For critical infrastructure, the more important question is becoming:
Can we continue delivering a critical service safely when parts of the environment can no longer be trusted?
That is the real test of OT cyber resilience.
The CI Fortify challenge
The Australian Signals Directorate’s (ASD) CI Fortify guidance presents a practical challenge for Australia’s critical-infrastructure sector.
Can you isolate the OT and enabling systems that sustain a critical service – from corporate networks, the internet and third parties – for an extended period while still operating safely?
And, if trust in the environment is lost, can you rebuild those systems from known-good, tested backups, configurations and recovery material quickly enough to continue delivering that service?
More than a network-security question
This is more than an OT network-security question.
It requires organisations to understand:
- Which services are genuinely critical.
- Which OT and enabling systems are essential to delivering them.
- Which dependencies cross OT, IT, cloud, vendor and supply-chain boundaries.
- Where isolation can occur without creating an unacceptable safety or service-continuity outcome.
- Which activities must revert to manual processes when normal integrations are unavailable.
- Whether firmware, configurations, engineering files, licences, spares and recovery procedures are current, accessible and tested.
Backups and segmentation are not resilience on their own
A backup strategy is not a recovery capability until it has been validated against the systems, dependencies and operating conditions that matter.
Likewise, segmentation is not resilience simply because zones and firewalls exist. It becomes resilience when an operator can confidently isolate a compromised zone, preserve safe operation of vital systems, and restore trusted capability without improvising during a crisis.
Have a good week,
Damien Pope
