CISA's New Guidance Tells Operators How to Communicate While OT Systems Are Isolated

CISA, the FBI, and international partners published joint guidance on September 2, 2026 directing service providers and critical infrastructure operators to treat crisis communication as a planned discipline, separate from technical containment and recovery. ¹

What Happened  

CISA, along with the FBI and international partners, released “Communicating Under Pressure: Best Practices for Service Providers.” The guidance describes how organizations should plan and execute clear, timely, accurate, and audience-appropriate communications during IT and operational technology outages, whether the cause is a cyberattack, human error, equipment failure, or a natural hazard.¹

The document sets seven specific actions for outage communication:  

1. Lead with confirmed facts and scope 

2. Tailor updates to each audience 

3. State what is known and unknown 

4. Explain operational impact and required customer action 

5. Avoid vague language and speculation 

6. Provide frequent time-stamped updates 

7. Align messaging with legal, regulatory, and law enforcement requirements. 

The guidance also specifies the structures that organizations should build before a crisis, not during one:  

• A cross-functional incident team spanning engineering, communications, legal, and customer support with primary and alternate contacts 

• A designated incident lead and spokesperson with predefined approval paths 

• A government relations lead where government stakeholders are affected 

• Backup communication methods, including out-of-band channels, established and regularly tested in advance. 

This new guidance is published under CISA's CI Fortify initiative, which helps critical infrastructure organizations prepare to isolate and recover vital OT systems during a major cyber incident. CISA states directly that isolation, whether from an outage or used deliberately as a defensive strategy, requires its own transparent and ongoing communication plan, and that critical infrastructure operators should assume their telecommunications services may be disrupted or unreliable during an incident. 

Why This Matters

CISA has formally separated two disciplines that operators have historically treated as one problem. Isolating a compromised OT system is a technical containment decision. Communicating through that isolation, to employees, regulators, the public, and partners, is a distinct operational requirement with its own plan, its own team, and its own tested infrastructure. An operator can execute a clean technical isolation and still fail this guidance if no one planned how the incident team talks to each other, or to the outside world, while the primary network is the thing being contained. 

The backup communication requirement is explicit: SMS and phone trees, radios, out-of-band communications, and conference bridges, established and tested before an incident, not assembled during one. CISA is telling operators that a plan which assumes the primary network stays available is not a plan. 

This is the communications layer the the original CI Fortify OT isolation blueprint left open. The earlier guidance told operators how to isolate vital systems. It did not solve how command staff, field personnel, and affected customers stay in contact once isolation happens. This new guidance is CISA's own answer to that gap, in federal language operators will now be measured against. 

How BlackBerry Fits the Guidance 

Recommended Actions Based on the Guidance 

• Pair any OT or IT isolation plan with a tested backup communication plan. The guidance treats these as one requirement, not two separate exercises. 

• Inventory which incident-team communications currently depend on the same network being isolated. That dependency is the gap this guidance is written to close. 

• Test the backup channel and the isolation plan together, on the same cadence. A channel that has not been exercised alongside the isolation event is not a tested channel. 

• Assign and document predefined roles, incident lead, communications lead, spokesperson, and government relations, before an incident, not during one. 

BlackBerry Perspective 

CISA has now validated, in its own words, what BlackBerry has argued since CI Fortify launched: OT isolation and stakeholder communication are separate disciplines that both require deliberate planning and infrastructure that does not depend on the network being contained. 

The guidance lists seven communication actions and the pre-crisis structures operators need to build. It does not name the channel that satisfies the backup communication requirement or the system that produces the coordination record the incident team structure implies. BlackBerry AtHoc and BlackBerry SecuSUITE are built for exactly that gap: coordination and out-of-band communication that continue operating independently of the infrastructure being isolated. 

Citations:

1.  Communicating Under Pressure: Best Practices for Service Providers (Cybersecurity and Infrastructure Security Agency, in collaboration with the Federal Bureau of Investigation and international partners, September 1, 2026).