--- title: "CI Fortify from CISA recommends that the operat… | Firevault" description: "Insights from Mark Fermor on OT, ICS, and the underlying storage layer." lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/cisa-ci-fortify-isolation-recovery-firevault#webpage", "url": "https://fire-vault.com/news/cisa-ci-fortify-isolation-recovery-firevault", "name": "CI Fortify from CISA recommends that the operat…", "description": "Insights from Mark Fermor on OT, ICS, and the underlying storage layer.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/a89fcfee-ebb3-4b8f-be73-99ddac829a76/cisa-ci-fortify-isolation-recovery-1778147922771-2x.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/cisa-ci-fortify-isolation-recovery-firevault#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/cisa-ci-fortify-isolation-recovery-firevault#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "CI Fortify from CISA recommends that the operators of critical infrastructure must prepare themselves for forced isolation and quick recovery", "item": "https://fire-vault.com/news/cisa-ci-fortify-isolation-recovery-firevault" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "CI Fortify from CISA recommends that the operators of critical infrastructure must prepare themselves for forced isolation and quick recovery", "description": "Insights from Mark Fermor on OT, ICS, and the underlying storage layer.", "url": "https://fire-vault.com/news/cisa-ci-fortify-isolation-recovery-firevault", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/a89fcfee-ebb3-4b8f-be73-99ddac829a76/cisa-ci-fortify-isolation-recovery-1778147922771-2x.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/a89fcfee-ebb3-4b8f-be73-99ddac829a76/cisa-ci-fortify-isolation-recovery-1778147922771-2x.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/a89fcfee-ebb3-4b8f-be73-99ddac829a76/cisa-ci-fortify-isolation-recovery-1778147922771-2x.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/__l5e/assets-v1/a89fcfee-ebb3-4b8f-be73-99ddac829a76/cisa-ci-fortify-isolation-recovery-1778147922771-2x.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Director & Co-Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-05-07T09:38:59.775881+00:00", "dateModified": "2026-08-28T08:03:22.256672+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/cisa-ci-fortify-isolation-recovery-firevault" }, "inLanguage": "en-GB", "articleSection": "Industry Insight", "wordCount": 1296, "keywords": "Industry Insight, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "In February 2026, CISA published CI Fortify , an allied initiative that asks critical infrastructure operators to prepare for a very specific scenario: a geopolitical crisis in which third-party connections, telecoms, vendors and upstream dependencies all become unreliable, while a determined adversary already has some access to the operational technology network. The guidance is unusually direct.", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview What CISA is asking operators to doIsolation is a storage problem, …Recovery only works if the gold …Where Firevault fitsPractical next steps for CNI and…Key TakeawaysMore Resources [Knowledge Vault](/learn/knowledge)/ [Insight](/learn/knowledge?filter=insight) Insight · Industry Insight · 7 May 2026 # CI Fortify from CISA recommends that the operators of critical infrastructure must prepare themselves for forced isolation and quick recovery Insights from Mark Fermor on OT, ICS, and the underlying storage layer. ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) Mark Fermor Director & Co-Founder, Firevault 7 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fcisa-ci-fortify-isolation-recovery-firevault)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fcisa-ci-fortify-isolation-recovery-firevault&text=CI%20Fortify%20from%20CISA%20recommends%20that%20the%20operators%20of%20critical%20infrastructure%20must%20prepare%20themselves%20for%20forced%20isolation%20and%20quick%20recovery%0A%0AInsights%20from%20Mark%20Fermor%20on%20OT%2C%20ICS%2C%20and%20the%20underlying%20storage%20layer.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fcisa-ci-fortify-isolation-recovery-firevault)[](mailto:?subject=CI%20Fortify%20from%20CISA%20recommends%20that%20the%20operators%20of%20critical%20infrastructure%20must%20prepare%20themselves%20for%20forced%20isolation%20and%20quick%20recovery&body=Insights%20from%20Mark%20Fermor%20on%20OT%2C%20ICS%2C%20and%20the%20underlying%20storage%20layer.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Fcisa-ci-fortify-isolation-recovery-firevault) ![Critical national infrastructure substation at twilight with an isolated steel storage vault door in the foreground, physically disconnected from the network](/__l5e/assets-v1/a89fcfee-ebb3-4b8f-be73-99ddac829a76/cisa-ci-fortify-isolation-recovery-1778147922771-2x.jpg) Critical national infrastructure substation at twilight with an isolated steel storage vault door in the foreground, physically disconnected from the network Why it matters ## What this means for organisations holding critical data Insights from Mark Fermor on OT, ICS, and the underlying storage layer. In this analysis 1. 