How to Use Brilliant at the Basics in Your CMMC Level 2 Program

The Department of War Chief Information Officer (CIO) publishes "Brilliant at the Basics," a campaign that lists ten cybersecurity practices for information technology (IT) and ten for operational technology (OT). Contractors preparing for Cybersecurity Maturity Model Certification (CMMC) Level 2 often ask how the campaign relates to their certification. This post explains how the two differ and how to use the campaign to strengthen a Level 2 program.

Two approaches to the same goal

CMMC Level 2 and Brilliant at the Basics both aim to raise the security maturity of the Defense Industrial Base. They approach that goal from different directions, and they come from different generations of security thinking.

The two work together. In our view, the campaign is the clearest published sign of where a reformed CMMC program may land.

Your obligations still come from your contract

The campaign adds nothing to what you owe. The page cites no contract clause, CMMC level, or NIST requirement, and it describes its content as provided "for educational and informational purposes only."

Your contract decides what you owe. DFARS 252.204-7012 requires you to protect covered defense information, which is the Controlled Unclassified Information (CUI) that the Department provides for a contract or that you collect, develop, or store in performing it. CMMC Level 2 verifies that protection against NIST SP 800-171 Revision 2. In July 2026, the Department suspended the move to Phase 2 of the CMMC rollout. DFARS 252.204-7012 still applies, and new solicitations can still require a Level 1 or Level 2 self-assessment.

Sort the practices into three groups

Compare each of the twenty practices with your system security plan (SSP), and place it in one of three groups:

1. 01 · Covered by Level 2Meet the requirementLet the campaign shape how you meet it.
2. 02 · Beyond Level 2Adopt it as a company decisionRecord it in your policy.
3. 03 · Outside Level 2Decide on business meritIs the practice worth the cost?

Record the second and third groups as company decisions rather than CMMC requirements, so that your staff and your assessor can tell the two apart.

Map the IT Top 10 to Level 2

Each practice below shows how far Level 2 covers it and the requirements it relates to. Select a practice to jump to its explanation.

IT TOP 10 · HOW FAR LEVEL 2 COVERS ITCOVEREDPARTLYBEYONDOUTSIDE

Level 2 covers seven of the ten, and two of those go further than Level 2 requires. One more is covered in part, one goes mostly beyond, and one sits outside Level 2.

1. 01
   Phishing-resistant multifactor authenticationCovered. Phishing resistance goes beyond Level 2.IA.L2-3.5.3IA.L2-3.5.4AC.L2-3.1.5
   Covered+ Beyond
2. 02
   Comprehensive asset inventoryCovered for hardware, software, and firmware. Identities, data, and continuous validation go beyond.CM.L2-3.4.132 CFR § 170.19(c)
   Covered+ Beyond
3. 03
   Strategic technical debt reductionCovered.CM.L2-3.4.6CM.L2-3.4.7CM.L2-3.4.9SI.L2-3.14.1
   Covered
4. 04
   Flexible technology stackOutside Level 2.No Level 2 requirement
   Outside
5. 05
   Logical segmentationCovered.SC.L2-3.13.1SC.L2-3.13.6AC.L2-3.1.3
   Covered
6. 06
   Risk-based vulnerability managementCovered.RA.L2-3.11.2RA.L2-3.11.3SI.L2-3.14.1
   Covered
7. 07
   Security early in the development lifecyclePartly covered, if you develop software.SC.L2-3.13.2
   Partly
8. 08
   Secure AI adoption and data protectionCovered wherever an AI tool can receive CUI.AC.L2-3.1.3AC.L2-3.1.20DFARS 252.204-7012(b)(2)(ii)(D)
   Covered
9. 09
   Resilient backup and disaster recoveryMostly beyond Level 2.MP.L2-3.8.9
   Mostly beyond
10. 10
    Continuous technical workforce readinessCovered.AT.L2-3.2.1AT.L2-3.2.2
    Covered

Multifactor authentication

Level 2 requires multifactor authentication (IA.L2-3.5.3) and replay-resistant authentication (IA.L2-3.5.4), but it does not require phishing resistance. NIST defines multifactor authentication by the kinds of factors used and names no required technology, so an authenticator app that generates one-time codes meets both requirements. The campaign asks you to move away from text-message codes and push notifications, which phishing attacks can defeat. For a new deployment, choose a phishing-resistant method such as a FIDO2 security key or a passkey. If your current method already meets Level 2, plan the upgrade as an improvement rather than a compliance fix.

Asset inventory

CM.L2-3.4.1 requires an inventory of your hardware, software, firmware, and documentation, and the CMMC scoping rule at 32 CFR § 170.19(c) requires every in-scope asset to appear in it. The campaign extends the inventory to identities and data and asks you to validate it continuously. An inventory that records where CUI is stored and which accounts can reach it also keeps your SSP accurate.

Technical debt and vulnerability management

Every system you retire is one fewer system to protect and document. Unsupported software receives no security fixes, which makes the timely flaw correction that SI.L2-3.14.1 requires hard to achieve. RA.L2-3.11.3 already requires you to "remediate vulnerabilities in accordance with risk assessments," so the campaign's risk-based approach fits the requirement. Write your method for setting priorities into your vulnerability management procedure, so that an assessor can see why some fixes waited.

Flexible technology stack

No Level 2 requirement addresses dependence on a single vendor, but your contract does limit your cloud choices. Under DFARS 252.204-7012(b)(2)(ii)(D), an external cloud service that stores, processes, or transmits covered defense information must meet security requirements equivalent to the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline. Check that condition before you add a cloud product to an environment that holds CUI.

