Network Isolation Procedures
This guide provides step-by-step instructions for isolating security zones during a cyber incident, with dependency maps showing which systems can safely operate disconnected and what pre-checks are required before each isolation action. Isolation procedures must be documented in the SCSRP per IACS UR E26 §4.4.3.
Isolation is the cyber equivalent of closing watertight doors. If a CBS is infected or compromised, the goal is to prevent lateral movement to other zones — particularly from IT or crew networks toward the OT core. There are two methods: Soft Isolation (via switch or firewall CLI) and Hard Isolation (physical cable removal). The correct method depends on whether the management interface is still accessible.
Before any isolation action: Confirm the operational impact with the Master or duty officer. Isolation affects monitoring and control capabilities. The wrong isolation sequence can make the vessel’s situation worse, not better. Follow the pre-action checks in the table below — every time, without exception.
Step 1 — Pre-isolation checks
Complete these checks before executing any isolation. They take less than two minutes and prevent isolation from creating a secondary safety problem.
Method 1 — Soft isolation (via firewall or managed switch)
This is the preferred method. It preserves the management interface so the ETO retains visibility and control of the network during the incident. Use this first whenever the management interface is accessible.
Emergency CLI commands — Cisco IOS / HPE ProCurve
# Isolate a single infected device — shut down the port it is connected tointerface GigabitEthernet1/0/12
shutdown
# Isolate an entire VLAN from the rest of the network
interface Vlan10
shutdown
# Sever the link between IT and OT zones at the core switch (the “Golden Cable” in software)
interface Port-Channel 1
shutdown
# Verify the interface is down before moving on
show interface GigabitEthernet1/0/12
# Expected output: GigabitEthernet1/0/12 is administratively down
After soft isolation: Confirm the affected device can no longer ping the OT gateway. If it still can, the VLAN configuration may not match the network diagram — escalate to shore-side IT support immediately.
Method 2 — Hard isolation (physical cable removal)
Use hard isolation when the management interface is unresponsive — common during active ransomware, DDoS, or a frozen switch. Physical disconnection is always available regardless of software state.
The Golden Cable
Identify the uplink cable connecting the iDMZ to the OT core switch. This cable is the single point that bridges the IT and OT environments. Unplugging it air-gaps all OT machinery from the rest of the vessel network in one action. Label this cable clearly in the ECR — it must be findable in the dark under stress.
The VSAT power-down
If the attack is originating from shore via a compromised remote access session, power down the SATCOM modem or the main firewall WAN interface. This kills the external command-and-control link. Confirm with the Master before doing this — it also cuts weather updates, email, and AIS data to the shore operator.
Zone-by-zone isolation reference
Before pulling any cable or shutting down any interface, confirm the operational impact and pre-action check for that specific zone. This table is the ETO’s field reference — it should be printed and posted in the ECR as part of the vessel’s SCSRP.
Step 3 — Post-isolation verification
After each isolation action, verify the isolation was effective before moving to the next action. An isolation that did not work wastes time and provides false confidence.
show interface [interface-id] on the switch. Expected status: administratively down. If it shows up, the shutdown command did not apply.E26 §4.4.3 compliance point
Every isolation action must be logged in the Cyber Incident Log with the exact time, the zone isolated, the method used, the pre-action check completed, and the post-isolation verification result. This log is the primary evidence that the crew followed a structured response — Class surveyors will request it at the next annual survey.
The network isolation procedure must also be included by name in the Incident Response Plan section of the SCSRP. A procedure that exists in practice but is not referenced in the SCSRP does not satisfy §4.4.3 — both the procedure and its reference in the plan are required.
The specific regulatory requirements this playbook satisfies. Use these references when preparing for Class survey or responding to a surveyor's checklist.
