Brilliant at the Basics: Mapping DoW's Top 10 to NIST 800-171

Brilliant at the Basics is voluntary guidance, not a new contract requirement, but it shows where the Department of War wants small contractors to focus while CMMC is under review. The DoW Chief Information Officer launched the campaign for Cybersecurity Awareness Month on October 1, 2026. It promotes two Top 10 lists, one for IT and one for operational technology (OT), that the Department issued in July. The useful move for a small contractor is to check each practice against the NIST SP 800-171 work you already owe and decide where to start.

What did the Department announce on October 1?

The October 1 release describes a month of daily posts and resources organized around four weekly themes: Be Aware, Be Vigilant, Be Secure, and Be Connected. It says the campaign gives “tailored guidance and accessible resources” to defense industrial base (DIB) partners, naming small, medium, and nontraditional businesses. It also says the campaign will spotlight low-cost and no-cost support programs aligned with the IT and OT best practices the Department issued in July 2026.

The practices themselves sit on the Brilliant at the Basics page, with downloadable versions of the IT Top 10 and the OT Top 10. The IT guide says it is meant to help small and mid-sized businesses protect their operations “without the burden of massive compliance overhead.”

Does it change what your contract requires?

No. The campaign materials carry a disclaimer that the practices are “for educational and informational purposes only” and must be tailored to your organization’s technical, operational, and regulatory requirements. Nothing in the release creates a clause, a score, or a certification.

Your contractual baseline is still whatever your contract says. For most DoD contracts involving covered defense information, that means DFARS 252.204-7012 and NIST SP 800-171 Rev. 2. Class Deviation 2026-O0025, Revision 3 keeps that Rev. 2 baseline while contracting officers revise CMMC assessment requirements. Our Revision 3 review guide covers how to check your own contract documents.

Treat the Top 10 as a prioritization aid. It shows which practices the CIO’s office chose to highlight for small businesses, which helps a small team decide what to fix first.

How do the IT practices line up with NIST SP 800-171?

The IT guide does not cite NIST requirement numbers. The third column below is our suggested mapping to NIST SP 800-171 Rev. 2, not DoW’s. Use it to find the evidence you already have, then confirm the mapping with whoever owns your System Security Plan.

Where do the practices go beyond the Rev. 2 baseline?

Several practices ask for more than the Rev. 2 requirement text on its face. Knowing where helps you separate contract obligations from optional upgrades.

• MFA type. Requirement 3.5.3 calls for multifactor authentication. The DoW guide goes further and asks you to move away from SMS and push methods. If your users approve logins by push notification, you may meet 3.5.3 and still fall short of the guide.
• AI tools. The guide asks you to “explicitly prohibit” entering sensitive Department data into public AI systems. Rev. 2 has no AI-specific requirement, but an acceptable-use rule plus technical blocking gives you a written answer to an assessor’s question about CUI flow.
• Backups. Requirement 3.8.9 covers the confidentiality of backup CUI. The guide adds immutability, isolated credentials, and full restore drills. Those protect your ability to recover after ransomware, which the confidentiality requirement alone does not address.
• Technology stack. Practice 4 is about avoiding vendor lock-in. It has no Rev. 2 counterpart, so treat it as a buying criterion rather than a control.

When you adopt one of these upgrades, record it as implemented only after it is in place. The Honeywell settlement review shows why statements about security posture should match what is operating on the network.

What if you run machines on a shop floor?

The OT Top 10 is written for production environments, where shutting a system down to patch it is often not an option. Three of its practices matter most for small manufacturers:

• Strict segmentation between the business network and production systems, so an intruder on an office laptop cannot reach a programmable logic controller.
• Short-lived remote access. The guide asks you to remove “always-on” connections, including cellular gateways, and to grant vendor access only when needed, with strong authentication.
• Compensating controls such as firewall rules, isolation, and application allowlisting for equipment you cannot patch until the next maintenance window.

The OT page also points to CISA’s Cyber Security Evaluation Tool (CSET), a free desktop tool for evaluating IT and industrial control system practices.

Which no-cost resources does the campaign list?

The Additional resources section of the campaign page lists 19 links. These are the ones most useful to a small contractor:

Eligibility rules differ by program. Check each program’s own page before you plan around it.

Pick three practices for the next 30 days

Most small teams cannot work all 10 practices at once. Start with three that touch CUI directly:

1. Start with authentication. List every account that can reach CUI and the MFA method each one uses. Flag SMS and push-only methods for replacement.
2. Reconcile the inventory. Compare your SSP’s system inventory against what is running today, including cloud services and personal devices. Retire what nobody owns.
3. Write the AI rule. Add a line to your acceptable-use policy covering public AI tools and CUI, then check whether your network or endpoint tools can enforce it.

For each item, record the owner, the date, and the evidence that shows it is done. That evidence also supports your SPRS score and any future assessment.

Where collaboration tools fit

Practices 1, 8, and 9 often break down in email and file sharing, where CUI moves between people and outside parties. IRONKEEP provides built-in identity with MFA or connects to your identity provider through SAML or OIDC, applies recovery and retention controls under tenant-scoped encryption keys, and produces audit evidence across mail, files, docs, and chat. It does not replace your SSP or your assessment; your organization still owns those.

If your 30-day review finds a gap in how CUI is shared or recovered, request a defense pilot scoped to that practice with IRONKEEP. Define what the reviewer needs to see, test with synthetic files, and confirm deployment suitability and contractual requirements before introducing controlled information.

Set the next review date

Choose one owner for the Top 10 review and give them a date. Bring the table above, your current SSP, and your contract clauses to that meeting. Decide which three practices to work first, which ones are already covered, and which ones you will skip, with a reason recorded for each.

Keep that record with your Rev. 3 contract review. When DoD finishes its CMMC review, you will already know where your basics stand.