CI Fortify: Isolation, Recovery and a Minimum Viable America with CISA's Matt Rogers

If communications fail and operational technology is damaged during a cyber attack, critical infrastructure operators may have to keep essential services running without internet access, outside assistance or readily available replacement hardware.

Matt Rogers of the Cybersecurity and Infrastructure Security Agency (CISA) explains how CI Fortify prepares water, energy and transportation systems for that scenario. He and Frank Cilluffo discuss operating through compromise, uncovering hidden dependencies and testing whether critical systems can isolate and recover before a crisis arrives.

Main Topics

• CI Fortify and emergency planning
• Operating through compromise
• Communications outages
• Hidden IT/OT dependencies
• Isolation and functional testing
• OT sovereignty
• Secure by Design for OT
• Public service and technical talent

Key Quotes

"If there is another Colonial Pipeline type incident again... how do we make sure that their incentive structure isn't I go from 100 to 0, it's that I go from 100 to 30? 40, where that... X is defense critical infrastructure, it's health and public safety, because we just can't afford to go to zero for our minimal services. We need sort of a minimum viable America." — Matt Rogers

"Nobody is coming to save you unless you've prearranged to be saved, which is a bit grim. But in a communications outage, you can't call for help." — Matt Rogers

"The more you tell me you have an air gap, the less I believe you... It's just really unsustainable for a lot of organizations.." — Matt Rogers

"Security doesn't have to be frictional and hard. The goal should be to design security such that you are kind of the well-lit path, the easy path, the default state is the secure thing to do." — Matt Rogers

Links and Resources

• CISA: CI Fortify
• CISA: Secure Connectivity Principles for Operational Technology
• CISA: ​​Barriers to Secure OT Communication: Why Johnny Can't Authenticate​
• CISA: Secure by Design

About the Guest:

Matthew Rogers, PhD is an Industrial Control Systems cybersecurity expert in CISA's Office of the Technical Director and leads the agency's Secure by Design initiative for Operational Technology. He earned his bachelor's degree in software engineering from Auburn University and later completed a DPhil in Cyber Security at the University of Oxford as a Rhodes Scholar, focusing on securing legacy OT networks in vehicles. Before joining CISA, Rogers was a founding engineer at Shift5 and worked on broader ICS cybersecurity efforts at MITRE. His work at CISA focuses on translating ICS research and development into practical capabilities for critical infrastructure.