CI Fortify – Designing Critical Infrastructure to Endure

Australian Critical Infrastructure operators are increasingly being asked to demonstrate more than strong cyber controls or regulatory alignment. The expectation has shifted toward showing how essential services would continue under sustained, constrained, or uncertain conditions.

CI Fortify sits in this space. CI Fortify originates from the Australian Signals Directorate (ASD) as part of its broader uplift guidance to Critical Infrastructure operators. It is not a product, a certification, or a reactionary framework for when things go wrong. It is a way of thinking about resilience as an intentional design choice - one that enables organisations to protect critical capabilities through deliberate separation and prioritisation.

At its heart, CI Fortify is about business control: understanding systems, dependencies, and decision points well enough to act deliberately when conditions deteriorate.

Resilience as an Active Protective Measure

Resilience is often positioned as what follows failure. CI Fortify approaches it differently. The ability to intentionally constrain parts of the business, isolate environments, or operate in a reduced but controlled state can itself be a protective action.

In some situations, preserving critical outcomes may require limiting non‑essential functions. This is where Business Continuity Planning (BCP) moves beyond documentation and becomes an operational tool - enabling organisations to decide what must continue, what can pause, and how separation is executed safely.

CI Fortify supports this decision-making by encouraging clarity rather than optimism.

The 90 Day Endurance Lens

Guidance associated with CI Fortify frequently references a planning horizon where Critical Infrastructure operators should be capable of operating in isolation forup to 90 days.

This is not a prediction, nor an assumption of inevitable failure. It is a design lens that exposes dependency. When organisations plan for extended isolation, questions emerge quickly:

What capabilities are truly critical? Which systems rely on external connectivity, cloud identity, or vendor access? How would operations adapt if those dependencies were constrained for weeks, not hours?

Designing for a 90 day scenario forces organisations to confront where resilience is engineered and where it is assumed.

The OT Reality

For Operational Technology environments - transport, energy, water, utilities - resilience is inseparable from safety and service continuity. Many OT environments were designed for availability and integration, not prolonged autonomy.

CI Fortify does not argue against integration. It asks whether organisations understand how that integration behaves under stress, and whether it can be selectively constrained to protect essential services.

This requires deliberate architectural choices: validated segmentation, localised access control, recovery processes that function without cloud dependency, and operational procedures that support constrained modes of operation.

Why CI Fortify Matters

Australian CI operators face legacy technology, lean specialist teams, regulatory scrutiny, and heightened geopolitical uncertainty. Boards and executives are accountable not only for preventing incidents, but for ensuring continuity when conditions are no longer normal.

CI Fortify provides a nationally aligned framework for understanding where organisations are resilient, where they are fragile, and where deliberate separation may be the most effective form of protection.

It does not assume failure. It does not prescribe a single response. Instead, it supports a simple but demanding question:

If conditions change, does the organisation know what it would protect first, how it would protect it, and how long it could endure?

Designing for that answer is what CI Fortify is really about.