US CISA directs utilities to plan for insider cyber threats

The Cybersecurity and Infrastructure Security Agency (CISA) issued a directive, named CI Fortify, on May 5 instructing American electric, water and pipeline operators to assume that hostile actors already have access to their control‑system networks. The guidance tells utilities to identify critical customers, such as nearby military bases, and to develop continuity plans that allow isolated operation for weeks or months, including manual fallback procedures. Acting CISA Director Nick Andersen said operators must be able to “isolate vital systems from harm, continue operating in that isolated state.”

CI Fortify follows a series of recent cyber incidents: Iranian‑linked hackers disrupted programmable logic controllers in U.S. critical‑infrastructure sectors, Russian‑linked actors penetrated Poland’s power grid, and a cyber‑induced blackout plunged Caracas into darkness. The new baseline assumption marks a shift from treating large‑scale cyber attacks as a low‑probability risk to treating them as an ongoing, internal threat.