Security teams should assume breach and contain compromise as early as possible, especially in critical infrastructure. The priority is to reduce blast radius by isolating affected systems, segmenting operational environments, and preserving essential services while investigation continues. In water facilities, resilience depends on limiting lateral movement and keeping core operations running even when one site or network segment is impacted.
Why This Matters for Security Teams
When multiple critical infrastructure facilities are affected at once, containment is no longer a local incident response task. It becomes a resilience problem across operational technology, corporate IT, remote access paths, and third-party dependencies. Security teams have to limit spread without taking down essential services, which is why segmentation, isolation, and pre-approved failover paths matter more than perfect forensic completeness. Guidance from CISA cyber threat advisories consistently shows that early, coordinated containment is the difference between a contained site issue and a regional operational event.
The hardest part is that containment choices in critical infrastructure often have operational side effects. Shutting down one environment may protect the enterprise but disrupt treatment, generation, distribution, or safety monitoring if the architecture was not built for graceful degradation. Teams also underestimate how quickly attackers use shared identity, remote management tools, and trusted inter-site links to pivot across facilities. Current guidance suggests treating shared services as potential blast-radius multipliers, not neutral conveniences. In practice, many security teams encounter multi-site compromise only after lateral movement has already crossed the control plane, rather than through intentional boundary enforcement.
How It Works in Practice
Effective containment starts with a clear view of where trust is shared. That means identifying common identity systems, remote access concentrators, engineering workstations, historian links, backup paths, and vendor support channels. Once those dependencies are mapped, teams can apply containment in layers rather than waiting for a single perfect isolation event. For multi-facility incidents, the objective is to stop propagation, preserve minimum safe operation, and keep evidence available for later analysis.
Practically, that usually means:
- Segmenting affected sites from each other and from central management systems.
- Revoking or constraining privileged access, especially shared administrative accounts and remote service credentials.
- Freezing risky automation paths, such as unattended scripts and remote orchestration jobs.
- Switching to manual or local control where the process allows it, while validating safety procedures first.
- Coordinating with OT, engineering, and business continuity leads before making isolation decisions that could interrupt essential services.
Containment should also be informed by attacker tradecraft. Mapping observed behavior to the MITRE ATT&CK Enterprise Matrix helps teams understand whether they are dealing with valid accounts, remote services, or living-off-the-land techniques that will survive simple blocking. Where AI-driven reconnaissance or automated targeting is suspected, the MITRE ATLAS adversarial AI threat matrix is useful for understanding model and agent abuse patterns, especially if AI systems are involved in monitoring or response workflows. NIST control guidance also matters here, particularly the NIST SP 800-53 Rev 5 Security and Privacy Controls baseline for access control, system boundary protection, and incident response coordination.
These controls tend to break down when facilities share flat networks, common domain trust, or centrally managed OT tooling that cannot be safely segmented during an active event.
Common Variations and Edge Cases
Tighter containment often increases operational disruption, requiring organisations to balance safety, service continuity, and investigative speed. That tradeoff becomes sharper in utilities, transport, and manufacturing environments where a local shutdown can cascade into public safety or regulatory issues. Best practice is evolving, but there is no universal standard for how much isolation is enough when several sites are affected simultaneously.
One common edge case is a multi-site incident that looks distributed but is actually driven by a shared identity or management layer. In that situation, isolating only the visibly impacted facility may leave the pivot path intact. Another is the presence of legacy OT equipment that cannot tolerate frequent disconnects or modern authentication controls. In those environments, containment may depend on external enforcement, compensating network controls, and strict operator procedures rather than endpoint actions alone.
Regulatory pressure can also shape response choices. The EU NIS2 Directive increases expectations for incident handling, reporting discipline, and resilience planning, while ENISA Threat Landscape reporting helps teams understand how infrastructure-focused threats are evolving across Europe. In AI-assisted environments, organisations should also watch for agentic tools accelerating incident spread through automation mistakes or compromised tool access, as highlighted in Anthropic’s first AI-orchestrated cyber espionage campaign report. The practical lesson is simple: containment plans must be built for shared dependencies, not just isolated sites.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0, EU-NIS2 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | RS.MI | Multi-site containment is a response mitigation problem. |
| MITRE ATT&CK | T1021 | Remote services are a common cross-facility pivot route. |
| EU-NIS2 | Article 21 | NIS2 requires risk management and resilience planning for critical entities. |
| NIST SP 800-53 Rev 5 | SC-7 | Boundary protection is central to limiting spread between facilities. |
Use RS.MI to drive isolation, suppression, and blast-radius reduction actions during coordinated incidents.
Related resources from NHI Mgmt Group
- How should security teams contain AI-speed attacks once the first exploit lands?
- How should security teams contain agentic AI attacks once execution starts?
- How should security teams harden MFA against code-guessing attacks?
- How should security teams defend enterprise AI systems against jailbreak attacks?