Segmentation

SC.L2-3.13.1 requires you to protect communications at external and key internal boundaries, and SC.L2-3.13.6 requires you to deny network traffic by default. Isolating the systems that hold CUI helps you meet both requirements. Segmentation can also reduce your assessment scope, because an asset that cannot process, store, or transmit CUI and provides no security protection for CUI assets is out of scope.

AI tools

The campaign asks you to keep sensitive Department data out of public AI systems, and Level 2 reaches the same result by another route. An AI service that receives CUI is processing CUI. A cloud AI service must therefore meet FedRAMP Moderate equivalence, and an AI service inside your environment is assessed against all 110 requirements. A consumer AI service meets neither condition.

Information Security Oversight Office (ISOO) Notice 2026-01 is sometimes cited as a ban on contractors using AI with CUI. The notice addresses agency personnel, and your contract is what binds your company.

We recommend pairing a written prohibition with a technical block on public AI services from the systems that hold CUI. The policy states your position, and the block shows that the position holds. No published guidance says whether an assessor accepts the policy alone.

Backups

MP.L2-3.8.9 requires only that you protect the confidentiality of backup CUI where it is stored. Immutable backups, separate backup credentials, and restoration drills go beyond Level 2. They are the campaign's answer to ransomware, and they are worth adopting on business grounds. A backup of CUI is still CUI, so a cloud backup service that holds it must meet FedRAMP Moderate equivalence even if you encrypt the backup first.

Workforce readiness

AT.L2-3.2.1 requires security awareness for managers, system administrators, and users, and AT.L2-3.2.2 requires training for people with security duties. The campaign's focus on technical staff fits the second requirement. Train your administrators on the systems they run, and keep a record of the training.

Use the OT Top 10 to document your Specialized Assets

At Level 2, operational technology is a Specialized Asset. 32 CFR § 170.4(b) defines operational technology as "programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment)." Table 3 to 32 CFR § 170.19(c)(1) sets four requirements for a Specialized Asset:

SPECIALIZED ASSETS · TABLE 3 TO 32 CFR § 170.19(c)(1)

“Document in the asset inventory · Document asset treatment in the SSP. · Show these assets are managed using the contractor’s risk-based security policies, procedures, and practices. · Document in the network diagram of the CMMC Assessment Scope.”

1. 1InventoryA validated OT inventory answers it.
2. 2SSPThe assessor reviews your SSP for these assets.
3. 3Risk-based practicesThe rule names none; the OT Top 10 fills the gap.
4. 4Network diagramShow the OT and its boundaries in scope.

The assessor reviews your SSP for these assets and does not test them against the other CMMC requirements.

The third item asks for risk-based practices without naming any. The OT Top 10 fills that gap with a list the Department itself published. We recommend that your SSP describe how you apply each OT practice to your equipment, or why a practice does not apply.

Several OT practices also connect to Level 2 requirements on the IT side:

OT TOP 10 · WHERE IT TOUCHES LEVEL 2

1. Validated asset inventoryA validated OT inventory gives you the asset inventory and network diagram that Table 3 requires.32 CFR § 170.19(c)(1), Table 3
2. Strict network segmentationThe boundary between your business network and your OT network is a key internal boundary under SC.L2-3.13.1.SC.L2-3.13.1
3. Remote access pathwaysA vendor session through your virtual private network (VPN) or a jump server usually crosses assessed assets, where AC.L2-3.1.12 and AC.L2-3.1.14 apply.AC.L2-3.1.12AC.L2-3.1.14
4. OT-specific incident responseYour OT plan can be an annex to the incident-handling capability that IR.L2-3.6.1 requires.IR.L2-3.6.1
5. Review processesThe safety review of an OT change parallels the change control in CM.L2-3.4.3 and CM.L2-3.4.4.CM.L2-3.4.3CM.L2-3.4.4
6. Supply chain securityNIST SP 800-171 Revision 2 has no supply chain requirement, but DFARS 252.204-7012(m) requires you to flow the clause down to subcontracts for operationally critical support or whose performance involves covered defense information.DFARS 252.204-7012(m)

Two cautions apply. First, the Specialized Asset category is a closed list of named classes, so a general-purpose workstation does not become OT because it is hard to secure. Second, in our view the category changes what the assessor examines without removing your duty to protect the CUI on that equipment.

Bring the campaign into your program

• Map all twenty practices to your SSP, using the three groups above.
• Use the campaign's recommendations when you choose or replace a technology for a covered practice.
• Record each practice beyond Level 2 in your policy as a company decision.
• Write the OT practices into the Specialized Asset section of your SSP.
• Review the mapping when the CMMC program or the campaign changes. The campaign page carries no date or version number, so check it periodically.

Want help mapping the twenty practices?

Our readiness team can walk your SSP against both lists with you: which practices Level 2 already covers, which ones are company decisions, and how to write up your OT as Specialized Assets so an assessor can follow it.

Sources: Department of War CIO, “Brilliant at the Basics” campaign page; 32 CFR Part 170, § 170.4(b) and § 170.19(c)(1), Table 3; NIST SP 800-171 Revision 2 (February 2020); NIST SP 800-53 Revision 4 (April 2013); DFARS 252.204-7012, paragraphs (b)(2)(ii)(D) and (m); ISOO Notice 2026-01 (March 30, 2026).