Brilliant at the Basics: IT Top 10
- Home
- Brilliant at the Basics
- IT Top 10
All 10 IT practices, with first steps and evidence.
The 10 IT Practices, in Plain Language
The DoW CIO's Brilliant at the Basics campaign names 10 IT practices covering office IT, email, cloud services and the people who run them. For each one below: what DoW asks, what it means for a small or mid-size defense supplier, what to do first, the evidence to keep, related NIST SP 800-171 requirements, and how Peripolos helps.
Not sure where you stand? Rate all 20 practices in five minutes with the free Basics Scorecard, or see the OT Top 10.
On this page
- IT-1 · Phishing-Resistant Multi-Factor Authentication
- IT-2 · Comprehensive Asset Inventory Management
- IT-3 · Strategic Technical Debt Reduction
- IT-4 · Flexible Technology Stack
- IT-5 · Logical Segmentation to Limit Adversary Lateral Movement
- IT-6 · Risk-Based Vulnerability Management
- IT-7 · Integrate Security Early in the Development Lifecycle
- IT-8 · Secure AI Adoption and Data Protection
- IT-9 · Resilient Backup and Disaster Recovery Architecture
- IT-10 · Continuous Technical Workforce Readiness
Phishing-Resistant Multi-Factor Authentication
What DoW asks: Use MFA that can't be phished, and move off SMS codes and push approvals.
Most breaches at defense suppliers start with a stolen password or an approved push prompt. For a small shop that means hardware security keys or passkeys for email, remote access and every admin account, starting with the people who handle CUI.
Start this week
- Turn on MFA for every admin and email account now
- Issue FIDO2 keys or passkeys to admins and remote users
- Turn off SMS and voice codes once keys are enrolled
Evidence to keep
- MFA or conditional-access policy export
- List of enrolled users and key types
- Exceptions, each with an end date
Related NIST SP 800-171 Rev 2: 3.5.3, 3.5.4
How Peripolos helps: Identity (IT Foundation)
Comprehensive Asset Inventory Management
What DoW asks: Keep an inventory of hardware, software, identities and data that stays current.
You can't protect a laptop or cloud app you don't know about. Start with what touches CUI: the PCs that open drawings, the file shares, the email tenant and the accounts that reach them.
Start this week
- Export devices from your endpoint or MDM tool
- Run the Peripolos collector on CUI machines
- List cloud apps, with an owner for each
Evidence to keep
- Inventory export with owner and location
- Installed-software list for CUI machines
- Date of the last review
Related NIST SP 800-171 Rev 2: 3.4.1, 3.4.9
How Peripolos helps: Inventory & Patch (IT Foundation), Scope (Readiness)
Strategic Technical Debt Reduction
What DoW asks: Retire or modernize unused, unsupported and duplicate systems.
Unsupported operating systems, old NAS boxes and forgotten admin tools can't be patched, so they stay open. Every one you retire is one less finding and one less way in.
Start this week
- Flag everything past vendor support, such as Windows 10
- Remove software nobody has used in 90 days
- Give each item a retire, replace or isolate date
Evidence to keep
- Unsupported-asset register with decisions and dates
- Removal or replacement tickets
Related NIST SP 800-171 Rev 2: 3.4.6, 3.4.7, 3.14.1
How Peripolos helps: Debt-Down (IT Foundation)
Flexible Technology Stack
What DoW asks: Build on modular, open-standard systems so no single vendor can lock you in.
For a small supplier this is mostly an exit plan: can you export your data, logs and settings if a provider fails or doubles its price?
Start this week
- List the systems you couldn't leave within 90 days
- Confirm each can export data in a standard format
- Keep settings documented or written as code
Evidence to keep
- Current architecture diagram
- A tested data export from each key system
Related NIST SP 800-171 Rev 2: 3.13.2
How Peripolos helps: Every managed Peripolos product runs on open-source tools with exportable data
Logical Segmentation to Limit Adversary Lateral Movement
What DoW asks: Split the network into zones so one compromised device can't reach everything.
In many small shops the office PCs, the CUI file share, the shop floor and guest Wi-Fi share one flat network. Separate the CUI systems and the production floor first.
