OT isolation diligence

OT isolation
Continuity plane
Partner oversight
Client-side control
Vital systems

010 / 2026

Recent Briefs asked who owns partner-run identity and access planes — Cisco ISE, NetScaler, BIG-IP APM. Those questions still matter. This week the trust-boundary question moves one layer deeper: the operational technology and enabling systems that keep a site, a plant line, a utility feed, or a partner-run process running when the corporate network is no longer trusted.

The control question is not whether your logo appears on a critical-infrastructure registry. It is whether anyone on the client side can name the vital systems, the partners who touch them, the isolation points that would keep essential services alive for an extended period, and the offline plan that still works when remote vendor access is cut.

That is control before coverage.

What CCCS and its partners actually say

Keep the Canadian news page, the CISA packaging page, and the full joint guide in separate lanes.

On its news page, the Canadian Centre for Cyber Security states that it has joined the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and partners — New Zealand’s NCSC, the United Kingdom’s NCSC, CISA, and the FBI — in releasing guidance on isolating vital operational technology (OT) systems. CCCS’s framing is direct: state-sponsored cyber actors are targeting critical infrastructure for espionage and pre-positioning. CI organisations can strengthen resilience by preparing to isolate vital OT and enabling systems from the Internet and other networks for an extended period, so essential services continue even if corporate networks are compromised. The joint guidance promotes a shift from reactive defence to proactive resilience, using physical isolation to limit threat actors’ access and maintain operational continuity during crises.

CCCS summarises a graduated implementation path:

1. Identify critical systems, networks and customers
2. Identify common levels of criticality and trust
3. Map connections and potential isolation points
4. Build effective separation and isolation points

CCCS points Canadian readers to the full joint publication, Advice for isolating vital systems, and encourages Canadian cyber operators and leadership in CI sectors to initiate onboarding with the agency at contact@cyber.gc.ca for a streamlined point of contact for relevant guidance and support.

CISA packages the same joint material under CI Fortify – Advice for isolating vital systems, with a publish date of 28 July 2026. Use that date as the clock for this Brief. CISA’s page is a packaging and distribution surface; the operational detail lives in the joint guide.

The full joint guide, hosted by ASD’s ACSC under the CI Fortify program (first published / last updated 28 July 2026), is where the diligence language gets concrete. Among the points that matter for a principal’s oversight file:

• Identify the minimum systems and networks required to deliver the critical service; identify dependent critical customers and service targets; group hosts into segments and zones with common criticality and threat exposure.
• Map every interconnection worth isolating: non-critical corporate systems, vendor remote access (routine and emergency — including consultants, contractors, and managed-service workforces), untrusted networks including the internet, cloud / “private cloud” offerings, and peer critical networks. Record transit types (carrier, radio, mobile, satellite, Wi-Fi) and protections such as encryption. Capture owners, third-party providers, information-flow type, criticality, and RPO/RTO targets. Keep architectural diagrams, gateway docs, firewall/router/VPN config, and routine plus emergency contacts current.
• Physical isolation is the preferred end-state: no connectivity or shared active infrastructure between vital and non-vital systems. Planned physical separation is a prerequisite. Organisations must be able to operate in isolation for an extended period, accepting that isolation will trigger manual processes and interrupt system-to-system communication.
• Where complete physical isolation is not operationally feasible (internet-facing services, geographically dispersed sites, unavoidable carrier links), strengthen and secure OT boundaries; use dedicated communications paths where possible; apply strong encryption over untrusted or shared links, implemented on trusted boundary devices — not encryption built into OT devices for carrier links. Treat carrier-provided service as untrusted.
• Administrative controls — VLANs, MPLS, IP access lists, route blocking, routing black holes — are framed as interim or minimally effective segregation on the path to physical and/or cryptographic isolation. They are not a long-term substitute for a fully segregated operations network. MPLS does not provide assurance of segregation by default; where used across security domains, cryptographic isolation on the OT-boundary router is required. VLANs are for same-security-domain administrative segregation, not as a permanent stand-in for physical separation of vital OT.
• Reduce OT / non-OT dependencies that would break isolation: shared switching/routing, shared hypervisors and hosts, shared SAN/NAS, corporate AD/DNS/DHCP, PKI, time sync from corporate or internet sources, shared backup services. Supporting systems such as UPS, backup generation, cooling, and physical security should be managed from the most critical networks.
• Build a graduated isolation plan with pre-defined triggers aligned to incident response — while keeping total isolation of the most vital systems as the target state.
• Test isolation plans regularly; testing a single vital system or subset may miss dependencies. Store a secure offline (hard-copy) version of the plans. After isolation, verify effectiveness (routing tables, flow monitoring, management-plane security so administrative controls cannot be quietly defeated).

