Brilliant at the Basics: A Plain-Language Guide for Defense Suppliers

In July 2026, when the Department of War suspended CMMC Phase 2, its Chief Information Officer also published two short lists of best practices for the defense industrial base: an IT Top 10 and an OT Top 10. On 1 October the CIO's office turned those lists into Brilliant at the Basics, a Cybersecurity Awareness Month campaign for warfighters, the civilian workforce and industry partners. The month is over, but the lists remain the clearest statement of what DoW wants small and mid-size suppliers to get right first.

What the campaign is, and what it is not

Brilliant at the Basics is guidance, not a rule. There is no assessment, score or certificate, and DoW's campaign page describes its content as educational and informational. It does not replace anything already in your contracts: CMMC Phase 1 self-assessments, your SPRS score and DFARS 252.204-7012 still apply.

During October the campaign ran a different theme each week: be aware, be vigilant, be secure and be connected. DoW also said it would spotlight low-cost and no-cost support programs that line up with the July practices.

The 10 IT practices

1. Phishing-Resistant Multi-Factor Authentication (MFA)
2. Comprehensive Asset Inventory Management
3. Strategic Technical Debt Reduction
4. Flexible Technology Stack
5. Logical Segmentation to Limit Adversary Lateral Movement
6. Risk-Based Vulnerability Management
7. Integrate Security Early in the Development Lifecycle
8. Secure AI Adoption and Data Protection
9. Resilient Backup and Disaster Recovery Architecture
10. Continuous Technical Workforce Readiness

Several go beyond NIST SP 800-171 Revision 2. Phishing-resistant MFA, first on the list, rules out text-message codes and simple push approvals in favor of security keys or passkeys. Technical debt, a flexible technology stack and secure AI adoption have no direct 800-171 equivalent at all.

The 10 OT practices

1. Identity and Access Control
2. Validated Asset Inventory
3. Strict Network Segmentation
4. OT-Specific Incident Response and Recovery Plan
5. Manage Known Vulnerabilities
6. Remote Access Pathways
7. Continuous Monitoring
8. System Resiliency
9. Supply Chain Security
10. Review Processes

The OT list matters for machine shops, fabricators and any supplier with CNC machines, PLCs or building systems that share a network with email. Practice 5, Manage Known Vulnerabilities, is the most concrete: know which of your products appear on CISA's Known Exploited Vulnerabilities (KEV) catalog, and act on each one, by patching or, where a controller cannot be patched yet, by containing it.

Free help DoW points to

The campaign page links 19 resources. The ones a small supplier is most likely to use:

• Project Spectrum, which DoW describes as no-cost cybersecurity resources for the DIB
• Attack surface management tools from NSA's Cybersecurity Collaboration Center
• Cybersecurity capability support from DC3's DIB Collaborative Information Sharing Environment (DCISE)
• CISA's industrial control systems resources and NIST SP 800-82, the guide to OT security
• NIST's Cybersecurity Framework 2.0 Small Business Quick-Start Guide

Each program has its own eligibility rules, so check before you count on one.

Where to start this month

1. Score yourself. Our free Basics Scorecard rates all 20 practices in about five minutes and shows your biggest gaps. Nothing is sent or stored.
2. Turn on phishing-resistant MFA for administrators, email and remote access first. Security keys or passkeys cover most small offices.
3. Write down what you have, office and shop floor. Inventory is practice 2 on both lists, and every other practice depends on it.
4. Check that inventory against the KEV catalog. Our free First Article Check does it in about a minute from product names and versions only.
5. Close or control every remote path into the shop floor, especially vendor access.
6. Keep evidence as you go, mapped to NIST SP 800-171, so the same work counts toward your SPRS score and your prime's supplier questionnaire.

How this relates to CMMC

Phase 2, the C3PAO requirement, is still suspended, and the CMMC Reform Task Force's recommendations have not been published. Whatever comes next, these practices overlap heavily with NIST SP 800-171, so time spent on them is not wasted. For the latest, see our CMMC status tracker and our November update on DoW cyber initiatives.

Sources

• DoW CIO: Brilliant at the Basics
• U.S. Department of War: Department of War Champions 'Brilliant at the Basics' for Cybersecurity Awareness Month (October 2026)
• AFCEA Signal: DOW kicks off Cybersecurity Awareness Month with fresh initiative launch (1 October 2026)
• CISA: Known Exploited Vulnerabilities Catalog

This article summarizes public information for general guidance. It is not legal advice or a compliance determination about any company. VIS provides readiness and internal-audit support, not certification or third-party attestation, and is not a C3PAO. CISA, the KEV catalog and the DoW CIO's Brilliant at the Basics campaign are referenced for context and do not endorse VIS.