TL;DR: CISA’s CI Fortify guidance reflects a shift from preventing compromise to sustaining safe operations in degraded OT environments, where adversaries may already be inside and isolation, local authentication, and containment must continue working under disruption, according to Xage Security. Per Xage Security, resilience now depends on enforcing identity and least privilege inside the environment, not just perimeter defence and recovery.
At a glance
What this is: This is an analysis of CISA’s CI Fortify guidance and the argument that critical infrastructure security must prioritise operational resilience, local control, and containment when OT environments are already compromised.
Why it matters: It matters because IAM, PAM, and NHI governance cannot stop at centralized access control when disconnected or degraded industrial environments still need identity enforcement, segmentation, and privileged access control.
Context
Critical infrastructure security is moving beyond the assumption that defenders can always block intrusion before it affects operations. In OT environments, the more realistic problem is how to preserve safe service delivery when compromise, isolation, and degraded dependencies all happen at once.
CI Fortify reflects that shift by treating resilience as an operational control problem, not only a detection or recovery problem. The article’s central claim is that perimeter models fail when trusted paths, remote access, and centralised authentication cannot be relied on in a crisis.
Key questions
A: They should assume central identity services may be unavailable and design local enforcement that still validates users, services, and privileged actions inside the segment. The goal is not perfect feature parity with the enterprise stack. It is safe, constrained operation under degraded conditions, with preplanned fallback controls and clear limits on who can act.
Q: Why do trusted industrial access paths create such high operational risk?
A: Because attackers often do not need to bypass perimeter controls when legitimate pathways already exist. Vendor access, shared trust, and remote connections can become the route for lateral movement if they are not tightly constrained. In critical infrastructure, the risk is not only compromise, but the loss of containment when those pathways remain over-trusted.
Q: What breaks when space systems depend on centralized authentication?
A: Centralized authentication breaks when connectivity is delayed, intermittent, or unavailable. Space platforms may lose the ability to validate users, devices, or autonomous agents at the moment access is needed. That can block mission tasks, delay emergency response, and force operators to choose between availability and control. Resilient ICAM shifts verification and authorization closer to the asset itself.
Q: Should resilience planning focus more on recovery or on containment in critical infrastructure?
A: Containment should come first. Recovery matters, but critical infrastructure often cannot pause long enough to rebuild before the attacker causes operational impact. The safer model is to maintain local control, reduce blast radius, and preserve essential service delivery while security teams investigate and remediate.
Technical breakdown
Why centralized authentication fails in isolated OT segments
Industrial environments often depend on centralized identity services for authentication, policy, and access enforcement. That model becomes fragile when network segmentation or incident containment disconnects OT sites from the systems that normally issue or validate access. In a degraded environment, the question is not whether a user or service can authenticate in the ideal state, but whether the control plane itself remains available enough to keep operations safe. Local enforcement, pre-established trust anchors, and constrained fallback modes become critical because OT teams cannot always wait for enterprise identity services to recover before restoring control.
Practical implication: Design isolated OT segments to preserve local authentication and access decisions when central identity services are unavailable.
How lateral movement persists through trusted industrial pathways
The article’s threat model is not a classic perimeter breach. It assumes adversaries may already be inside the environment and can move through legitimate paths such as vendor links, remote access channels, shared credentials, and unmanaged trust relationships. In OT, these pathways often exist for operational necessity, which makes them attractive for stealthy persistence and lateral movement. This is where identity and segmentation intersect: if access is broadly trusted across sites, operators may lose the ability to contain an intruder before operational impact spreads. The control problem is therefore containment of trusted access, not only blocking unauthorised entry.
Practical implication: Map all trusted industrial access paths and constrain them so compromise in one zone cannot propagate across the environment.
Why continuity in degraded states is a resilience control, not a recovery afterthought
CI Fortify’s emphasis on continuing operations during disruption reframes resilience as an always-on control requirement. If organisations only plan for restoration after an incident, they assume the process can pause safely, which is often false for utilities, transportation, energy, and manufacturing. Operational continuity in a degraded state requires pre-engineered segmentation, distributed policy enforcement, and access controls that survive disconnection. That is a governance issue as much as an architecture issue, because it determines whether the business can keep running safely while security teams investigate, isolate, and remediate. See the Cyber Resilience Guide.
Practical implication: Test whether critical services can remain safe and controlled when OT sites are partially disconnected from enterprise systems.
Threat narrative
Attacker objective: The attacker aims to preserve access inside critical operational environments long enough to disrupt service, expand influence, or force defenders into unsafe shutdown decisions.
- Entry occurs through legitimate industrial pathways such as remote access, third-party connectivity, or already-embedded adversary presence rather than a noisy perimeter breach.
- Credentialed movement then continues through trusted access and centralized dependencies that cannot enforce policy once portions of the OT environment are isolated.
- Escalation and spread happen when operators lose local visibility and control, allowing the adversary to retain operational access while response teams are forced into containment.
- Impact is operational disruption, not just data loss, because critical services must keep running safely even while the environment is compromised.
Breaches seen in the wild
- Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Resilience is now an identity control problem as much as an availability problem. When OT segments are isolated, the organisation does not only need the network to survive. It needs authentication, authorisation, and access enforcement to continue inside the segment itself. That makes local identity control part of operational continuity rather than a separate security concern. Practitioners should treat disconnected access governance as a core resilience requirement, not a contingency feature.
