What happens when critical infrastructure operators stay online and connected during a cyber crisis without practicing isolation procedures?

When operators have not rehearsed isolation, a cyber crisis can spread from an intrusion into operational disruption, making it harder to contain the threat or keep essential services running. The article’s warning is that critical infrastructure should be ready to behave like a disaster response environment, where control systems can be separated from the internet and operations continue in a constrained mode.

Why Staying Connected During a Cyber Crisis Makes Containment Harder

When critical infrastructure operators remain online during a cyber crisis, they preserve the very pathways an intruder may use to move, observe, and disrupt. That keeps the environment “live” for the attacker and often delays decisive containment. In operational settings, the first security objective is not perfect convenience, it is preventing the event from crossing from IT compromise into service interruption.

That is why isolation procedures matter as a rehearsed operating mode, not an improvised last resort. In critical services, separation can be the difference between a contained incident and a cascading operational failure, especially when remote connectivity, shared credentials, or centrally managed tooling are still available to the compromised environment. CISA Industrial Control Systems resources repeatedly emphasise that operational environments need distinct recovery and continuity assumptions from ordinary enterprise IT.

What Isolation Procedures Change in Practice

Isolation procedures force a deliberate shift from normal connectivity to constrained operations. That usually means breaking unnecessary external links, restricting remote administration, and maintaining only the minimal control paths needed to keep essential functions running safely. The point is not to “turn everything off”, it is to reduce the blast radius while preserving enough control to manage the process under abnormal conditions.

Practically, this changes the operator’s response options. A team that has rehearsed isolation can separate affected segments, validate which systems still trust each other, and continue essential monitoring from a safer boundary. A team that has not rehearsed it often discovers too late that remote access, shared management planes, or vendor dependencies are still entangled with the affected environment. CISA cyber threat advisories and ENISA Threat Landscape both show how ransomware and infrastructure-targeted intrusions can exploit that entanglement to widen the impact.

In a mature response posture, isolation is paired with continuity planning. That means defining which functions must survive, which connections can be cut, and how operators will communicate when normal enterprise channels are no longer trusted. It also means accepting that some convenience, visibility, and speed will be sacrificed to preserve operational safety.

Why the Failure Mode Becomes So Severe in Critical Infrastructure

Critical infrastructure is especially sensitive because availability, safety, and control integrity are tightly coupled. If operators stay connected after compromise, the attacker may inherit trusted paths into supervisory systems, maintenance accounts, or shared infrastructure services. Even without full control, that access can disrupt alarms, delay response, or interfere with recovery actions.

Isolation failures also create a trust problem. The more systems remain interconnected, the harder it becomes to know which signals are reliable, which credentials are compromised, and which responses might amplify the incident. That is why incident response in these environments increasingly resembles disaster response, where systems may need to operate in a degraded but controlled state until trust can be re-established. The Colonial Pipeline ransomware attack is a strong reminder that a single exposed access path can force an operator into a high-impact shutdown decision.

For teams wanting a broader evidence base on how real breaches progress from access to disruption, The 52 NHI Breaches Report is useful because it shows how compromised credentials and overtrusted access frequently become the mechanism that expands an incident once containment is delayed.

Risk and Threat Considerations

Staying online during a cyber crisis increases the chance that the attacker can continue using live trust relationships, which can turn a manageable intrusion into an operational outage. The risk is not only data loss, but loss of confidence in control, monitoring, and remote access at the exact moment those functions matter most.

Failure mechanism: Unrehearsed operators leave normal connectivity in place, so the compromised environment retains paths for lateral movement, command delivery, or remote manipulation while defenders are still trying to understand scope.

Impact: The incident can spread beyond the initial foothold, forcing broader shutdowns, slowing restoration, and increasing the chance that essential services must run in a degraded or unsafe state.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	RC.RP-01 — Recovery Planning	Isolation procedures are part of restoring trusted operations after a cyber crisis.
	PR.IR-01 — Network Resilience	Network separation and fallback connectivity directly affect containment and continuity.
	RS.MA-01 — Incident Management	Containment decisions depend on coordinated incident handling during live operations.
Recommendation — Rehearse isolation and recovery so essential functions can continue in a constrained mode. Design network segmentation and fallback paths to support crisis isolation. Define incident actions that can cut trust paths without losing operational control.
NIST SP 800-53 Rev 5	CP-2 — Contingency Plan	Crisis isolation requires preplanned continuity and degraded-mode operations.
	SC-7 — Boundary Protection	Isolation is fundamentally about restricting communications across trust boundaries.
	IR-4 — Incident Handling	The scenario is about containment and operational response during active compromise.
Recommendation — Document contingency procedures for isolated operation of critical services. Enforce boundary controls that can separate critical systems during an incident. Build incident handling playbooks that include rapid isolation decisions.
CIS Controls v8	CIS-12 — Network Infrastructure Management	Network segmentation and controlled connectivity are central to isolation procedures.
	CIS-17 — Incident Response Management	The question focuses on what happens when response procedures are not rehearsed.
Recommendation — Segment critical networks so they can be isolated without losing control. Test isolation steps in incident response exercises before a real crisis.

Practitioner Guidance

What to prioritise: Treat isolation as an operational capability, not just a cyber task. The first decision is whether the environment can be safely segmented while essential services remain under manual or local control.

What to verify: Confirm that teams can sever external connectivity, restrict privileged remote access, and maintain a trusted fallback path for monitoring and command authority. If those steps cannot be executed quickly, the organisation is not ready for crisis isolation.

Common mistake: Assuming that “staying connected” improves resilience. In a cyber crisis, ongoing connectivity often improves the attacker’s position faster than it improves the operator’s situational awareness.

Practitioner takeaway: The real test is whether essential operations can continue after trust is deliberately reduced. If isolation has not been rehearsed, the organisation is likely to discover its dependencies during the crisis, when the cost of discovery is highest.