FORTRESS America | Installation cyber recovery
If the base network were wiped tonight, what would you restore from?
Installation cyber recovery comes down to a question every base should answer before a crisis: where is the last clean copy of the systems that keep the power on, the gates controlled, and the cameras recording, and how long does it take to bring them back?
- 01
Microgrid, power, water, and HVAC settings
- 02
Badge database, doors, and schedules
- 03
Video management servers and camera settings
- 04
Switch, firewall, and directory configurations
01 | The operational reality
The night it happens
It is 0300. The gate readers stop accepting badges. The video wall in the security operations center goes dark. The microgrid controller shows setpoints nobody on shift entered. The help desk ticket says "network issue."
This is an illustrative scenario, not an account of a specific incident. The first decisions are real ones. Do you trust the systems in front of you? Do you rebuild them from a backup? And if the intruder has been inside for months, which backup is clean?
Backing up servers is routine. The harder questions are about each control system on the base: where the last known good copy lives, who can reach it, and how long a full restore takes. Those 3 answers decide whether a bad night ends at 0600 or runs into next week.
The question that matters
Who on this installation knows where the last clean copy is, and has anyone timed the restore?
If the answer lives in 1 person's head or on the network that just went down, the base does not have a recovery plan yet.
02 | The warning on record
CISA, NSA, and FBI described this threat in 2024.
On February 7, 2024, CISA, NSA, and FBI, joined by the Department of Energy, EPA, TSA, and partner agencies in Australia, Canada, the United Kingdom, and New Zealand, issued advisory AA24-038A. It said state sponsored actors from the People's Republic of China, known as Volt Typhoon, were positioning themselves on IT networks so they could disrupt or destroy U.S. critical infrastructure systems.
Where
Communications, energy, transportation, and water
The advisory named those 4 sectors, in the continental United States and outside it, including Guam.
How long
At least 5 years in some networks
Volt Typhoon kept access and footholds in some victim IT environments for at least 5 years.
What it could reach
Cameras, controls, and server room cooling
The actors could access camera surveillance systems at critical infrastructure sites and tested access to operational technology with default vendor credentials. The advisory warned the access could be used to manipulate HVAC in server rooms or disrupt energy and water controls.
How it hides
Living off the land
The advisory calls the use of tools already present on a network a hallmark of Volt Typhoon activity. Activity that uses built in tools is hard to tell apart from normal administration.
Those are the same kinds of systems that run a base. UFC 4-010-06 calls them facility related control systems and lists building control systems, utility control systems, electronic security systems, and fire and life safety systems among them. All fall under the Risk Management Framework.
Why it matters now
FORTRESS America asks bases to keep running under any conditions.
The memo calls the program the nation's "insurance policy" and organizes it around 5 pillars: energy independence, supply chain and defense industrial base resilience, a strategic defense reserve, installation hardening and cyber resilience, and resilience in space and spectrum.
- The pillar
- Installation hardening and cyber resilience
- The goal
- A force that can fight and win under any conditions
- What it means for recovery
- A base that can restore its own control systems from a copy it trusts
"A homeland that cannot be starved out, shut down, or cut off."
FORTRESS America memo, September 30, 2026
03 | The inventory
What has to come back, and what a clean copy has to contain
A recovery plan starts with a list. For each system, we write down what a usable copy includes, who owns it, and the questions the installation has to answer before an incident. The owners below are typical. Each base assigns its own.
| System | What a clean copy contains | Typical owner | Answer before an incident |
|---|---|---|---|
| Microgrid and utility controls | Controller configurations, setpoints, control logic, firmware versions, and network settings | Facility engineering | Can the generators and switchgear run in local mode while the controller is rebuilt? |
| Building automation and HVAC | Controller programs, schedules, alarm limits, and the cooling settings for server and communications rooms | Facility engineering | How long can the server room run if cooling control is lost? |
| Access control | Credential database, door and schedule settings, controller configurations, and enrollment records | Installation security | Which gates and doors fail locked, which fail open, and who can override them? |
| Video management | Server configuration, camera inventory and settings, recording and retention policies | Installation security | Which cameras matter first, and where does recording continue while the server is rebuilt? |
| Network and identity | Switch, router, and firewall configurations, directory services, and certificates | Base communications | Can the restore team log in if the directory is the system that was compromised? |
The last row deserves attention. If the restore depends on the same identity system the intruder controls, every copy is within the intruder's reach. That is why the recovery copy needs its own credentials.
