Brilliant at the Basics Scorecard

Good looks like: Every admin, email and remote login uses phishing-resistant MFA, such as security keys or passkeys.

Good looks like: A current inventory of devices, software, accounts and data, each with an owner.

Good looks like: Nothing runs past vendor support without a dated plan to retire, replace or isolate it.

Good looks like: Key systems can export their data and settings in standard formats.

Good looks like: CUI systems, office, guest and shop-floor networks are separated by rules you can explain.

Good looks like: Known exploited vulnerabilities are fixed first, with dates, on a set schedule.

Good looks like: Code and firmware you build is scanned for vulnerable components and leaked secrets before release.

Good looks like: A written AI policy, approved tools, and controls that keep CUI out of public AI.

Good looks like: Immutable or offline backups, and a full restore tested in the last quarter.

Good looks like: Admins and CUI handlers are trained for their roles and take part in phishing drills.

Good looks like: Named accounts and MFA on engineering and remote access, with no shared logins.

Good looks like: An as-operated OT inventory with firmware versions, confirmed on the floor.

Good looks like: A firewall between office and floor that allows only named connections.

Good looks like: A rehearsed OT response plan, with offline copies of PLC logic and machine programs.

Good looks like: Known exploited flaws on OT are patched, or contained by a dated control until the next maintenance window.

Good looks like: No always-on remote connections; vendor access is per visit, with MFA and logs.

Good looks like: The floor network is monitored and its logs are reviewed on a schedule.

Good looks like: Critical machines can run or stop safely without the network, and spares exist.

Good looks like: Security terms in supplier contracts and a replacement plan for unsupported hardware.

Good looks like: Significant OT changes are tested, approved and reversible.