A Vital System Must Be Isolatable
The July 30 federal public-service announcement describes attacks on internet-facing PLCs used in water operations and reports that operational effects depended in part on the function of the affected device and the ability to switch to manual operations. [1]
Isolation Is Not a Panic Button
A useful isolation plan defines what will be separated, what must remain connected, who can authorize the action, how operators verify the safe state, what communications remain available, and how evidence is preserved. It can range from disabling a single remote-access route to separating an OT zone from enterprise networks. The correct action depends on process safety and continuity, so the decision should be designed before the incident.
Response and Recovery Must Share the Same Operating Model
NIST’s 2026 manufacturing practice guide treats response and recovery as operational-resilience capabilities for ICS environments. It emphasizes planning for cyber incidents that can affect production, safety, and property and describes approaches to minimize downtime and restore operations. [2]
Segmentation Is Valuable When It Can Be Used
CISA’s ransomware guide recommends separating IT and OT and maintaining current network diagrams that show topology, interdependencies, third-party access, and cloud connections. [3]
Decision Rights Matter as Much as Technology
NERC’s CIP-008-7.1 focuses on incident reporting and response planning for Bulk Electric System cyber systems. Critical-infrastructure organizations should not discover during a crisis that cyber teams can recommend isolation but operations teams control the switch, or vice versa. [4]
Engineer for the Consequence, Not Only the Threat
DOE’s Cyber-Informed Engineering program asks engineering teams to consider cyber risk across the system lifecycle. Cyber resilience becomes stronger when engineers can change the consequence, not only when security teams can detect the attacker. [5]
CyberTech Intelligence Perspective
For every vital service, create an Isolation Decision Record. This turns “segment the network” into a tested business capability.
Build the Model Before the Next Incident
Identify the smallest set of systems required to sustain the essential service.
Map every external, enterprise, vendor, and management connection to that set.
Choose graduated isolation points and confirm who can activate each one.
Test the operator workflow with cyber and operations teams together.
Preserve logs and configuration evidence outside the affected trust boundary.
Prove that known-good configurations and backup sources can be restored.
Reopen connectivity in stages with monitoring and an explicit rollback decision.
Standards and Threat Mapping
NIST, CISA, NERC, and DOE approach resilience from different sectors and mandates, but their guidance converges on planned response, segmentation, recoverability, and engineering decisions that preserve safe operations. These sources are used for control context, not as proof that a specific organization is exposed or compliant. [2] [3] [4] [5]
Take the Next Step
Test one question now: if a connected operational system had to be isolated today,
could the business keep running safely? Use the CyberTech Intelligence Resilience
Review to find out.
Visual Decision Architecture
The following decision models convert the campaign thesis into a repeatable sequence for executive review, operational containment, continuity, recovery, and governance. They are CyberTech Intelligence synthesis tools, not claims that every incident follows the same path.
Critical Infrastructure Cyber Attack Path
Figure 1. Critical Infrastructure Cyber Attack Path - From Reachable OT to Verified Recovery
|
Stage |
Operational Meaning |
|---|---|
|
1. Find a reachable path |
An internet-facing OT device, remote-access service, vendor connection, or weakly protected pathway makes operational technology reachable. |
|
2. Gain operational access |
The actor reaches a device or supporting system with enough access to view, change, or disrupt operations. |
|
3. Change trusted state |
Passwords, addresses, configurations, project files, logic, or other trusted settings are changed or misused. |
|
4. Degrade visibility or control |
Operators lose monitoring, control, or confidence and must determine what remains safe to operate. |
|
5. Protect the essential service |
Teams isolate the affected path, preserve evidence, and use approved manual or fallback procedures. |
|
6. Restore and validate |
Teams restore known-good settings and access, verify changes, strengthen monitoring, and stage normal operations. |
Operational Isolation and Recovery Decision Workflow
Figure 2. Operational Isolation and Recovery Decision Workflow
|
Decision Step |
Required Outcome |
|---|---|
|
1. Define the essential service |
Confirm the service, minimum safe state, dependencies, and accountable incident authority. |
|
2. Isolate the risky path |
Separate affected OT and enabling systems at preplanned isolation points without unnecessary service loss. |
|
3. Preserve evidence |
