Brilliant at the Basics vs NIST 800-171 — Campaign, Not a Replacement
Quick answer: Brilliant at the Basics is a Department of War / DoD CIO hygiene campaign with IT and OT Top 10 lists. It is useful as a focus list. It is not a new DFARS clause, not a substitute for the 110 NIST SP 800-171 Rev 2 requirements, and not a CMMC assessment path. Keep scoring and signing against 800-171 / SPRS.
Key takeaways
- Treat BatB as a campaign: useful hygiene, not a contractual replacement.
- Map IT Top 10 themes onto 800-171 families you already owe; do not drop uncovered controls.
- The OT Top 10 does not put shop-floor systems into CMMC by itself — freeze whether OT is in your CUI boundary.
- Phishing-resistant MFA is a BatB uplift; 800-171 3.5.3 is still MFA as written in the requirement you are assessed against.
- Do not mark 800-171 MET because you posted a BatB checklist.
What Brilliant at the Basics is
The DoD CIO Brilliant at the Basics page is a hygiene campaign: an IT Top 10 and an OT Top 10 aimed at warfighters, the civilian workforce, and Defense Industrial Base partners. The CIO’s office spotlighted it again on 1 October 2026 for Cybersecurity Awareness Month.
It is not:
- A DFARS clause
- A replacement for NIST SP 800-171 Rev 2
- A SPRS scoring methodology
- A CMMC Level 2 assessment path
- Permission to park open 800-171 rows
If your contract carries DFARS 252.204-7012, you still implement 800-171 Rev 2 and you still need a score you can stand behind. Start with the SPRS worksheet and the Defensibility Check.
IT Top 10 → 800-171 (plain language)
Titles below follow the CIO campaign’s IT list. Mappings are themes, not official DoD equivalencies. Confirm requirement text in NIST SP 800-171 Rev 2.
| BatB IT practice | Closest 800-171 Rev 2 rows | What a Level 2 shop should not assume |
|---|---|---|
| Phishing-resistant MFA | 3.5.3 (MFA); also 3.5.1, 3.5.2 | 3.5.3 is MFA as written. “Phishing-resistant” is a BatB uplift, not automatic extra SPRS credit. |
| Comprehensive asset inventory | 3.4.1 | A CMDB export is not a complete configuration baseline if it is stale or missing software/firmware. |
| Strategic technical debt reduction | 3.4.6, 3.4.7, 3.14.1 | Retiring junk helps; it does not close unrelated families (audit, media, personnel). |
| Flexible technology stack | 3.4.1, 3.4.2 (loose) | No 1:1 control. Do not invent a MET mark for “we might swap vendors.” |
| Logical segmentation / limit lateral movement | 3.13.1, 3.13.5, 3.13.6 | High-weight rows. Flat networks fail here even if MFA is pretty. |
| Risk-based vulnerability management | 3.11.1–3.11.3, 3.14.1 | Scanning without remediation still leaves 3.11.3 open. |
| Security early in the development lifecycle | 3.13.2 | Applies when you build software; buying SaaS does not auto-satisfy it. |
| Secure AI adoption and data protection | 3.1.3, 3.13.16, 3.1.22 (loose) | Rev 2 has no “AI control.” CUI in a model or prompt is still CUI in a system. |
| Resilient backup and disaster recovery | 3.8.9; IR family 3.6.x | Backups of CUI still need confidentiality protection. |
| Continuous technical workforce readiness | 3.2.1, 3.2.2, 3.2.3 | Awareness training is necessary and not sufficient for access, crypto, or logging. |
Use the list to sequence work. Do not use it to hide the other ~90 requirements.
OT Top 10 — scope first
The campaign’s OT list (identity and access, validated inventory, strict segmentation, OT-specific incident response, known-vulnerability management, remote access pathways, continuous monitoring, resiliency, supply chain, review processes) is good shop-floor hygiene.
It does not mean:
- Operational technology is now inside CMMC Level 2 by default
- You must buy an OT product to stay DFARS-compliant
- A paused CMMC Phase 2 somehow moved the goalposts onto the mill or the CNC cell
Put OT in the CUI / in-scope map. If CUI never lands on those systems and they are out of the SSP boundary, say so in the SSP. If it does land there, those systems inherit 800-171 for that boundary. Either way, write it down.
The CMMC Reform Task Force report is not public as of this page’s last verified date. Do not build a CMMC-OT program off campaign slides while you wait.
How to use BatB without lying to SPRS
- Freeze scope (CUI map).
- Keep the 110-row register (status mapping + SPRS worksheet).
- Use BatB as a priority filter for high-weight rows you already owe (MFA, inventory, segmentation, vuln management, backups, training).
- Record evidence in an evidence log (15-row sample). BatB checklists are not artifacts for 3.5.3.
- Sign against 800-171 / SPRS, not against a campaign poster (sign-off checklist).
Sources
- DoD CIO — Brilliant at the Basics (campaign home)
- Department of War CIO Cybersecurity Awareness Month announcement, 1 Oct 2026 (campaign relaunch; four weekly themes: Be Aware, Be Vigilant, Be Secure, Be Connected)
- NIST SP 800-171 Rev 2
- DoD Assessment Methodology v1.2.1 (SPRS weights)
- Living policy context: CMMC after the Phase 2 pause · Reform Task Force RFI (closed)
If this page and a primary source disagree, trust the primary source and your contract.
Frequently asked questions
Does Brilliant at the Basics replace CMMC or DFARS 7012?
No. Campaign guidance from the CIO’s office does not repeal DFARS 252.204-7012, NIST SP 800-171 Rev 2, SPRS reporting, or 32 CFR Part 170. Your contract and those instruments still govern.
If we nail the IT Top 10, is our SPRS score 110?
No. Several Top 10 items overlap high-weight 800-171 rows (MFA, inventory, segmentation, vuln management). Most of the 110 requirements are not on the Top 10. Arithmetic still uses official 1/3/5 weights on every applicable row.
Do we have to implement the OT Top 10 for CMMC Level 2?
Only if those OT systems are in the CUI assessment boundary you are scoring. BatB highlighting OT does not, by itself, expand CMMC. Map OT in or out with a scope worksheet, then score what is in.
Is this a new obligation from the Reform Task Force?
No. The Task Force report is not public as of this page’s last verified date. BatB predates that report as a CIO campaign and was spotlighted again for Cybersecurity Awareness Month (1 Oct 2026). Do not wait for the report to keep 7012 work going, and do not invent new BatB-only clauses.
What this page is / is not: readiness and advisory guidance only. Not legal advice, not a C3PAO assessment, and not a CMMC certification. CUI designation is driven by government requirements and contract language—not by this site. Prefer primary sources when policy text conflicts with any blog (including ours).