CISA Tells Critical Infrastructure Operators to Plan How They'll Talk When the Systems Go Dark

Key points

• CISA, the FBI and international partners released joint guidance on crisis communications during IT and operational technology outages.
• The document tells critical infrastructure operators to plan messaging in advance, not scramble for words mid-incident.
• It sits alongside CISA's CI Fortify initiative, which helps operators isolate and recover industrial control systems during a cyber crisis.
• Operators are told to assume phone and internet services may fail during a major event and to prepare backup ways to reach customers.
• The guidance centres on three core principles: clarity, accountability and transparency.

When a hospital's booking system goes down, or a water utility's controls stop responding, the second crisis is usually the silence that follows. Customers don't know what happened. Staff don't know what to tell them. Rumours move faster than facts.

That gap is what the US Cybersecurity and Infrastructure Security Agency wants critical infrastructure operators to close. In new joint guidance published with the FBI and international partners, CISA lays out how utilities, hospitals and other essential services should communicate with the public during a serious outage.

The document covers outages of both IT systems (the ordinary computer networks that handle billing and records) and operational technology, meaning the industrial control systems that run pumps, power grids and factory lines.

What is CISA actually telling operators to do?

Plan the words before you need them. The guidance argues that clear, timely, accurate messaging has to be drafted and legally cleared before an incident, because there's no time to write it once alarms are going off.

Clarity, accountability and transparency sit at the centre of the advice. Operators should say what they know, admit what they don't, and name who is responsible for updates. Messaging must align with legal duties, law enforcement requests and the security of the ongoing response, so nothing said publicly tips off attackers or damages a criminal investigation.

Why does this matter to ordinary customers?

Because outages ripple. One hospital losing its records system can force ambulances to divert. A payment processor failing can shut tills across a supermarket chain. CISA warns that outages at one organisation can cascade across interconnected systems, increasing public alarm even when the original problem is contained.

When a company you rely on goes quiet, you're more likely to flood helplines that can't cope or share unverified posts on social media. Good crisis messaging isn't corporate spin. It's the difference between a manageable disruption and a panic.

Our coverage of the July wave of attacks on more than 100 water systems showed exactly how fast public alarm builds when operators say nothing: most of those facilities were compromised through an exposed modem, and the silence from several of them lasted days.

What about industrial systems specifically?

CISA points to its CI Fortify initiative, which helps operators prepare to isolate and recover operational technology during a major cyber incident. Isolation means deliberately cutting parts of a network off from other systems to stop an attack spreading.

That defensive move looks, to a customer, exactly like a breakdown. The guidance is direct on this: whenever service availability changes, whether from an attack or from a defensive shutdown, operators must keep telling users what is happening and why.

The telecoms assumption

One line in the guidance stands out. For emergency planning, operators are told to assume that phone and internet services may themselves be disrupted or unreliable during a major event.

If mobile networks are down, a website update helps no one. Plans need backup channels: radio, physical notices, staff on the ground, agreements with local broadcasters. Operators are also told to know, in advance, what kind of communication they should expect from their own suppliers when those suppliers are the ones in trouble.

The guidance carries no penalties. It's a template and a nudge. For the nurse, the commuter, the account holder on the other end of an outage, its success will be measured in one thing: whether the next big incident comes with a straight answer instead of a shrug.