TLDR: October is Cybersecurity Awareness Month, a good time to test whether your resilience plans hold up. CI Fortify is the proof point: it asks critical infrastructure operators to show they can keep essential services running if and when they are compromised. For GRC teams, that means documenting isolation and recovery plans, mapping every third-party dependency, and testing the plans with evidence. Though not a binding regulation today, CI Fortify sets a federal baseline that boards, insurers, and examiners will likely use to judge your resilience after an incident.
What is CI Fortify?
On May 5, 2026, CISA announced CI Fortify, an initiative to help critical infrastructure maintain a baseline of continuity during a cyberattack. It centers on two capabilities: isolation and recovery.
The planning assumptions are blunt: operators should assume telecommunications, third-party vendors, and other dependencies may be unreliable. They should also assume adversaries may already have a foothold in operational technology networks.
The initiative responds to pre-positioning campaigns by nation-state actors such as Volt Typhoon. These actors are not only stealing data; they are positioning themselves to disrupt operations.
Why Does CI Fortify Matter Beyond Critical Infrastructure Operators?
Critical infrastructure spans energy, water, transportation, healthcare, and communications. Any organization that sells to, depends on, or insures those sectors may face similar expectations.
Vendors are a direct example. If a customer must run in isolation for weeks, every cloud tool and remote service in its stack becomes a continuity question. Your own resilience evidence may soon appear in customer security reviews.
Boards also take note of federal baselines. Once CISA publishes what “good” looks like, a gap between that baseline and your GRC program becomes a governance finding.
What Does Isolation Require From a GRC Program?
Isolation is the ability to proactively disconnect from third-party and business networks while sustaining essential operations. CISA’s guidance breaks it into four steps and each one maps to a GRC deliverable:
- Set a service target. Identify critical customers and define the minimum service level for each.
- Deliverable: a service-target register with an owner and approval date
- Rank vital assets. Determine which assets must keep running in isolation.
- Deliverable: a criticality-ranked inventory with mapped dependencies.
- Update continuity plans. Make sure operations can continue without vendor support, remote monitoring, or cloud tools
- Deliverable: an isolation-ready plan with manual procedures, an owner, and a review date
- Track communications. Follow CISA and sector agency alerts, and set up backup communication channels.
- Deliverable: a communications register covering sources, recipients, and backup channels
What Does Recovery Require From a GRC Program?
Recovery covers the scenario where an adversary has already compromised OT components. CISA’s framework has three elements: documented systems with backups, practiced replacement and manual procedures, and a review of recovery dependencies, such as licensing servers or business network connections, that may be unavailable in a crisis.
The second element is the hardest to evidence. CISA recommends tabletop exercises and drills, not just written plans. An auditor will ask for the exercise record, the findings, and the remediation that followed.
Hidden dependencies cause the most damage. A recovery procedure that needs a licensing server or business network connection fails exactly when you need it.
How Do You Map the Third-Party and System Dependencies CI Fortify Assumes Will Fail?
You need a single model that links assets, controls, vendors, and risks, so one question can trace a failure across all of them. Which critical services lose a vendor if that vendor goes offline? Which controls depend on that vendor’s tooling?
LogicGate’s no-code graph database platform connects controls, assets, and risks into a multi-hop view of how they relate. This lets teams trace a dependency chain without rigid, siloed tables. Pair it with third-party risk management to see which vendors sit behind each critical service.
Humans still own the decisions. LogicGate’s platform surfaces the dependency chain, and your team sets the service targets, approves the isolation plan, and signs off on recovery tests.
How Does CI Fortify Connect to Frameworks You Already Use?
CI Fortify does not replace existing frameworks. It sharpens how you apply them. The recover and respond functions of the NIST Cybersecurity Framework align with CISA’s isolation and recovery objectives.
If you already track controls against NIST CSF, map CI Fortify’s steps to the controls you have. The gaps become your remediation backlog. LogicGate’s Controls compliance workflows can then keep the evidence current instead of rebuilding it before each audit.
Teams in regulated sectors can start with their industry view. LogicGate’s energy and utilities page shows how risk programs apply there.
What Should GRC Leaders Do in the Next 90 Days?
Start with the work that surfaces the biggest gaps fastest. Each action below produces evidence you can show a board or regulator.
- Inventory dependencies. List every vendor, cloud service, and remote connection behind your critical services.
- Set service targets. Define the minimum acceptable service level for each critical customer or function.
- Review continuity plans against an isolation scenario. Test whether operations survive weeks without vendor support.
- Run a tabletop exercise. Include operations, IT, security, legal, and executive leadership.
- Record and track findings. Assign owners and due dates for every gap the exercise exposes.
LogicGate’s operational resilience solution helps you turn these steps into evidence you can show a board or regulator.
See Your Dependency Chain Before an Incident Does
Map your assets, controls, and vendors in one connected model. Request a demo to see how LogicGate’s platform supports operational resilience evidence.
Frequently Asked Questions
Is CI Fortify a Regulation?
No. CI Fortify is guidance and operational support from CISA, not binding regulation today. It still sets a federal baseline that regulators, insurers, and courts may reference after an incident.
Who Should Follow CI Fortify?
It is written for critical infrastructure owners and operators, especially those with OT networks. Vendors, insurers, and service providers to those sectors should treat it as a signal of customer expectations.
What Are the Two Objectives of CI Fortify?
Isolation and recovery. Isolation means disconnecting from third-party and business networks while sustaining essential services. Recovery means restoring operations after OT components are compromised.
What Does CI Fortify Assume About Third-Party Connections?
It assumes they will be unreliable and that attackers may already have some access to OT networks. Plans should hold up when telecommunications, vendors, and cloud tools are unavailable.
How Can GRC Teams Prove They Are Ready?
Keep current records of dependencies, service targets, plan reviews, and exercise results. Evidence of testing and remediation carries more weight than a plan that was never exercised.
