CI Fortify and the End of Siloed Asset Management

The Regulator Just Changed the Game

On May 5, 2026, CISA announced CI Fortify — a directive calling on critical infrastructure owners and operators to prepare for geopolitical conflict scenarios in which operational technology networks are actively targeted while communications infrastructure is simultaneously degraded.

The announcement is not yet binding regulation. But in Washington's regulatory vocabulary, "prepare for" reliably becomes "demonstrate compliance with" within twelve to eighteen months. Boards, executives, and legal teams in the energy, water, transit, and industrial sectors are already taking note.

Buried in the guidance is an assumption that many operators cannot yet satisfy: that you have a coherent, unified picture of every OT asset you operate — what it is, where it sits in your network, its current health, and its criticality to adjacent assets if it fails.

For most organisations running mixed infrastructure portfolios, that assumption is broken before you even open the EAM console.

Two Systems, One Problem

Asset-intensive industries rarely operate clean portfolios. A water utility manages a network of pipelines, pumping stations, and treatment plants. A transit authority runs track infrastructure and maintenance depots. An energy company operates grid transmission lines and generation facilities. The physical reality is mixed — linear assets woven through space, and discrete assets sitting at nodes in that network.

The software industry's response has been to sell two separate systems: one built for linear assets (GIS-native, network-topology-aware, designed around spatial relationships and cascade analysis), and one built for discrete assets (hierarchy-structured, OEE-focused, designed around parent-child failure modes and ISO 14224 taxonomies).

The result is a split that makes operational sense to nobody. When a pipeline segment degrades and takes a pumping station offline, the event lives in the linear EAM. The downstream impact on the treatment plant — a discrete asset — lives somewhere else. No single system can reason across that boundary. A technician, an operations manager, or an AI agent working from one system is, by definition, working blind.

CI Fortify exposes this gap precisely because it asks operators to model what happens when things go wrong across the full asset estate — not just within a category.

What Network-Aware Reasoning Actually Means

Linear asset management has long relied on GIS to give context to physical location. But location alone is not intelligence. The capability that matters in a pressure scenario — regulatory or operational — is network topology reasoning: understanding which assets are connected to which, how failure propagates through a dependency graph, and which intervention point stops the cascade.

This is qualitatively different from the reasoning that applies to a discrete asset. A pump in a manufacturing plant fails in the context of a parent-child hierarchy: the pump belongs to a unit, the unit belongs to a line, the line belongs to a facility. Failure propagates upward. The maintenance response is organised around that hierarchy — ISO 14224 failure coding, OEE impact, spare parts tied to the equipment class.

Both models are correct. They describe different physical realities. The error is forcing one model to describe both, or running two disconnected systems and calling it integration.

Agentic AI Makes the Gap Worse — Unless the Foundation Is Right

Agentic AI is arriving in EAM faster than most vendors expected. Gartner projected that 40% of enterprise applications would include task-specific AI agents by end of 2026, up from under 5% in 2025. In asset management, that means agents that monitor sensor feeds, schedule work orders, route crews, and flag emerging risks without waiting to be asked.

The promise is real. Machine learning models applied to historical condition data and live telemetry can now forecast equipment failures six to twelve months in advance with accuracy exceeding 85%. Applied to a discrete asset management context, agents can catch developing faults in rotating equipment weeks before failures propagate.

But an AI agent is only as coherent as the data model it reasons over. An agent trained on linear asset data cannot reason about the plant at the end of the pipeline. An agent trained on discrete asset hierarchies cannot model how a grid fault propagates across fifty kilometres of transmission line. Bolting a chatbot onto a siloed EAM and calling it "AI" does not solve the underlying problem — it makes it more visible.

The agentic platform underneath the agents has to understand both asset types natively. That means graph-based reasoning for linear networks and hierarchy-based reasoning for equipment — not as separate modules that hand off between systems, but as a unified model that lets a single agent reason across the boundary.

Audit-Ready by Default

CI Fortify and the broader trend toward OT asset inventory requirements also raise the question of accountability. When an AI agent recommends taking a pipeline segment offline for preventive maintenance, or escalates an anomaly on a treatment plant turbine, the regulator — and the incident investigation team — will eventually ask: on what basis?

This is where the decision log matters as much as the decision. Every prediction, every recommendation, and every automated action needs to be traceable to the data inputs, the model version, and the confidence threshold that produced it. Audit readiness is not a reporting feature — it is a design requirement for the underlying platform.

Organisations that deploy AI agents on top of systems that cannot produce that log will find themselves exposed in exactly the situations CI Fortify was written to address.

The Mixed Portfolio Is the Norm, Not the Exception

There is a tendency in the EAM market to treat mixed portfolios as an edge case — unusual organisations that happen to operate both kinds of assets. In practice, they are the majority. Most utilities, transit authorities, energy companies, and industrial conglomerates operate linear and discrete assets in combination. The organisations running a pure portfolio of one type are the exceptions.

Understanding the full scope of linear asset management starts with acknowledging that the network and the node are not separate problems. The pipeline and the pumping station are part of one operational reality. Managing them on one platform, with one AI reasoning engine that understands both, is not a luxury feature — it is the minimum viable response to what regulators are now asking for.

---

Curious how UniEAM handles both? Request a demo.