardroom, as organizations confront persistent cyber intrusions with significant operational impacts, including days- or weeks-long outages reported by 31% of Canadian firms. The growing complexity of OT environments demands enhanced asset visibility—currently achieved by only 14% of organizations—and robust network segmentation to support resilience. Industry voices call for transparency and harmonized regulatory frameworks to unify governance efforts, while also recognizing that physical threats to critical infrastructure, such as mandated ballistic protections for transformers, require equal board-level attention. This holistic governance approach integrates cybersecurity into operational planning and risk management, treating cyber resilience as a core component of overall operational performance alongside productivity and safety.

By mid-2026, supply chain cyber breaches had become alarmingly widespread, impacting 26% of businesses in the past year alone, with organizations knowingly engaging risky suppliers facing over four times the likelihood of third-party incidents (43% vs 10%). Experts like Chris Butler and Max Imbiel highlight that traditional risk assessments relying on administrative questionnaires fail to capture the complex, multi-tiered realities of modern supply chains, which have grown increasingly interconnected and expansive. This complexity demands continuous, granular visibility into third-party access and data flows, as well as integrating suppliers into incident response plans and adopting zero-trust principles focused on verification and least privilege, rather than assumed trust.

Despite significant investments in third-party risk management tools, supply chain-related breaches surged to represent 48% of all breaches by late July 2026, underscoring a critical failure in execution rather than visibility. Organizations have built systems to detect risks but lack the operational infrastructure to drive remediation and outcomes, leading to fragmented efforts and supplier fatigue as thousands of security teams redundantly assess the same suppliers. Moreover, systemic vulnerabilities now often arise from shared dependencies such as cloud providers and widely used software platforms, risks that no single organization can fully map or manage alone, necessitating a fundamental shift from treating supply chain risk as an individual company problem to embracing collective risk management across the network.

Critical National Infrastructure (CNI) sectors reveal the persistent challenge of repeated supplier breaches and credential theft, with 76% and 75% of organizations respectively reporting such incidents that exploit trusted third-party access to operational technology (OT) environments. Alarmingly, 39% of these organizations only review third-party access reactively after incidents occur, while uneven investment leaves smaller suppliers under-resourced and vulnerable, creating weak links for larger contractors. The shift toward cloud-connected OT and expanded remote supplier access—now integrated by about 70% of organizations—further enlarges the attack surface, making continuous monitoring and zero-trust approaches indispensable to prevent attackers from exploiting trusted connections.

The convergence of IT and OT systems in sectors like energy amplifies supplier vulnerabilities, as cyber risks can propagate across domains, disrupting operations and physical production. Analysts such as Ravindra Puranik emphasize the need for stronger vendor governance, continuous monitoring, and joint incident response plans, especially given attacks exploiting shared vendor software tools. The tangible impacts are evident in manufacturing, where supplier breaches cause delays in customer deliveries and reduced production capacity, prompting calls from industry bodies like Make UK for cyber resilience to be integrated into operational performance metrics with clear board-level ownership, employee training, and robust supplier assurance to mitigate the intertwined digital and operational risks.

By mid-2026, the technological landscape of OT security in critical infrastructure has evolved to emphasize comprehensive asset visibility and operational mapping across both gray space (facility power, HVAC) and white space (IT load), enabling organizations to understand device locations, communication pathways, and firmware versions. This granular visibility supports advanced detection and response strategies that treat security as a cyber-physical discipline, correlating security events with operational anomalies and anticipating manipulation of monitoring and control systems, as highlighted in analyses from August 2. Network segmentation and strict remote access controls have become foundational, isolating control networks from business networks and enforcing least-privilege access to mitigate the expanded digital attack surface driven by AI integration and IT-OT convergence.

The dual role of artificial intelligence in OT security—both as a tool for attackers and defenders—has added complexity to cybersecurity strategies. As discussed in early August 2026, generative AI accelerates the sophistication and speed of cyberattacks, pressuring companies to enhance their response capabilities while simultaneously leveraging AI defensively to detect and mitigate threats. This dynamic necessitates integrating AI-aware cyber-physical controls that are transparent and auditable, meeting the rising expectations of underwriters and regulators for operational uptime assurance amid an expanding attack surface that now includes distributed resources and data centers.

Regulatory adaptation is critical to managing the growing complexity of OT cybersecurity risks, with experts calling for harmonized, transparent frameworks developed by established bodies like IEEE and IEC. The fragmented and underfunded nature of current regulatory efforts, including recent cuts to CISA, underscores the urgent need for centralized coordination to unify standards across legacy and modern systems. This harmonization effort aims to address emerging challenges such as the integration of distributed energy resources outside traditional CIP perimeters and the nuanced handling of foreign-manufactured power electronics, balancing technical realities against geopolitical concerns.

Post-quantum cryptography (PQC) readiness presents a formidable challenge for OT systems due to legacy hardware limitations and stringent real-time processing requirements inherent in SCADA and RTOS environments. As noted in mid-August 2026 analyses, adapting enterprise IT best practices—such as network segmentation and gateway deployment—to OT environments is essential to manage legacy devices while enhancing authentication and encryption. Regulatory support, including executive orders referencing critical infrastructure sectors, reflects growing recognition of OT security’s vital role in safeguarding societal functions and human life amid evolving quantum threats.

The cybersecurity resilience of Tenaga Nasional Berhad (TNB), Malaysia’s primary electricity provider, is not merely an internal operational concern but a cornerstone of national security. As a designated National Critical Information Infrastructure sector lead under the Cyber Security Act 2024, TNB’s operational technology safeguards underpin the stability of vital services including hospitals, banks, transport, and government operations. A cyber incident disrupting TNB’s systems could cascade across these sectors, illustrating the profound interdependencies within the nation’s critical infrastructure.

TNB’s rapid digital transformation, marked by the deployment of approximately 4.5 million smart meters by the end of 2024 and ambitions to double that number, significantly broadens its cyberattack surface. This expansion necessitates integrated, cross-sector cybersecurity strategies that transcend traditional silos to protect the increasingly interconnected grid and its dependent services. Recognizing that prevention alone is insufficient, TNB emphasizes resilience—prioritizing the ability to maintain safe and reliable electricity operations during and after cyber incidents, a pragmatic approach that balances vigilance with operational continuity.