# CISA CI Fortify: Critical Infrastructure OT Isolation and Recovery Planning Guidance (2026)

> CISA launched the CI Fortify initiative urging critical infrastructure owners and operators (water, energy, transportation, communications) to plan to disconnect OT from third-party and business networks and to recover compromised systems while isolated, so essential services can continue for weeks or months during a cyber disruption. This is defensive guidance; it contains no CVEs and no IOCs.

- **Published:** 2026-11-03T13:21:54Z
- **Last reviewed:** 2026-11-03T13:21:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5154
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5154.png
- **ID:** TL-2026-5154
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 12 (1 shown free below)

## Description

CI Fortify is a CISA initiative, announced in early May 2026 by Acting Director Nick Andersen, that pairs published guidance with operational support (pilot assessments) to help critical infrastructure operators keep delivering essential services during periods of cyber duress, including a geopolitical crisis or wider conflict. It is built on two capabilities: isolation and recovery.

Isolation means proactively disconnecting operational technology (OT) from third-party and business networks, including cloud providers, vendors, and telecommunications services, so that OT cyber impacts do not spread and essential services continue during degraded communications. Per Andersen, isolation also severs adversary command-and-control pathways. Operators are asked to plan for sustained isolated operation of weeks to months. Recovery means restoring compromised systems while isolated: documenting systems, backing up critical files, and rehearsing component replacement or transition to manual operation in case isolation fails and components become inoperable.

CISA's recommended actions for operators: identify critical customers (e.g., military installations and lifeline services) and set service delivery targets; determine the vital OT needed to meet those targets while isolated; update business continuity plans for prolonged isolation; monitor CISA and Sector Risk Management Agency communications for isolation triggers; and share the guidance with managed service providers, integrators, and vendors. Industrial vendors are asked to identify blockers to isolation and recovery (licensing, contractual issues), communicate failure states during telecommunications outages, and update contact details with CISA. MSPs should support engineering updates, local backups, documentation, and dependency mapping. Security vendors should provide watch-and-warning and communicate tactics that prevent recovery or break isolation. Linked CISA resources include 'CI Fortify - Advice for Isolating Vital Systems', 'Communicating Under Pressure: Best Practices for Service Providers', 'Secure Connectivity Principles for OT', and a tabletop exercise package for isolation and recovery. Coverage also notes CISA's zero-trust guidance for OT (April 30, 2026) and an Australian CI Fortify framework from 2025 as a model.

Threat context from press coverage: the scenario assumes nation-state actors are already positioned inside OT, telecommunications, and critical infrastructure networks, and that third-party connections, internet access, and upstream providers become unreliable. CyberScoop and Cybersecurity Dive reference Chinese state-sponsored campaigns Volt Typhoon and Salt Typhoon as context; the guidance itself does not attribute a specific campaign. Xage Security CEO Duncan Greatwood cautioned that isolation alone is insufficient without control and segmentation inside the environment, because threats exploit trusted connections and compromised credentials. CISA reported pilot assessments already underway and a hiring push of 300+ positions for regional field operations and industrial control systems expertise.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1133 External Remote Services
- T1078 Valid Accounts
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1485 Data Destruction

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CI Fortify OT: System Recovery Inhibition via VSS/Backup/BCD Tampering (T1490/T1485)** (`TL-2026-5154-SPL-002`)

