Published Tuesday, August 11, 2026 at 10:28 AM PT
BLUF: Five allied governments (CISA, ACSC, FBI, NCSC, Canadian Centre for Cyber Security) published joint guidance (CI Fortify, July 28, 2026) requiring critical infrastructure operators to isolate vital OT systems from corporate networks and maintain service continuity during disconnection. Most enterprise security platforms lack architectural support for this pattern; implementation gap is widespread and unaddressed.
DETAILS
- Guidance document: CI Fortify published jointly July 28, 2026 by CISA, Australian Signals Directorate (ACSC), FBI, UK NCSC, and Canadian Centre for Cyber Security
- Requirement: Critical infrastructure operators must demonstrate ability to isolate vital OT systems from all other networks during active cyber incident while maintaining essential service delivery in disconnected state
- Root gap: Flat network architectures lack pre-positioned segmentation; enterprise security platforms (Zscaler, others) built for console-first models do not natively support OT isolation + continuity patterns
- Scope: Implementation gap appears universal across major enterprise security vendors; no confirmed single-vendor solution exists
- Status: This is published guidance, not an active incident; no breach or attack campaign confirmed in provided material
IMPACT
Critical infrastructure operators (energy, water, communications, transportation) across Five-Eyes jurisdictions now face a compliance requirement they lack tools to satisfy. Time gap between July 2026 publication and typical enterprise procurement/implementation cycles (6–18 months) creates extended window of non-compliance.
RECOMMENDED ACTIONS
- Audit your OT segmentation architecture against CI Fortify requirements (isolate, continue)
- Request technical briefing from your security vendor on OT isolation + disconnected-service-continuity support
- Flag to procurement: evaluate open-source and bespoke OT isolation solutions (commercial platforms insufficient)
- Monitor for exploit campaigns targeting OT/corporate network convergence during this gap period
SOURCES
CI Fortify guidance (July 28, 2026); vendor positioning commentary from Zscaler; incomplete technical details in source material (flagged as truncated). No vendor-specific vulnerabilities confirmed in provided material.
STATUS: Incomplete intel — source material truncated. Monitoring for incident confirmation or vendor-specific vulnerability disclosure.
Recent high-severity events at publish time:
