Can Your Team Still Coordinate When Your Systems Are Isolated?

Since July 27, 2026, water and wastewater utilities in at least seven US states have reported intrusions into their control systems to the FBI. Some saw degraded operations, including pressure loss and flooding. In Minnesota alone, more than 30 water systems were hit in one coordinated attack and some switched to manual operations.

In France this past October, a cyberattack on the refrigeration systems of hundreds of supermarkets reportedly drove temperatures as high as 50°C (122°F), spoiling food and starting fires at several stores. The Paris prosecutor has opened an investigation.

In both cases, operators found out in real time whether their people could keep working when normal systems stopped behaving. Governments now want operators to make sure that critical systems can continue operating when operational technologies are isolated and offline.

Regulators Now Expect Operators to Be Ready to Isolate and Keep Running

This July, Australia led the development of joint guidance called CI Fortify, issued with the US, UK, and Canada, telling critical infrastructure operators to be ready to isolate vital operational technology and keep running that way. The guidance is voluntary, but the mandates around it are not. The US, Canada, the UK, the EU, and Australia have each advanced cyber rules this year that change what operators must be able to do during a breach.

Read side by side, they make the same demands. Assume a breach and keep operating: plan for a compromise and keep essential services running through it. Put accountability above the IT team: in the EU, Australia, and Canada, responsibility reaches the board or directors. Prove a tested capability on the regulator's clock: every one of the five sets a reporting window.

Why the Breakout Window Has Compressed to Minutes

CrowdStrike's 2026 Global Threat Report puts the average eCrime breakout time, from initial access to lateral movement, at 29 minutes in 2025, 65 percent faster than in 2024. The fastest observed breakout time took 27 seconds. The report also finds that AI-enabled adversaries increased their operations by 89 percent year over year, and says AI is accelerating attackers and compressing defenders' time to respond. At that speed, detect-and-evict is one layer of the response, not the whole plan. 

What Isolation Does to the People Running the Response

Isolation is a technical decision. What it does to your people is a separate problem, and most plans stop at the technical part.

When you isolate a network, the tools your people use to run the response often go down with it. Email carries field reports and status updates; when it goes, real-time field intelligence goes with it. Ticketing gives command one view of who is safe and what is being worked; when it goes, so does personnel visibility across the response. Directory and single sign-on are how outside agencies authenticate into your environment; when they go down, inter-agency sharing stops entirely, not because of a decision but because the access path is gone. Desk phones and softphones narrow your reach, but they are rarely the only casualty.

The org chart does not change during an incident. The tools your organization uses to run it can all disappear at once. 

What Your Team Must Be Able to Answer Before an Incident

Before an incident, your team should be able to answer:

1. Could incident command reach your field staff?

2. Could you verify who is on a call without your directory and single sign-on?

3. Could you share information with an outside agency?

4. Could you file your incident report inside the regulator's window?

If any answer is "not sure," that is the gap requiring attention.

How BlackBerry AtHoc Closes Each Gap When Systems Are Isolated

BlackBerry^® AtHoc^® provides out-of-band communications for crisis response and continuity of operations, running on sovereign, private, or on-premises infrastructure so it does not depend on the network that is isolated. If the enterprise network goes down, BlackBerry AtHoc doesn’t go down with it.

The platform maps directly to the gaps above. Geo-tagged reports, photos, and GPS status from the field arrive in a shared dashboard that gives command a single view of alerts, maps, and personnel safety. It reaches people by phone, text, and email as well as through sirens and digital signs. Permission-based networks, built with outside agencies before an incident, let information move across jurisdictions without waiting for someone to establish an ad hoc connection under pressure.

BlackBerry^® SecuSUITE^® keeps voice and messaging off the carrier network when that network is the threat vector. BlackBerry^® Unified Endpoint Management maintains endpoint policies and device access even when the directory is unreachable. Together they close the two capability gaps isolation creates that BlackBerry AtHoc does not directly address: carrier-network exposure and endpoint control. 

Find Out How to Operate through Isolation. Join the Webinar.

On November 12, BlackBerry^® Secure Communications is hosting a webinar on operating through isolation. We cover what the five jurisdictions expect of operators, what goes down when you isolate, and how your people coordinate when the tools are gone. We close with where BlackBerry AtHoc fits.

You will leave with:

• A clear view of what the US, Canada, the UK, the EU, and Australia expect of operators, and where they agree

• A map of what goes down with your network, and which coordination capability each loss breaks

• A readiness checklist you can take to your next board or executive briefing

When: Thursday, November 12, 2026, at 11:00 a.m. ET, 4:00 p.m. GMT, 5:00 p.m. CET

Length: 45 minutes including live Q&A

Speakers: John de Boer, Vice President, Government Relations BlackBerry | Christine Gadsby, Chief Security Advisor, BlackBerry | David Wiseman, Vice President of Secure Communications, BlackBerry

Recording: Every registrant receives the recording

Register for the Webinar