TL-2026-5154 (CISA CI Fortify) centres on recovering compromised OT systems while isolated, so tactics that prevent recovery are directly in scope (T1490 Inhibit System Recovery). Detects vssadmin/wmic shadow copy deletion, wbadmin catalog/backup deletion and bcdedit recovery-disabling commands via Sysmon process creation. These destroy the local restore points operators rely on during isolated operation, and wbadmin/vssadmin deletion of backup catalogs and shadow copies is also destruction of recovery data (T1485).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1490, T1485
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ((Image="*vssadmin.exe" CommandLine="*delete*" CommandLine="*shadows*") OR (Image="*wmic.exe" CommandLine="*shadowcopy*" CommandLine="*delete*") OR (Image="*wbadmin.exe" CommandLine="*delete*" (CommandLine="*catalog*" OR CommandLine="*backup*" OR CommandLine="*systemstatebackup*")) OR (Image="*bcdedit.exe" CommandLine="*recoveryenabled*no*") OR (Image="*bcdedit.exe" CommandLine="*bootstatuspolicy*ignoreallfailures*"))
| table _time host User ParentImage Image CommandLine
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine contains "delete" and ProcessCommandLine contains "shadows")
    or (FileName =~ "wmic.exe" and ProcessCommandLine contains "shadowcopy" and ProcessCommandLine contains "delete")
    or (FileName =~ "wbadmin.exe" and ProcessCommandLine contains "delete" and (ProcessCommandLine contains "catalog" or ProcessCommandLine contains "backup"))
    or (FileName =~ "bcdedit.exe" and (ProcessCommandLine matches regex @"(?i)recoveryenabled.*no" or ProcessCommandLine matches regex @"(?i)bootstatuspolicy.*ignoreallfailures"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: System Recovery Inhibition Via Shadow Copy Backup Or BCD Tampering (CI Fortify TL-2026-5154)
id: 7b2d94e0-1c6f-4a38-b5d7-92e4c8a0f102
status: experimental
description: Detects commands that delete volume shadow copies, delete Windows backup catalogs or disable boot recovery. CI Fortify (TL-2026-5154) relies on the ability to restore compromised OT systems while isolated; these actions inhibit system recovery (T1490).
references:
    - https://www.cisa.gov/fortify
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.impact
    - attack.t1490
    - attack.t1485
logsource:
    category: process_creation
    product: windows
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    selection_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains: 'delete'
    selection_wbadmin_target:
        CommandLine|contains:
            - 'catalog'
            - 'backup'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'ignoreallfailures'
    condition: selection_vssadmin or selection_wmic or (selection_wbadmin and selection_wbadmin_target) or selection_bcdedit
falsepositives:
    - Backup or storage administrators pruning shadow copies during approved maintenance
    - Imaging or provisioning scripts that reset boot configuration
level: high

```

**Known false positives:**

- Backup administrators deleting old shadow copies or catalogs during approved maintenance
- Provisioning or imaging scripts that modify bcdedit recovery settings

**Tuning notes:** Exclude known backup-server hosts and service accounts. Treat hits on OT/engineering workstations and historians as high priority. Requires Sysmon EventCode 1 with command-line capture (or Windows 4688 with command-line auditing).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CI Fortify OT: Third-Party Remote Support Tool Executed On Host (T1133/T1199) (locked: unlock with TL Creds)
- CI Fortify OT: Backup, Database, Historian or SCADA Service Stop (T1489/T1490) (locked: unlock with TL Creds)
- CI Fortify OT: One Account Network/RDP Logons Across Many Hosts (T1021/T1078) (locked: unlock with TL Creds)
- CI Fortify OT: Remote Desktop Access Path Re-Enabled On Host (T1133/T1021) (locked: unlock with TL Creds)
- CI Fortify OT: Secure Deletion / Disk Wipe Utilities And Backup File Deletion (T1485/T1490) (locked: unlock with TL Creds)
- CI Fortify OT: Remote Execution Tooling For Lateral Movement (T1021/T1078) (locked: unlock with TL Creds)
- CI Fortify OT: Remote Desktop Logon From Public IP (T1133/T1078/T1199) (locked: unlock with TL Creds)
- CI Fortify OT: Periodic Script/LOLBin Beaconing To External Hosts (T1071/T1133) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 12)

Defanged, TLP:CLEAR.

- URL: `hxxps://www[.]cisa[.]gov/fortify`

Full set of 12 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CISA CI Fortify](https://www.cisa.gov/fortify)
- [CISA Urges Critical Infrastructure Providers to Make Plans to Remain Operational if hit by Cyber-Attack (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/cisa-ci-fortify-isolation-recovery/)
- [CISA CI Fortify critical infrastructure isolation recovery guidance during conflict (CyberScoop)](https://www.cyberscoop.com/cisa-ci-fortify-critical-infrastructure-isolation-recovery-guidance-during-conflict/)
- [CISA: Critical Infrastructure Must Master Isolation, Recovery (SecurityWeek)](https://www.securityweek.com/cisa-critical-infrastructure-must-master-isolation-recovery/)
- [CISA CI Fortify isolation and recovery guidance (Cybersecurity Dive)](https://cybersecuritydive.com/news/cisa-ci-fortify-isolation-recovery-guidance/819317)
- [CISA 'CI Fortify' Aims to Keep Services Running Under Attack (GovInfoSecurity)](https://www.govinfosecurity.com/cisa-ci-fortify-aims-to-keep-services-running-under-attack-a-31602)
- [CISA Launches CI Fortify to Strengthen Critical Infrastructure Resilience (Manufacturing.net)](https://www.manufacturing.net/cybersecurity/news/22966302/cisa-launches-ci-fortify-to-strengthen-critical-infrastructure-resilience)
- [CISA's 'CI Fortify' Aims to Secure Critical Infrastructure During Conflicts (Security Boulevard)](https://securityboulevard.com/2026/05/cisas-ci-fortify-aims-to-secure-critical-infrastructure-during-conflicts/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5154