Industrial compromise is often a governance failure in trusted access, not a failure of perimeter defence. The article correctly points to third-party links, shared trust, and compromised credentials as the routes attackers use most effectively in OT. That makes the real gap a standing assumption that internal trust remains safe after compromise. Trust-path containment becomes the decisive question, because once a trusted channel is abused, perimeter-centric controls arrive too late. Practitioners should re-evaluate every implicit trust path inside OT.
CI Fortify validates the move from recovery-first thinking to containment-first architecture. For critical infrastructure, the question is no longer whether an incident can be reversed quickly enough, but whether the environment can keep operating safely while part of it is compromised. That shift aligns with zero trust in industrial settings and with the reality that adversaries may already be present when isolation begins. Practitioners should build for safe operation under compromise, not only post-incident restoration.
Distributed identity enforcement is the named design pattern this article makes unavoidable. Central authentication and access control cannot be the only enforcement point in environments that may disconnect from enterprise services during crisis conditions. The article’s core implication is that operational resilience depends on policy enforcement surviving segmentation, degradation, and vendor isolation. Practitioners should design distributed control planes that still validate who and what can act when the broader environment is unavailable.
Read next: Cyber Resilience Guide
What this signals
Containment-first design is becoming the default resilience posture for industrial environments. The practical shift is away from assuming perfect prevention and toward building environments that can survive while compromised. For practitioners, that means distributed enforcement, segment-level control, and service continuity under degraded communications are becoming baseline requirements, not advanced options.
Distributed identity enforcement: critical infrastructure teams need access controls that keep working when the enterprise control plane does not. The next programme question is whether local OT policy enforcement can stand alone long enough to preserve safety, visibility, and least privilege during a partial outage or isolation event.
For practitioners
- Map OT trust dependencies end to end Inventory vendor links, remote access routes, shared accounts, and enterprise dependencies that would fail or become unsafe during isolation.
- Validate local authentication during disconnection Test whether critical sites can continue enforcing identity, access decisions, and least privilege when central services are unreachable.
- Constrain trusted pathways before an incident Reduce standing trust across OT, IT, cloud, and edge networks so a compromised path cannot be used for lateral movement.
- Exercise degraded-state operations Run resilience drills that assume partial isolation, degraded communications, and unavailable third parties while preserving safe service delivery.
- Review privileged access for crisis containment Ensure elevated access can still be governed locally when normal enterprise controls are disrupted, especially for operators and third parties.
Key takeaways
- Critical infrastructure security is now judged by whether operations can stay safe during compromise, not only by how well compromise is prevented.
- The article’s main warning is that centralized identity and access control can fail exactly when isolated OT environments need it most.
- Containment, distributed enforcement, and degraded-state testing are the controls that determine whether a crisis becomes an outage or a managed disruption.
Related NHI Mgmt Group resources: Cyber Resilience Guide · Vulnerability Management Guide · Sisense breach 2024
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on maintaining access enforcement when OT segments are isolated or degraded. |
| PR.IR-01 — Incident Response Plan is Executed | CI Fortify stresses continuity and containment during active disruption, not only post-incident recovery. | |
| Recommendation — Enforce PR.AA-05 so local OT access decisions remain constrained when central systems are unavailable. Use PR.IR-01 to test whether incident procedures preserve safe operation under partial isolation. | ||
| MITRE ATT&CK | TA0008;TA0006 — Lateral Movement; Credential Access | The article describes adversaries moving through trusted pathways and credentials inside critical infrastructure. |
| Recommendation — Map trusted-path exposure to TA0006 and TA0008, then narrow the access routes attackers can reuse. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust for OT segmentation — Zero Trust Architecture | The article explicitly argues for zero trust enforcement inside segmented industrial environments. |
| Recommendation — Apply zero trust principles so segmentation does not remove the ability to authenticate and authorise locally. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Cloud-linked industrial environments still depend on IAM continuity across disconnected or hybrid operational sites. |
| Recommendation — Use IAM controls to keep identity enforcement intact across OT, cloud, and enterprise dependencies. | ||
Key terms
- Operational Resilience: Operational resilience is the ability to keep critical services running or recover them quickly after disruption. In identity-led environments, that depends on authentication services, privilege management, and recovery procedures that can be tested under realistic failure conditions.
- Distributed Identity: An identity model where trust is established across multiple issuers, verifiers, and relying parties rather than through one central directory alone. It can improve portability, but only if interoperability and governance are strong enough to preserve assurance across domains.
- Degraded-State Operations: A mode of running essential systems when communications, dependencies, or supporting controls are partially unavailable. The environment may be compromised or isolated, but business and safety functions must continue under tighter constraints. Practitioners use this concept to test whether access controls and segmentation still work during partial failure.
- Trust-Path Containment: The practice of limiting how far an attacker can move through legitimate, pre-existing access paths such as vendor links, remote access, or shared trust relationships. In critical infrastructure, containment must focus on trusted pathways because those routes often remain available even when perimeter defences have failed.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management in the context of operational access control. It is suited to practitioners who need to connect identity governance to broader security and resilience programmes.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org