None of that is a Canadian CVE alert serial. Do not treat CI Fortify as AV26-xxx. Lead with CCCS’s news packaging for Canadian readers, CISA’s 28 July 2026 resource page for the U.S. distribution stamp, and the ASD-hosted joint guide for the technical path.

Why this matters for Alberta principals and Canadian mid-market

Many Alberta and Canadian mid-market firms are not designated critical-infrastructure operators in the federal sense. They still inherit OT and enabling systems through energy-adjacent operations, utilities-facing contracts, industrial mid-market sites, building and process controls, or integrators and MSPs who remote into the gear that keeps continuity real. The plant historian, the BMS, the SCADA segment a partner “looks after,” the vendor VPN that never quite left the change log — those are continuity trust boundaries whether or not a board slide says “OT program.”

The transferable lesson is the same family as RMM partner diligence, third-party ID vendor diligence, and the access-plane Briefs: third parties inside the trust boundary, client-side standards, written ownership. If the only answer to “can we isolate vital systems for an extended period?” is a monitoring dashboard or a partner’s reassurance email, the client is renting hope.

Alberta money often sits next to partner-run operational continuity — not always inside a regulated CI designation. Principals who fund energy services, industrial mid-market operations, or utilities-facing delivery still need a written map of vital systems, isolation points, and who owns the offline plan when corporate IT is the compromised plane. That is diligence, not theatre.

A calm competitor note, then back to work: the regional MSSP pitch often sells “more SOC.” Forged-CS’s lane is client-side control of the continuity boundary — risk architecture and partner oversight — not another rented monitoring layer.

The control questions

Answer these in writing before the next integrator or MSP status call.

Which vital OT and enabling systems support the services the firm cannot afford to lose — named systems, named networks, named owners on the client side?

Which partners, integrators, contractors, and managed-service workforces hold routine or emergency remote access into those systems — named org, named path, named emergency contacts?

Where are the documented isolation points between vital and non-vital networks, and what is the graduated sequence (with triggers) that gets to total isolation of the most vital systems?

Is the current segregation physical, cryptographic, or interim administrative (VLAN / MPLS / ACL)? Who owns the dated plan to move off interim controls where full physical isolation is the stated end-state — or to harden OT boundaries where physical isolation is not feasible?

Have isolation plans been tested beyond a tabletop for a single segment? Where is the offline hard-copy plan stored?

If corporate IT, identity, or the partner remote-access path is compromised, who owns offline / manual operation for the critical service for an extended period — and what dependencies (power, cooling, fuel, chemicals, vendor SLA priority) were pre-worked with peers?

Who on the client side owns the continuity-plane standard the same way finance owns payment-destination changes and the MSP standard owns remote-helpdesk tools?

Forged-CS’s lane here is advisory: map the continuity trust boundary around partner-run OT and enabling systems, diligence the partners who touch that plane, and set the oversight standard from the client’s side of the table. We do not isolate plant systems. We do not sell OT engineering, SCADA integration, or field control-system work. We do not run a 24/7 SOC or an MDR stack. We do not operate as an MSP or a network integrator. Where regulated investigative or technical field work is required under Alberta or other applicable law, that work belongs with vetted licensed partners. Oversight stays with the client.

Client-side diligence that actually moves risk

Inventory vital systems and the partners who touch them. Ask every integrator, MSP, and internal operations owner for a written list of OT and enabling systems required for the critical service, plus every remote-access path (routine and emergency). Include vendor jump hosts, cloud management planes, and “temporary” contractor VPN that never expired. You cannot oversee what you have not mapped. Pair this with security risk assessments when the file needs a structured control review — still advisory, still client-owned.

