OT systems are particularly vulnerable to cyber attacks. Many were never designed to withstand cyber threats and are now exposed to adversaries with sophisticated capabilities.
In October 2025, ASD’s ACSC released CI Fortify. The series provides practical, principles-based guidance to help CI withstand cyber threats and recover quickly in the event of an incident, ensuring the continuity of critical services during crises or prolonged disruptions. CI Fortify should be prioritised by all Australian CI operators.
To achieve this capability, organisations should:
identify vital OT and enabling systems that support a critical service as well as associated isolation points
develop the capability to physically isolate vital OT and enabling systems from the internet and other networks for three months while continuing to maintain critical services
be able to rapidly and fully rebuild vital OT and enabling systems to minimise disruption to critical services.
ASD’s ACSC’s latest publication in the series, Advice for Isolating Vital Systems, provides guidance to OT system owners and operators, and cyber defenders in adopting CI Fortify’s physical isolation requirement. The physical isolation of vital systems removes operational independence between OT and IT networks, enabling continued delivery of critical services even if corporate networks become inoperable or degraded.
The ability to fully rebuild isolated OT and supporting systems is equally critical, allowing for effective incident response and the safe, timely restoration of services. This is particularly important where malicious activity may persist beyond the temporary isolation period, or where initial recovery efforts prove unsuccessful.
