ASD to critical infrastructure ops: be ready to isolate systems for three months

The Australian Signals Directorate (ASD) has released detailed technical guidance instructing critical infrastructure operators on how to fully separate operational technology and "vital enabling" systems from the outside world when crisis or conflict strikes.

Its revised CI Fortify-Advice for isolating vital systems, to be released today, sets a three-month target on how long an operator should be able to run its essential services in a state of complete disconnection from other systems and from the internet.

The new guidance follows a 12-month consultation with the industry.

The revision comes against a backdrop of a continually challenging threat environment, in which state-sponsored espionage and ordinary cybercrime are increasingly blurring together.

"Sometimes cyber-attacks are blending both criminal and geopolitical objectives," ASD's assistant director-general for cyber uplift Heidi Hutchison told iTnews.

Hutchison pointed to attackers' growing use of artificial intelligence (AI) and machine learning (ML) to automate and scale their operations.

"Authoritarian regimes are demonstrating a growing willingness to destroy critical infrastructure, to impede decision-making, and to damage war-fighting capabilities and sow discord," she said.

"We saw campaigns attributed to groups such as Volt Typhoon and Salt Typhoon that demonstrated clear intent to pre-position within critical systems ahead of disruption," Hutchison added.

Asked if the ASD advice meant full "air gapping" for isolation, Hutchison confirmed that it does.

"Yes, segmentation," Hutchison said, describing a state of being able to "fully disconnect from external network connectivity, whether or not that's connectivity to the corporate environment or the IT environment, and especially from the internet."

Full isolation is not the initial response, however.

"It's actually probably the last measure of resilience," Hutchison said.

Instead, ASD suggests a graduated plan that steadily reduces exposure to external networks before an operator needs to fully "pull up the drawbridge", as Hutchison put it. 

Vital systems versus business systems

Segmentation and isolation is recommended not only for a core OT system but also for "vital enabling systems ... that are critical for the continued running of [the] OT [system]," Hutchison said.

For the latter, critical infrastructure operators will need to accurately delineate systems that connect to the core OT system as either "vital" or "business".

For operators covered by the Security of Critical Infrastructure (SoCI) Act, it's anticipated that much of this delineation is already contained within their critical infrastructure risk management program (CIRMP) plans.

Still, Hutchison agreed that distinguishing between vital and business systems that connect to the OT system could be challenging.

"There are potentially vital enabling systems that are sitting within the corporate network or within other parts of external connectivity that are critical for the continued running of OT," Hutchison said.

"One of the challenges businesses will have is understanding what a vital enabling system is versus what is a business enabling system, which may be considered vital in their minds, but not necessarily vital for the water to still flow or the energy to still run," Hutchison said.

Hutchison added that ASD is developing separate guidance aimed at executives and boards to help them identify the difference and build business continuity plans around it.

The three-month isolation target figure is designed to force that conversation.

"You might be able to disconnect [the OT system] for a week or two [from] a billing system, without too much of a detrimental impact on your business, but three months will [have an impact]," Hutchison said.

"By putting that three-month timeframe on, it is really encouraging businesses to do that work, but [also] if that three month were to turn into six months, or if there was something like a very serious cyber incident that
really impacted the ability for the business to re-establish their corporate networks, or if there's a crisis or conflict situation that's going on for longer, the three-month period gives businesses a time to build more viable, ongoing business continuity plans."

Shared dependencies undermine isolation 

OT encompasses supervisory control and data acquisition (SCADA) and other industrial control systems and the safety interlocks that keep a substation or a water plant running.

ASD's document, sighted by iTnews, lists a set of shared dependencies that can quietly undermine isolation even when an operator thinks its OT is properly segmented.

This could be shared routing and switching infrastructure, common virtualisation and storage platforms, Active Directory, DNS and DHCP, and digital certificate services.

Even time synchronisation services such as Network Time Protocol (NTP) are included in the document as a coupling between systems.

A recent real-world example of that could create a vulnerability is Telstra's nationwide outage on July 8 2026 which interrupted calls, data and Triple Zero emergency calls for millions of users, along with EFTPOS payments and Victoria's V/Line regional trains.

Historically, OT was kept off the internet entirely, and connected to nothing beyond its own control room, a fact that Hutchison pointed to as the root of the problem.

"These environments are not originally designed for cyber security," she said.

"They're designed for reliability and availability and safety, and not necessarily resilience against modern cyber threats and adversarial activity," Hutchison said.

Efficiency gains from connecting OT to corporate networks and the internet, for remote monitoring and vendor support among other things, are what has opened up these environments, however.

Attacked by Russia, Ukraine offers a real-world example of OT isolation, although it is one of improvisation rather than a rehearsed plan.

Ukrainian engineers manually isolated substations during Russia's 2015 and 2016 grid attacks, in what the Atlantic Council called "analogue resilience" while under active attack, but not exercising a plan built and tested in advance.

In comparison, ASD's plan involves steps such as identifying vital systems and networks to deliver critical services.

Critical customers should also be identified, which could be military infrastructure and lifeline services, among other measures, and to create and test the isolation plan.

Source: ASD

The example ASD provides is of a fictitious electricity transmission company that moves through five stages: cutting remote workers' access to OT first, then on-site remote access, then all links between non-OT and OT systems, then lower-priority connections to peer utilities, before isolating OT completely.

REDSPICE lessons

The new guidance is part of a joint technical document co-sealed with the United States' Cybersecurity and Infrastructure Security Agency (CISA).

It is drawn from lessons taken from ASD's Critical Infrastructure Uplift program, a three-year effort funded under the $10 billion REDSPICE that gave the agency direct visibility into a wide range of OT environments.

While laying out the guidance, ASD has no enforcement powers, as it is not a regulator. Hutchison said it would be up to Home Affairs to decide what, if anything, becomes mandatory.

Hutchison acknowledged that meeting the segmentation and isolation guidance would likely entail additional costs for infrastructure providers.

"There will need to be some investment into understanding what's required, and potentially making changes to the architecture of systems," Hutchison said.

Hutchison added that publishing the guidance now is designed to feed into multi-year investment cycles, giving operators a documented basis to build isolation capability into future planning that is already under way.