Virtual Infrastructure Services has launched Peripolos, a product and service line that helps small and mid-size defense suppliers put the DoW CIO's Brilliant at the Basics practices in place and keep the evidence. It starts with a free check anyone can run and grows into hands-on packages where VIS does the work with you. The name comes from the peripoloi, the frontier patrols of classical Athens.
Why now
With CMMC Phase 2 suspended and the task force's recommendations still unpublished, many suppliers are unsure what to work on. The answer has not changed: NIST SP 800-171 and your SPRS score still apply, and DoW's IT and OT Top 10 lists show where it sees the biggest risks.
Why start with known vulnerabilities
Attackers do not need a zero-day when a flaw that is already being exploited is sitting on a firewall or an engineering workstation. CISA's Known Exploited Vulnerabilities (KEV) catalog lists exactly those flaws; our most recent sync, on 30 October 2026, counted 1,766 entries. Managing them is practice 5 on the OT Top 10 and part of practice 6, risk-based vulnerability management, on the IT list.
The free First Article Check
In manufacturing, a first article inspection proves a process before full production. Our First Article Check does the same for your known-vulnerability exposure:
- Three ways in: a short, readable collector script for Windows or Linux; an OT worksheet for PLCs, HMIs, drives and firewalls; or a pasted asset list or scanner export.
- Metadata only. The collector reads installed software and versions, strips IP addresses, user names and serial numbers, makes no network connections, and saves a file you can read before you upload it.
- Results in about a minute: every KEV match, risk-ranked, with an action for each finding.
- An AI summary of your results, and a KEV agent you can ask follow-up questions.
- Raw uploads are not stored, results are deleted after 30 days, and nothing is used to train AI models. Please do not upload CUI.
Two free guides cover the IT Top 10 and the OT Top 10, each with first steps, evidence to keep and the related NIST SP 800-171 requirements. The free Basics Scorecard rates all 20 practices in about five minutes without sending anything to us.
Four packages, one path
When you want help closing the gaps, four packages cover all 20 practices. Each is scoped to your company and priced per engagement.
- Peripolos Readiness. A defensible starting point: your CUI boundary and enclave decision, a NIST SP 800-171 gap assessment with an evidence-backed SPRS worksheet and POA&M, KEV findings worked down in a four-week Peripolos Sprint, and answers for your prime's supplier questionnaire.
- Peripolos IT Foundation. The IT practices without hiring a security team: phishing-resistant MFA, a right-sized CUI enclave on PreVeil or Microsoft 365 GCC High, inventory and risk-based patching, tested backups, AI guardrails and training.
- Peripolos Shop Floor. The OT practices for machine shops and fabricators: a passive inventory validated by a walk-down, segmentation between office and floor, time-boxed vendor access protected by MFA, and a recovery plan that keeps the line safe.
- Peripolos Assurance. Staying ready all year: daily KEV matching against your assets, 24/7 monitoring by US-based analysts, a living SSP and evidence locker, a monthly scorecard, and a fractional security lead for prime audits and the annual affirmation.
Every practice maps to at least one package. The full map is on the Peripolos page.
What Peripolos is not
Peripolos is readiness and internal-audit support. It is not a certification, a CMMC assessment or third-party attestation, and VIS is not a C3PAO. We deliver it with our partners Microsoft and PreVeil, and as an authorized RADICL reseller.
Run your free First Article Check
It takes about a minute, and a VIS consultant can walk you through the results.
Run the Free CheckSources
This article summarizes public information for general guidance. It is not legal advice or a compliance determination about any company. VIS provides readiness and internal-audit support, not certification or third-party attestation, and is not a C3PAO. CISA, the KEV catalog and the DoW CIO's Brilliant at the Basics campaign are referenced for context and do not endorse VIS.