Retain configurations, access logs, network records, change history, vendor activity, and operator observations. |
|
4. Sustain operations |
Use approved manual operations, local control, alternate communications, or other continuity procedures. |
|
5. Restore trust |
Restore known-good configurations, rotate credentials, validate communications and logic, and reconnect in stages. |
|
6. Improve the system |
Close root causes, update architecture and procedures, assign owners, and retest response and recovery. |
Critical Infrastructure Cyber Resilience Maturity Model
Figure 3. Critical Infrastructure Cyber Resilience Maturity Model
|
Maturity |
Operating Pattern |
Leadership Priority |
|---|---|---|
|
Reactive |
Exposure and recovery dependencies emerge during an incident. |
Identify vital services, exposed assets, owners, and isolation options. |
|
Defined |
Policies exist, but IT, OT, vendors, and continuity remain separate. |
Standardize inventory, access, segmentation, monitoring, response, and recovery. |
|
Connected |
Cyber, operations, engineering, safety, vendors, and executives share evidence. |
Use one resilience model around essential-service outcomes. |
|
Measured |
Exposure, access, isolation, recovery tests, and exceptions are measured by service. |
Prioritize investment using operational impact and tested evidence. |
|
Adaptive |
Controls evolve from incidents, exercises, architecture changes, and threat intelligence. |
Scale proven patterns and retest assumptions as dependencies change. |
Governance and Decision Rights
Figure 4. Critical Infrastructure Cyber Resilience Governance Framework
|
Decision Stage |
Accountable Owner |
Required Evidence |
Exit Criteria |
|---|---|---|---|
|
Critical-Service Scope |
Business / Operations Owner |
Essential service, safe state, dependencies, impact tolerance, and fallback method. |
Service priority and continuity requirements approved. |
|
Architecture and Access |
OT / Engineering / Security |
Asset inventory, exposure, remote access, identities, segmentation, vendors, and change controls. |
Material paths are owned and constrained. |
|
Detection and Response |
CISO / Incident Commander |
OT telemetry, network records, change events, escalation criteria, isolation, and communications. |
Detection, escalation, and containment tested. |
|
Continuity and Recovery |
Operations / Engineering Owner |
Manual operations, backups, known-good configurations, recovery sequence, validation, and rollback. |
Return-to-service evidence and authority recorded. |
|
Improvement and Investment |
Executive Risk Committee |
Exercises, incidents, exceptions, corrective actions, regulatory duties, and investments. |
Actions are funded, owned, and closed with evidence. |
CyberTech Intelligence Critical Infrastructure Cyber Resilience Framework™
Eight operating layers connect essential-service purpose to reduced exposure, controlled access, observable operations, reliable isolation, trusted recovery, and evidence-led governance.
Figure 5. CyberTech Intelligence Critical Infrastructure Cyber Resilience Framework™ - Eight-Layer Architecture
|
Layer |
Name |
Operating Requirement |
|---|---|---|
|
01 |
Know |
Identify essential services, OT assets, owners, dependencies, remote connections, vendors, and minimum safe states. |
|
02 |
Reduce Exposure |
Remove unnecessary internet exposure, retire unused pathways, secure gateways, and eliminate insecure defaults. |
|
03 |
Control Access |
Use named identities, strong authentication where feasible, least privilege, time-limited vendor access, and rapid revocation. |
|
04 |
Segment |
Separate business IT, OT zones, safety functions, remote-access paths, and management networks by operational need. |
|
05 |
Observe |
Monitor access, configuration change, network behavior, privileged actions, and service conditions for reconstruction. |
|
06 |
Isolate |
Predefine and test graduated isolation so teams can contain a cyber path without improvising. |
|
07 |
Recover |
Maintain tested backups and known-good configurations, manual alternatives, integrity checks, and staged restoration. |
|
08 |
Govern |
Align cyber, operations, engineering, safety, legal, compliance, vendors, and executives around service continuity. |
Critical Infrastructure Cyber Resilience Readiness Score™
Table. Critical Infrastructure Cyber Resilience Readiness Score™
|
Domain |
Executive Assessment Question |
Ready-State Evidence |
|---|---|---|
|
Asset Visibility |
Can leaders identify OT assets and support systems for each essential service? |
Current inventory, owner, function, criticality, version, dependencies, and review evidence. |
|
Internet Exposure |
Are public-facing OT devices and services known, justified, and minimized? |
Exposure inventory, approved exceptions, secure gateways, rules, and recurring verification. |
|
Remote Access |
Is every remote-access path attributable, approved, monitored, and revocable? |
Named accounts, approved methods, strong authentication where feasible, limits, logs, and revocation tests. |
|
Network Segmentation |
Can compromise in business IT or one OT zone be contained? |