01 [What CISA is asking operators to do](#section-0) 2. 02 [Isolation is a storage problem, …](#section-1) 3. 03 [Recovery only works if the gold …](#section-2) 4. 04 [Where Firevault fits](#section-3) 5. 05 [Practical next steps for CNI and…](#section-4) **On this page**[What CISA is asking operators to do](#section-0)[Isolation is a storage problem, …](#section-1)[Recovery only works if the gold …](#section-2)[Where Firevault fits](#section-3)[Practical next steps for CNI and…](#section-4) In February 2026, CISA published [CI Fortify](https://www.cisa.gov/topics/industrial-control-systems/ci-fortify), an allied initiative that asks [critical infrastructure](/control-for-critical-infrastructure) operators to prepare for a very specific scenario: a geopolitical crisis in which third-party connections, telecoms, vendors and upstream dependencies all become unreliable, while a determined adversary already has some access to the operational technology network. The guidance is unusually direct. Operators are told to invest now in two capabilities, **Isolation** and **Recovery**, so that vital services can keep running during the crisis rather than collapse with it. For anyone building, defending or insuring industrial control systems, this is a significant shift in tone from CISA, the NCSC, the Australian Cyber Security Centre and the Canadian Centre for Cyber Security, all of whom now point in the same direction. It also lands squarely on the question I have been putting to operators for the better part of two decades: where does the gold copy of your operational data actually live, and is it reachable by the same adversary you are trying to defend against? In my experience, nine sites out of ten cannot answer that question without a long pause. ## What CISA is asking operators to do CI Fortify defines two emergency planning objectives. **Isolation** means proactively disconnecting from third-party and business networks to keep essential services running in a degraded communications environment. **Recovery** means documenting systems, backing up critical files, and rehearsing the replacement of components or the transition to manual operation when isolation fails and equipment is rendered inoperable. Nick Andersen, CISA's Acting Director, put it plainly: in a geopolitical crisis, the organisations Americans rely on must keep delivering crucial services, isolate vital systems from harm, continue operating in that isolated state, and quickly recover any systems an adversary has compromised. The same logic applies to UK and European operators bound by NIS2, the Cyber Assessment Framework and DORA. ## Isolation is a storage problem, not just a network problem Most operators read the word "isolation" as a network exercise: shutting down VPNs, severing vendor remote access, killing internet egress at the boundary firewall. That is necessary, but it is not sufficient. The moment you isolate, the question becomes what data, configurations and runbooks the site has on the inside of that boundary. If your golden images, PLC programs, SCADA project files, safety-system configurations and recovery runbooks live in a cloud bucket, an MSP tenant or a corporate file share, then "isolation" leaves the plant without the very assets it needs to keep running. Worse, if any of those assets has been quietly modified by an adversary already on the network, the operator has no clean copy to fall back to. [Layer 1 path control for OT environments](/solutions/control/ot-environments) exists to close that gap, by putting an operator-controlled, physically disconnected copy of the operational state inside the isolation boundary. ## Recovery only works if the gold copy survived the attack CI Fortify is unusually candid about recovery. It tells security vendors to communicate the adversary tactics that prevent recovery, including malicious firmware updates, and to flag vulnerabilities in software-based data diodes that can break isolation. That language matters. It accepts that backups, snapshots and replication are themselves part of the attack surface. Anything reachable over a network or an API can be encrypted, deleted or silently corrupted before the operator notices. Our position at Firevault, drawn from years of working inside CNI and OT estates, is straightforward. The recovery copy of an OT environment should be held offline by default, brought online only by a deliberate, audited human action, and held in infrastructure that the operator controls. That is what Layer 1 [Offline Secure Storage](/offline-secure-storage) delivers. It is not another network tier with a friendlier label. It is a physical break in the path, so that a compromise of the IT estate, the OT estate, the MSP, the cloud account or the vendor cannot, by design, reach the gold copy. ## Where Firevault fits CI Fortify is clear that the responsibility sits with the operator, supported by vendors, integrators and security providers. Firevault sits in the security-vendor and storage-vendor lane, with three deliberate choices that line up with the CISA guidance: - **Protection through physical disconnection.** The Vault is offline by default. There is no always-on path for an attacker to traverse, so encryption, deletion and silent tampering of the gold copy are stopped at Layer 1, not at a policy or an alert. - **Operator-owned recovery state.** Golden images, PLC and DCS programs, safety-system configurations, P&ID drawings, firmware and runbooks live where the people accountable for the plant can reach them, even when telecoms, vendors and the corporate network are unavailable. - **Auditable, human-gated access.** Every connection event is logged, so NIS2, the Cyber Assessment Framework, DORA and the safety case all have evidence that the recovery copy was untouched between incidents. This is the same architecture the [Offline Secure Storage core](/solutions/oss) applies to [critical infrastructure](/solutions/control/critical-infrastructure), and it is why the [bunker network](/bunkers) is built around operator control of the physical path rather than a single jurisdiction or provider. ## Practical next steps for CNI and OT operators - **Inventory the recovery dependency chain.** For every safety-critical and service-critical system, write down where the gold copy lives, what network it sits on, and which third party can reach it. If any link in that chain breaks under CI Fortify's isolation assumption, treat it as a finding. - **Separate the recovery copy from the production network.** A backup that shares a control plane, an identity provider or an API surface with production is not a recovery copy in CI Fortify terms. Move it behind a physical break. - **Rehearse a cold restart from offline media.** Tabletop and live exercises should assume the MSP, the cloud and the corporate WAN are unavailable. Time the restart and record what was missing. - **Align the evidence.** Tie the offline recovery copy to the obligations in [NIS2](/solutions/oss/compliance/nis), DORA, the Cyber Assessment Framework and the relevant safety case, so the same artefact serves regulators, insurers and the board. - **Read the partner guidance.** The [NCSC severe cyber threat guide](https://www.ncsc.gov.uk/collection/how-to-prepare-and-plan-your-organisations-response-to-severe-cyber-threat-a-guide-for-cni), the [ACSC CI Fortify page](https://www.cyber.gov.au/business-government/secure-design/operational-technology-environments/ci-fortify) and the [CCCS resilience initiative](https://www.cyber.gc.ca/en/cyber-security-readiness/critical-infrastructure-resilience-escalated-threat-navigation-initiative) say the same thing in slightly different words. ## Key Takeaways - **CI Fortify changes the planning baseline.** Operators are now expected to assume forced isolation and partial OT compromise as a planning case, not a worst case. - **Isolation without local data is theatre.** Cutting the network is only useful if the golden images, configurations and runbooks the plant needs are already inside the boundary. - **Network-reachable backups are part of the attack surface.** CISA itself flags malicious firmware and data-diode software flaws as recovery blockers. - **Layer 1 storage closes the gap.** A physically disconnected, operator-controlled copy of the recovery state is the simplest way to satisfy both the Isolation and Recovery objectives. - **The evidence is reusable.** The same offline copy supports NIS2, DORA, the Cyber Assessment Framework, the safety case and the insurer questionnaire. If you want to walk through CI Fortify against your own OT estate, [book a briefing with the Firevault team](/contact). We will map your current recovery chain, mark the points where CI Fortify's assumptions break it, and show how Layer 1 Offline Secure Storage removes them. _Mark Fermor is the co-founder of Firevault. He has spent more than twenty years building offline-first storage for critical national infrastructure, operational technology and regulated estates across the UK and Europe._ **How Firevault helps** - **[Offline Secure Storage](/offline-secure-storage)** keeps gold-copy data physically disconnected from the network, so a ransomware or exfiltration event cannot reach it. - **[Control](/control)** gives boards and operators a single view of what is online, what is isolated, and what is recoverable across the estate. - **[Firebreak](/firebreak)** delivers hardware-enforced disconnection at Layer 1, so exposed credentials or compromised network paths cannot become a route into the vault. _Talk to Firevault about [Disconnect to Protect®](/about) for your organisation._ About the author ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## A recovery copy an attacker cannot reach Offline Secure Storage® keeps a clean copy of your data on hardware that is physically disconnected, so backup and recovery do not depend on systems an intruder can touch. [Get started](/get-started)[Talk to the team](/demo) **Hardware**Your copy sits on dedicated encrypted hardware **Disconnect**Offline by default, connected only when you say so **Recovery**A known-clean copy to rebuild from, on your timetable **Location**Held in a secure Firevault Bunker Related Reading ## You may also find these useful [ ![When Access Fails: Continuity Needs Offline Secure Storage](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/when-the-grid-fails-offline-secure-storage-business-continuity-2026.jpg) Industry Insight ### When Access Fails: Continuity Needs Offline Secure Storage Fire and grid failure are only one of six ways organisations lose access to their own records. A practical case for holding critical material offline, whatever the cause. 18 Aug 2026 9 min ](/news/when-the-grid-fails-offline-secure-storage-business-continuity)[ ![Offline Is Not Enough: What the $114 Million Cold Wallet Sweep Teaches Us About Key Generation](/hero-images/cold-wallet-seed-entropy-2026-vibrant.jpg) Industry Insight ### Offline Is Not Enough: What the $114 Million Cold Wallet Sweep Teaches Us About Key Generation An attacker emptied 1,196 bitcoin wallets in 41 minutes without ever touching a single device. The wallets were air gapped. The keys were not truly random. Here is what that means for anyone who relies on offline storage. 6 Aug 2026 4 min ](/news/cold-wallet-seed-entropy-flaw-offline-is-not-enough)[ ![The Minnesota Water Attacks: Why Connectivity Is Becoming Critical Infrastructure's Biggest Risk](/hero-images/minnesota-water-attacks-2026-vibrant.jpg) Industry Insight ### The Minnesota Water Attacks: Why Connectivity Is Becoming Critical Infrastructure's Biggest Risk More than 30 US water and wastewater utilities were targeted in a coordinated cyber attack on operational technology. The lesson for critical infrastructure is that unnecessary connectivity is now the risk itself. 31 Jul 2026 5 min ](/news/minnesota-water-attacks-connectivity-critical-infrastructure-risk)[ ![Rogue AI Agents: A Firevault Commentary on the Hugging Face Incident](/hero-images/rogue-ai-agents-2026-vibrant.jpg) Industry Insight ### Rogue AI Agents: A Firevault Commentary on the Hugging Face Incident Firevault commentary on the first fully autonomous AI hack. Our take on what boards should do, informed by Joe Tidy's BBC reporting. 29 Jul 2026 4 min ](/news/rogue-ai-agents-hugging-face-opinion-2026)[ ![Data Integrity Attacks and Air Gap Defence](/__l5e/assets-v1/2afceeb3-5499-4aa5-9b5c-e555af9b8ab8/the-silent-threat-data-integrity-attacks-and-the-air-gap-defence-1771693250462-2x.jpg) Industry Insight ### Data Integrity Attacks and Air Gap Defence Data integrity attacks, a stealthier cousin to traditional ransomware, are on the rise, posing a significant threat to organisational trust and operational continuity. This article explores the growing danger of data manipulation and highlights how physically air-gapped storage offers an uncompromised defence. 21 Feb 2026 5 min ](/news/the-silent-threat-data-integrity-attacks-and-the-air-gap-defence)[ ![Firmware Attacks and the Air Gap Defence](/__l5e/assets-v1/05135422-b1ae-4dcf-8de5-66b7067ec7ae/the-silent-sabotage-firmware-attacks-and-the-air-gap-imperative-1771434041117-2x.jpg) Industry Insight ### Firmware Attacks and the Air Gap Defence Firmware attacks are a sophisticated and increasingly prevalent threat, capable of bypassing traditional security measures. This article explores the growing danger of these low-level compromises and highlights the critical role of physical air-gapped storage in providing an unbreachable last line of defence. 18 Feb 2026 5 min ](/news/the-silent-sabotage-firmware-attacks-and-the-air-gap-imperative) ## Suggested Reading - [What is Offline Secure Storage The foundation of physical disconnection ](/how-it-works/offline-secure-storage) - [Why Offline Secure Storage The case for physical control ](/why-oss) - [Ransomware Defence Hold gold copies offline ](/oss-for-ransomware-recovery) - [Control Physical path control for IT and OT ](/solutions/control) - [Knowledge Vault All articles, guides and whitepapers ](/learn/knowledge) - [Book a Demo See Firevault in action ](/demo) [Back to Knowledge Vault](/learn/knowledge)