04 | Before you trust a backup
5 tests of a clean copy
A backup that exists is a start. A backup you can restore from after a long intrusion has to pass 5 tests. CISA's guidance and the Volt Typhoon advisory support all 5.
- It exists: there is a dated copy for every system on the inventory, including controller configurations that often live only on the controller.
- It is out of reach: the copy sits where credentials from the production network cannot change or delete it. CISA's ransomware guide calls for offline, encrypted backups because attackers look for backups they can reach.
- It is known good: the copy is checked for tampering before anyone restores from it. After years of quiet access, the newest backup may hold the intruder's changes.
- It restores: the team has run a restore drill and timed it. The Volt Typhoon advisory calls for regular backups on OT networks and regular tests of those backup procedures.
- It works without the network: the restore plan exists on paper and offline, along with the steps to run each system locally. The advisory asks organizations to plan how they would operate if they lose access.
The hard truth
The last backup and the last clean backup can be years apart.
Keep enough history, and check it, to reach back past the point where the intruder arrived.
05 | The restore order
Decide what comes back first while the base is still running.
CISA's guidance is to restore from offline, encrypted backups in order of critical services. That order should be written, signed, and drilled before an incident, because 0300 is the wrong time to negotiate it. A common starting point looks like this. Each installation sets its own.
- Isolate
Cut the affected networks off from the recovery copies and from each other.
- Verify
Pick the last copy that passes inspection, using the vault's analysis and the incident timeline.
- Restore by priority
Power and cooling first, then access control and video, then the networks and services that depend on them.
- Validate and return
Check each system against its documented configuration before it goes back into service.
Then measure it. A restore target only means something after a drill shows the team can hit it. We recommend running the drill on the actual systems, or on a staged copy of them, and recording the time for each step.
06 | How we build it
Where Dell Federal and Paragon Micro fit in installation cyber recovery
As a Dell Technologies Federal Platinum Partner and multi-vendor technology provider, we design backup, failover, and recovery around each agency's recovery point and recovery time goals, and we plan for continued operations during a cyber incident as well as the recovery afterward.
The vault
A copy the attacker cannot reach
Dell describes PowerProtect Cyber Recovery as creating an operational air gap: critical data sits in a separately governed vault with its own controls, credentials, and management plane, so recovery stays trusted when production, identity, or backup systems are in doubt.
Outcome to prove: the vault stays intact when the production directory is compromised.
The check
Know which copy is clean
Dell's Cyber Detect software analyzes full content, including files, databases, and virtual machines, to find corruption before a restore, and reports the last known good backup.
Outcome to prove: the team can name the copy it will restore from, with evidence.
The network
Keep control systems apart
Dell PowerSwitch segmentation limits lateral movement between utility controls, security systems, and business IT, with monitored crossing points.
Outcome to prove: an intrusion in business IT cannot reach the controllers directly.
The paperwork
Recovery the authorizing official can see
We support ATO documentation, control mapping, and risk mitigation, so the recovery design shows up in the system's security package.
Outcome to prove: contingency planning controls backed by tested evidence.
Our System Readiness Center is a facility of more than 55,000 square feet, staffed by vetted U.S. citizens, where every configuration step is documented. We can stage the recovery vault, load its configuration, and record the build before it ships, so the base receives a documented baseline with the restore procedure attached.
We do not run the installation's control systems, and our work does not replace the base's own incident response, the authorizing official's decisions, or government acceptance. We help make sure that when the restore is needed, the copy exists, it is clean, and the team has done it before.
Paragon Micro | Dell Federal
Find out where your last clean copy lives.
Send us the control systems on your installation, the networks they sit on, and the restore times your mission needs. We can help design the vault, the restore order, and the drill that proves it works.
Acquisition paths may include ITES-4H, MDA SHIELD, and GSA, depending on scope, eligibility, and ordering rules.