Documented zones, conduits, access rules, third-party paths, diagrams, and isolation tests. |
|
Identity and Privilege |
Do users, services, and vendors have only required operational access? |
Role-based access, unique credentials, privileged controls, reviews, and termination procedures. |
|
OT Monitoring |
Can teams detect and reconstruct unauthorized access or configuration change? |
Network telemetry, device-change records, time synchronization, retention, alerts, and investigation procedures. |
|
Response and Isolation |
Can teams isolate an affected path without unmanaged operational risk? |
Graduated isolation plan, decision rights, test evidence, alternate communications, and preserved forensic data. |
|
Manual Operations and Continuity |
Can essential service continue if remote connectivity or central monitoring is unavailable? |
Manual/local procedures, trained operators, dependency map, alternate communications, and exercises. |
|
Backup and Recovery |
Are configurations, logic, and support data recoverable from trusted copies? |
Versioned backups, change integration, restore tests, known-good baselines, validation, and rollback. |
|
Third-Party Access |
Are vendor connections and shared support paths governed as operational exposure? |
Vendor inventory, contract controls, access windows, monitoring, notification, and offboarding evidence. |
|
Executive Governance |
Are operational cyber risks, exceptions, exercises, duties, and investments owned? |
Risk register, service metrics, exception aging, exercises, corrective-action closure, and executive decisions. |
How to Calculate the Score
Rate each domain from 0 to 4: 0 = absent; 1 = informal; 2 = documented; 3 = implemented and tested; 4 = measured and continuously improved. The maximum is 44 points. Divide the total by 44 and multiply by 100. Suggested bands are Critical (0-24%), Developing (25-49%), Defined (50-69%), Managed (70-84%), and Adaptive (85-100%). The score is an internal readiness aid. It is not a certification, a statement of compliance, or a prediction of incident likelihood.
Continue the Critical Infrastructure Cyber Resilience Journey
Use this asset to review one essential service end to end. Confirm the service owner, vital OT assets, exposed and remote-access paths, identities, segmentation, monitoring, isolation choices, manual operating method, backup and recovery evidence, vendor dependencies, and executive risk decision. CyberTech Intelligence can support a facilitated executive resilience assessment or working session built around organization-specific evidence.
About CyberTech Intelligence
CyberTech Intelligence provides research-led cybersecurity intelligence, executive content, and market engagement programs. This publication is vendor-neutral and intended for education and decision support.
Research and Citation Governance
This asset uses public sources current through August 21, 2026. Incident statements are limited to what the cited organizations published within their stated scope. CyberTech Intelligence does not infer local exposure, customer impact, actor identity where authorities have not attributed an incident, control effectiveness, or incident probability without organization-specific evidence. Framework and scorecard content are CyberTech Intelligence analysis and are presented as decision aids rather than external proof points.
References
[1] Washington State Department of Health, “FBI Public Service Announcement I-073026-PSA,” July 30, 2026. https://doh.wa.gov/sites/default/files/2026-08/PSA-Cybersecurity.pdf Accessed August 21, 2026. Relevance: State-hosted copy of the joint FBI/EPA warning describing attacks on internet-facing water-sector PLCs and reported operational effects.
[2] National Institute of Standards and Technology, “Now Available: NIST SP 1800-41, Responding to and Recovering from a Cyber Attack,” May 21, 2026. https://www.nist.gov/news-events/news/2026/05/now-available-nist-sp-1800-41-responding-and-recovering-cyber-attack Accessed August 21, 2026. Relevance: Provides current manufacturing-sector guidance on ICS response, recovery, and operational resilience.
[3] Cybersecurity and Infrastructure Security Agency, “#StopRansomware Guide,” accessed August 21, 2026. https://www.cisa.gov/stopransomware/ransomware-guide Accessed August 21, 2026. Relevance: Recommends network segmentation, approved remote-access solutions, current network diagrams, and offline backups.
[4] North American Electric Reliability Corporation, “CIP-008-7.1: Cyber Security - Incident Reporting and Response Planning,” modified March 27, 2026. https://www.nerc.com/standards/reliability-standards/cip/cip-008-7.1 Accessed August 21, 2026. Relevance: Defines incident-response requirements intended to mitigate risk to reliable operation of the Bulk Electric System.
[5] U.S. Department of Energy, “Cyber-Informed Engineering,” accessed August 21, 2026. https://www.energy.gov/ceser/cyber-informed-engineering Accessed August 21, 2026. Relevance: Describes engineering questions and lifecycle practices intended to reduce the severity of cyber incidents or digital failures in physical infrastructure.
