CISA ‘CI Fortify’ Aims to Keep Services Running Under Attack

The U.S. cyber defense agency is launching an effort to better prepare the nation’s critical infrastructure sectors for major cybersecurity attacks, calling for operators to sever operational technology networks from business networks at a moment’s notice and to ensure that backups are ready to step in for corrupted files.

See Also: How Cyberattacks Can Turn Battery Farms Into Grid Blackouts

The Cybersecurity and Infrastructure Security Agency unveiled Tuesday “CI Fortify,” an initiative combining new guidance and operational support for critical infrastructure owners and operators. The program urges owners and operators to adopt a resilience model that allows organizations to continue delivering essential services even as networks are degraded, communications are disrupted or core systems are compromised.

CISA Acting Director Nick Andersen described the effort during a Tuesday media briefing as a call-to-action for infrastructure providers to invest in resilience measures before an incident exposes operational gaps. Officials said that the initiative is designed to ensure the continued delivery of essential services during “periods of cyber duress.”

The framework focuses on two capabilities – isolation and recovery. Isolation refers to disconnection from third-party dependencies, including cloud providers, vendors and telecommunications services. Andersen said isolation also serves to sever adversarial command-and-control pathways.

Recovery focuses on restoring critical systems while isolated, including through pre-tested backup processes, offline capabilities and manual operations. Officials emphasized the need for regular testing and exercises to validate those capabilities before a crisis occurs.

The new initiative comes as federal cyber officials warn that foreign adversaries are prepositioned in the nation’s critical infrastructure systems and planning for disruption. Andersen said nation-state actors seek access to infrastructure systems with the intent of disrupting services such as water, electricity and communications.

CISA officials said the agency has already begun pilot assessments with infrastructure operators and will offer them others, though the scope and approach will vary depending on sector-specific risks and operational requirements. Andersen declined to indicate which specific organizations the agency will initially partner with on the initiative.

Andersen said the agency is hiring additional staff to support the effort, including more than 300 planned positions, with a focus on strengthening regional field operations and technical expertise tied to industrial control systems and operational technology. Regional personnel will play a central role in assessing infrastructure operators and supporting implementation across 10 regions recognized by the Federal Emergency Management Agency.

The initiative is also expected to involve coordination with other federal agencies and sector partners, particularly in cases where smaller operators may lack the resources to implement isolation and recovery capabilities on their own.

The rollout comes as CISA continues to experience leadership instability and resource constraints that have raised concerns about its ability to support partners at scale (see: No Vote, No Leader: CISA Faces 2026 Without a Director). Those pressures were exacerbated during multiple prolonged funding lapses this year that forced the agency into a reactive posture, limiting proactive services such as vulnerability scanning and stakeholder engagement.