Peripolos: Brilliant at the Basics for Defense Suppliers
- Home
- Brilliant at the Basics
“Patrol the basics before an adversary finds the gap.”
The Basics DoW Named, Done for Small and Mid-Size Suppliers
The DoW CIO's Brilliant at the Basics campaign lists 10 IT and 10 OT practices: phishing-resistant MFA, a validated asset inventory, segmentation, managing known vulnerabilities, controlled remote access and more. With CMMC Phase 2 suspended, they are the practical benchmark DoW is pointing contractors to.
Peripolos is how VIS gets you there. It starts with a free check of your systems and shop floor against CISA's Known Exploited Vulnerabilities catalog, then four packages close the gaps and keep the evidence your prime or assessor will ask for. Peripolos takes its name from the frontier patrols of classical Athens.
Start with a First Article Check
Run our read-only collector, fill in the OT worksheet or paste an asset list. In about a minute you see which of your products are on CISA's KEV catalog and what to do about each: patch now, contain until the next maintenance window, or verify the version. We also help eligible contractors enroll in NSA's no-cost DIB cybersecurity services.
Four Packages, One Path
Each package is scoped to your company and priced per engagement. Start where your gaps are; Readiness or the Peripolos Sprint is a natural first step.
Peripolos Readiness
A defensible starting point in two to three weeks: where CUI lives, an evidence-backed SPRS worksheet for your affirming official, and answers ready for your prime's supplier questionnaire.
- Scope: CUI boundary and enclave decision
- SPRS Reset: NIST 800-171 Rev 2 gap assessment and POA&M
- Peripolos Sprint: KEV findings worked down in four weeks
- Prime Packet: supplier questionnaire answers with an evidence index
Peripolos IT Foundation
The BatB IT practices without hiring a security team: phishing-resistant MFA, a right-sized CUI enclave, inventory and risk-based patching, tested backups, AI guardrails and training.
- Identity: FIDO2 keys or passkeys, conditional access
- Enclave: PreVeil or Microsoft 365 GCC High, sized to the users who touch CUI
- Inventory & Patch, Recover, AI Guardrails, Ready
Peripolos Shop Floor
The BatB OT practices for machine shops and fabricators: an as-operated inventory, segmentation between office and floor, controlled vendor access, and a recovery plan that keeps the line safe.
- Peripolos Sensor: passive OT inventory, validated by a walk-down
- Cell Guard: segmentation by cell or zone
- Vendor Gate: time-boxed, MFA-protected vendor access
- Hold Point and Recovery Drill
Peripolos Assurance
Daily KEV matching against your assets, 24/7 monitoring with US-based analysts, a living SSP and evidence locker, and a fractional security lead for prime audits and the annual affirmation.
- Peripolos subscription and monthly scorecard
- Watch: 24/7 detection and response
- Traveler: living SSP and evidence
- Liaison: prime questionnaires and audits
Every BatB Practice, Covered
Each of the 20 practices on the DoW CIO's lists maps to a Peripolos package and leaves evidence behind.
| # | Brilliant at the Basics practice | Peripolos package |
|---|---|---|
| IT-1 | Phishing-Resistant Multi-Factor Authentication | IT Foundation |
| IT-2 | Comprehensive Asset Inventory Management | IT Foundation, Readiness |
| IT-3 | Strategic Technical Debt Reduction | IT Foundation |
| IT-4 | Flexible Technology Stack | All (open, exportable tooling) |
| IT-5 | Logical Segmentation to Limit Adversary Lateral Movement | Readiness, IT Foundation, Shop Floor |
| IT-6 | Risk-Based Vulnerability Management | First Article Check, IT Foundation, Assurance |
| IT-7 | Integrate Security Early in the Development Lifecycle | IT Foundation (for firms that build software) |
| IT-8 | Secure AI Adoption and Data Protection | IT Foundation |
| IT-9 | Resilient Backup and Disaster Recovery Architecture | IT Foundation |
| IT-10 | Continuous Technical Workforce Readiness | IT Foundation |
| OT-1 | Identity and Access Control | IT Foundation, Shop Floor |
| OT-2 | Validated Asset Inventory | First Article Check, Shop Floor |
| OT-3 | Strict Network Segmentation | Shop Floor |
| OT-4 | OT-Specific Incident Response and Recovery Plan | Shop Floor |
| OT-5 | Manage Known Vulnerabilities | First Article Check, Readiness, Shop Floor, Assurance |
| OT-6 | Remote Access Pathways | Shop Floor |
| OT-7 | Continuous Monitoring | Shop Floor, Assurance |
| OT-8 | System Resiliency | IT Foundation, Shop Floor |
| OT-9 | Supply Chain Security | IT Foundation, Assurance |
| OT-10 | Review Processes | Shop Floor |
Readiness and internal-audit support, not certification or third-party attestation. CISA, the KEV catalog and the DoW CIO's Brilliant at the Basics campaign are referenced for context; they do not endorse VIS. Delivered with our partners Microsoft and PreVeil, and as an authorized RADICL reseller.
Want help reading your results?
Book a free consultation and we'll walk through your First Article Check with you.
Frequently Asked Questions
What is Brilliant at the Basics?
Brilliant at the Basics is a DoW CIO cybersecurity campaign with two Top 10 lists of best practices, one for IT and one for operational technology (OT). DoW launched it alongside the July 2026 suspension of CMMC Phase 2 as a practical benchmark for the defense industrial base.
Does Brilliant at the Basics replace CMMC?
No. It is a campaign, not a compliance framework: there is no assessment, score or certification. CMMC Phase 1 self-assessments, SPRS and DFARS 252.204-7012 still apply, and Peripolos work is mapped to NIST SP 800-171 as well as to the BatB practices.
What does the free First Article Check collect?
Product names and versions only. The read-only collector reads installed software and writes a file you can open and review before uploading; it makes no network calls and reads no documents. You can also paste a list or use the OT asset worksheet. Raw uploads are never stored, and results are deleted after 30 days.
Is Peripolos a certification or an audit?
No. VIS provides readiness and internal-audit support. Peripolos produces evidence your company can show a prime or an assessor; it does not certify or attest to compliance.