US and Australia Publish Joint Playbook for Cutting Critical Infrastructure Off From Cyber Attack
New guidance tells power plants, water utilities, and other essential services how to keep running even when their networks are under attack or must be disconnected entirely.
Key points
- The United States and Australia jointly released guidance telling critical-infrastructure operators how to isolate operational technology systems during a cyber attack.
- The document focuses on OT, meaning the computers and control systems that physically run equipment such as pumps, valves, and power grids, as distinct from ordinary office IT.
- It covers both the isolation steps themselves and how to keep essential services running for an extended period without normal network connections.
- No specific incident triggered the release, but ransomware attacks on industrial targets have risen sharply over the past three years.
What did the two governments actually publish?
The US and Australia released a joint advisory telling operators of critical infrastructure, think electricity grids, water treatment plants, and gas pipelines, exactly how to cut their control systems off from outside networks when a cyber attack begins, then keep those systems running alone.
The guidance centres on OT, short for operational technology. OT is the hardware and software that directly controls physical processes: the computers that open a dam gate, raise water pressure, or route electricity. When ransomware, which is malicious software that locks files and demands payment to restore access, hits an OT network, the consequences reach beyond lost data. They can mean taps running dry or hospital generators going dark.
The document lays out steps for "network isolation", which means deliberately disconnecting a facility's control systems from the broader internet and corporate networks so attackers cannot spread further or send commands. It then addresses how a site can continue operating in that isolated state for a prolonged stretch, because simply pulling the plug is not an option when the alternative is a city without clean water.
Why does this matter right now?
Ransomware gangs have increasingly shifted attention toward industrial targets. Attacks on critical infrastructure are not just about extortion money; they create public-safety pressure that operators argue forces faster payment. SecurityWeek noted the guidance specifically addresses this pressure point by giving sites a credible plan to operate without paying.
Several prominent ransomware groups, including ones operating under the Ransomware-as-a-Service model, where criminal developers rent their attack tools to other criminals in exchange for a cut of ransoms, have listed water authorities, energy firms, and transport operators on their public leak sites in recent years.
| Sector | Why OT isolation matters |
|---|---|
| Water and wastewater | Treatment chemicals controlled by OT; wrong doses harm public health |
| Electricity generation | Grid-control systems; outages cascade across hospitals and homes |
| Oil and gas pipelines | Pressure and valve systems; safety risk if tampered with |
| Manufacturing | Production lines; ransomware can halt output for weeks |
The guidance does not name a single triggering incident. Instead it functions as a standing instruction manual that facility managers can rehearse before an attack arrives.
What should ordinary people take from this?
If you live near a water treatment plant or rely on a regional power grid, you will not notice anything from this guidance directly. What it means in practice is that the operators responsible for keeping your taps and lights working now have an official, tested checklist for the moment attackers try to hold those services hostage.
If your area ever does experience a utility disruption tied to a cyber attack, the usual advice applies: keep a few days of bottled water on hand, know where your circuit breaker is, and follow guidance from local emergency services rather than social media.