Keep reading
FORTRESS America: what independent bases need from their IT and security systems
Read chapter 10 of our Dell Federal guide for edge operations and cyber recovery, and chapter 15 for how a FORTRESS installation build fits together.
Answers for installation teams
Installation cyber recovery: common questions
What is installation cyber recovery?
It is the plan and the equipment that let a base restore its control systems and networks after a cyberattack. That includes the utility and building controls, access control, video, and the network and identity services they depend on. It covers where clean copies are kept, how they are checked, who restores them, in what order, and how long it takes.
Why is a recent backup not enough?
An intruder who has been inside for months or years may have changed systems before the latest backup was taken. The Volt Typhoon advisory reported access in some networks for at least 5 years. A recovery copy has to be checked for tampering, and enough history has to be kept to reach a point before the intrusion.
Which installation systems need offline copies?
Start with the facility related control systems in UFC 4-010-06: building control systems, utility control systems, electronic security systems, and fire and life safety systems. Add the network devices, directory services, and certificates the restore depends on.
What did the Volt Typhoon advisory recommend about backups?
Among its mitigations, advisory AA24-038A calls for regular data backup procedures on OT networks, regular testing of those procedures, and a resilience plan that covers how to operate if access is lost.
How does a cyber recovery vault differ from a regular backup?
A regular backup system usually shares credentials and management with the production network, so an intruder with administrator access can reach it. Dell describes its PowerProtect Cyber Recovery vault as separately governed, with its own controls, credentials, and management plane, and with analysis to find the last known good copy before a restore.
How does this connect to FORTRESS America?
The FORTRESS America memo of September 30, 2026 names installation hardening and cyber resilience as 1 of its 5 pillars. A base that can restore its own control systems from a trusted copy is better placed to keep running when its networks are attacked.
Reference desk
Sources and further reading
Public sources as reviewed October 22, 2026. Agency guidance and product capabilities change, so confirm current versions before award.
ViewHide 10 sourcesPrimary and supporting references
Cybersecurity and Infrastructure Security Agency, National Security Agency, & Federal Bureau of Investigation. (2024, February 7). PRC state-sponsored actors compromise and maintain persistent access to U.S. critical infrastructure (Advisory AA24-038A). https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
Cybersecurity and Infrastructure Security Agency. (2023, September). #StopRansomware guide. https://www.cisa.gov/stopransomware/ransomware-guide
Dell Technologies. (n.d.). PowerProtect Cyber Recovery solutions. https://www.dell.com/en-us/shop/powerprotect-cyber-recovery/sf/powerprotect-cyber-recovery
Hegseth, P. (2026, September 30). Establishment of FORTRESS America as a Department of War program for the defense of the American homeland [Memorandum]. U.S. Department of War. https://media.defense.gov/2026/Sep/30/2004009303/-1/-1/1/ESTABLISHMENT-OF-FORTRESS-AMERICA-AS-A-DEPARTMENT-OF-WAR-PROGRAM-FOR-THE-DEFENSE-OF-THE-AMERICAN-HOMELAND.PDF
Paragon Micro. (n.d.-a). Dell Federal. https://www.paragonmicro.us/partners/dell-federal/
Paragon Micro. (n.d.-b). Secure integration & staging facility. https://www.paragonmicro.us/about-us/facility/
Paragon Micro. (n.d.-c). Zero trust & cyber resilience for government. https://www.paragonmicro.us/solutions/zero-trust-and-cyber-resilience/
Paragon Micro. (2026a). Dell Federal and Paragon Micro: How the partnership is positioned for FORTRESS America, Project Meridian, and the Autonomous Warfare Command. https://www.paragonmicro.us/dell-federal-paragon-micro-dow-initiatives/
Paragon Micro. (2026b, October 2). FORTRESS America: What independent bases need from their IT and security systems. https://www.paragonmicro.us/fortress-america-installation-it-security/
U.S. Department of Defense. (2023, October 10). Cybersecurity of facility-related control systems (UFC 4-010-06). https://www.wbdg.org/FFC/DOD/UFC/ufc_4_010_06_2023.pdf