Map connections and isolation points as facts, not adjectives. Require diagrams and config excerpts for interconnects to corporate IT, internet, carrier links, peer networks, and cloud. Demand named isolation points and a graduated plan with pre-defined triggers. Treat “we have VLANs” as an interim statement with an owner and a dated next step — not as closure. The joint guide is explicit: administrative controls are not the long-term substitute for physical or cryptographic isolation of vital OT.

Demand test evidence and offline continuity ownership. Ask when isolation was last tested beyond a single segment; ask where the hard-copy plan lives; ask who runs the plant, the line, or the critical service when remote vendor access is intentionally cut for an extended period. Prefer partners who can describe that sequence in concrete process language.

Separate client-side standard from rented monitoring coverage. More tickets in a SOC queue do not equal written ownership of isolation points, dependency reduction, or manual operation. Tie this Brief to the adjacent control set: ISE identity plane, NetScaler access plane, BIG-IP APM, RMM, third-party ID vendors, and control before coverage. See also /intelligence and /services/cybersecurity.

Where Canadian CI operators want a direct line to the Cyber Centre, CCCS’s own invitation stands: initiate onboarding at contact@cyber.gc.ca. That is their channel, not a Forged-CS product.

What this Brief is not

This is not a claim that every Alberta mid-market firm is regulated critical infrastructure. It is not an Alberta or Canadian OT breach census. It is not a claim that Forged-CS isolates plant systems, runs OT field engineering, or operates SOC/MDR. It is not legal advice about CI designation thresholds. It is not a rewrite of Brief 009 (Cisco ISE) or any live edge-CVE Brief. It is decision-ready diligence for Alberta and Canadian principals who inherit partner-run vital systems and want isolation and continuity under client-side control — with licensed partners where field work requires it, and with oversight kept where it belongs.

Control before coverage

If the next partner call cannot name the vital systems, the isolation points, the test evidence, and who owns offline operation when corporate networks are compromised, you are already negotiating from behind. Inventory the continuity plane. Demand mapped connections and graduated isolation with triggers. Treat VLANs and MPLS as interim facts with owners. Own the offline plan as a dated client-side standard.

Then decide what tools or partners you actually need.

Forged-CS is the client-side control layer — risk architecture and partner oversight, not more coverage.

— Hassan Sukhera | Forged-CS | forged-cs.com

FAQs

Does this guidance mean every Alberta firm must physically air-gap OT tomorrow?

No. CCCS and partners describe a graduated path toward isolation capability, with physical isolation as the preferred end-state for vital OT and enabling systems. Where complete physical isolation is not feasible, the joint guide emphasises stronger OT boundaries and cryptographic controls over untrusted links. The diligence ask is written ownership of the path, the isolation points, and the offline plan — not a slogan about overnight air gaps.

What should an Alberta principal ask their integrator or MSP first?

Require a written list of vital OT and enabling systems; every remote-access path (routine and emergency); documented isolation points and a graduated isolation sequence with triggers; whether current segregation is physical, cryptographic, or interim administrative; date of last isolation test beyond a single segment; location of the offline hard-copy plan; and a named owner for extended offline / manual operation.

Does Forged-CS isolate plant systems or replace OT engineers?

No. Forged-CS provides advisory risk architecture and partner oversight. We do not isolate plant systems, do not sell OT/SCADA field engineering, do not operate as an MSP or network integrator, and do not run SOC/MDR. Regulated field work, where required, is scoped through vetted licensed partners under applicable law.

Is there a CCCS AV26 or AL26 alert number for this OT guidance?

No verified CCCS alert serial applies to this material at draft time. Lead with CCCS’s joint-guidance news page, CISA’s CI Fortify resource page (28 Jul 2026), and the ASD-hosted joint guide. Do not invent an AV26/AL26 serial for CI Fortify.

How does this differ from buying more monitoring or “more SOC”?

Monitoring coverage can report symptoms. Isolation diligence asks whether vital systems can keep essential services running when corporate networks are compromised — mapped connections, isolation points, tested plans, offline ownership. That is client-side control of the continuity trust boundary, not a larger ticket queue.