Functional isolation is the practice of separating system functions so that a failure, compromise, or unsafe state in one part does not easily spread to other parts. In cyber-physical systems, this can mean keeping control logic, safety functions, operator interfaces, and communications paths distinct enough that one corrupted component cannot directly trigger all others. It is a core resilience concept in critical infrastructure because attackers often try to move from an exposed digital foothold into broader operational control.
In defense, functional isolation appears in architectures that use independent safety controllers, segmented networks, manual overrides, and non-digital backup paths. These measures reduce the blast radius of an intrusion: if malware reaches one subsystem, it should not automatically disable protection, alter sensor readings everywhere, or cause a chain reaction of failures. In attacks, the lack of functional isolation is what makes a single compromise so dangerous; in secure-by-design engineering, it is one of the main ways to contain it.