Start this week
- Move guest Wi-Fi to its own network
- Put CUI systems in their own VLAN or enclave
- Block office-to-floor traffic except what machines need
Evidence to keep
- Network zone diagram
- Firewall rule set with an owner for each rule
Related NIST SP 800-171 Rev 2: 3.13.1, 3.13.5, 3.1.3
How Peripolos helps: Scope (Readiness), Enclave (IT Foundation), Cell Guard (Shop Floor)
Risk-Based Vulnerability Management
What DoW asks: Fix vulnerabilities by real-world exploitation and business impact, not severity score alone.
CISA's Known Exploited Vulnerabilities (KEV) catalog lists the flaws attackers are using now. Fix those first, starting with internet-facing firewalls and VPNs.
Start this week
- Run the free First Article Check on your asset list
- Patch KEV matches on internet-facing devices this week
- Enroll in NSA's no-cost attack surface management if eligible
Evidence to keep
- KEV-ranked findings with fix dates
- Scan reports
- Exceptions with their compensating controls
Related NIST SP 800-171 Rev 2: 3.11.2, 3.11.3, 3.14.1
How Peripolos helps: Inventory & Patch (IT Foundation), Peripolos subscription (Assurance)
Integrate Security Early in the Development Lifecycle
What DoW asks: Build security into how you write and ship code, including third-party components.
This applies if you write software, firmware or machine programs in-house. Most of the risk sits in outdated libraries and secrets left in code.
Start this week
- Turn on dependency scanning in your code host
- Scan repositories for leaked keys and passwords
- Require a review before code reaches production
Evidence to keep
- A software bill of materials (SBOM) per release
- Scan results and the fixes made
Related NIST SP 800-171 Rev 2: 3.13.2, 3.4.3, 3.4.4
How Peripolos helps: Code Check (IT Foundation)
Secure AI Adoption and Data Protection
What DoW asks: Set rules for AI use and keep sensitive data out of public AI tools.
An engineer pasting controlled drawing notes into a public chatbot has caused a CUI spill. Decide which AI tools are approved and what may never go into them.
Start this week
- Publish a one-page AI use policy
- Approve AI tools that keep your data private
- Block or monitor CUI uploads to public AI sites
Evidence to keep
- Signed AI use policy
- Approved-tool list
- Data loss prevention or web filter rules
Related NIST SP 800-171 Rev 2: 3.1.3, 3.1.20, 3.1.22
How Peripolos helps: AI Guardrails (IT Foundation), Enclave (IT Foundation)
Resilient Backup and Disaster Recovery Architecture
What DoW asks: Keep backups that ransomware can't reach, and test full restores.
Ransomware crews go after backups first. Keep at least one copy offline or immutable, and prove you can restore the file server and the systems that run production.
Start this week
- Add an immutable or offline backup copy
- Restore one full system this month and time it
- Back up CNC programs and PLC logic as well
Evidence to keep
- Restore-test records with dates and durations
- Backup job reports
Related NIST SP 800-171 Rev 2: 3.8.9 (Rev 2 covers backup confidentiality; recovery goes beyond NIST SP 800-171)
How Peripolos helps: Recover (IT Foundation)
Continuous Technical Workforce Readiness
What DoW asks: Keep the people who run your systems trained on current threats and tools.
In a small company that may be one IT person or an outside MSP. Make sure whoever holds admin rights knows today's attack patterns and your incident plan.
Start this week
- Name everyone who holds admin rights
- Train admins and CUI handlers for their roles
- Run a phishing drill and review the results
Evidence to keep
- Training completion records
- Drill results and follow-ups
Related NIST SP 800-171 Rev 2: 3.2.1, 3.2.2
How Peripolos helps: Ready (IT Foundation)
Practice titles are the DoW CIO's own, from the Brilliant at the Basics page. Descriptions, first steps and NIST SP 800-171 mappings are VIS's analysis; DoW has not published an official mapping. Brilliant at the Basics is a campaign, not a certification. Readiness and internal-audit support, not certification or third-party attestation; DoW does not endorse VIS.
Want help with any of these?
Book a free consultation and we'll pick the three practices that matter most for your shop.