01
Phishing-Resistant Multi-Factor Authentication
Make a stolen password useless on its own.
IT-013.5.3IA.L2-3.5.3
INDEPENDENT IMPLEMENTATION LAYERPLAIN-LANGUAGE GUIDES
Cloud Setup Guides
Step-by-step, plain-language instructions for turning on the security settings that matter — in Microsoft 365, AWS, Google Workspace, Google Cloud, and Azure Government. Every guide is written to be understood by a beginner, with a diagram and a checklist you can actually follow.
How to use these guides
Pick your cloud, then work through the ten requirements in order. Each requirement is explained in everyday words, shows a process-flow diagram, and gives you a click-by-click checklist. Your checklist progress is saved only in this browser. The official campaign remains the authoritative source.
Read the official campaign ↗Choose your cloud
Five platforms, one playbook
Productivity Suite
Microsoft 365
Email, files, Teams, and identity for the whole company.
- BEST FOR
- Contractors standardized on Outlook, Teams, SharePoint, and Windows.
- WHERE YOU WORK
- Microsoft 365 admin center + Microsoft Entra admin center
Cloud Infrastructure
Amazon Web Services
Servers, storage, databases, and networking you rent by the hour.
- BEST FOR
- Teams that build and host their own applications and infrastructure.
- WHERE YOU WORK
- AWS Management Console
Productivity Suite
Google Workspace
Gmail, Drive, Docs, and Meet with a single admin console.
- BEST FOR
- Companies that live in Gmail, Drive, and Google Docs.
- WHERE YOU WORK
- Google Admin console (admin.google.com)
Cloud Infrastructure
Google Cloud
Google's rent-by-the-hour compute, storage, and networking.
- BEST FOR
- Teams building applications, data platforms, or AI on Google Cloud.
- WHERE YOU WORK
- Google Cloud console (console.cloud.google.com)
GOV CLOUD
Azure Government
A separate, sovereign Azure cloud built for U.S. government data.
- BEST FOR
- CUI and ITAR workloads that need FedRAMP High and DoD IL4/IL5.
- WHERE YOU WORK
- Azure Government portal (portal.azure.us)
What you will set up
Ten requirements, every cloud
Each maps to the Brilliant at the Basics IT Top 10 and to the NIST SP 800-171 / CMMC Level 2 controls behind DFARS 252.204-7012.
02
Least-Privilege Access Control
Give each person only the access their job needs — and no more.
3.1.5AC.L2-3.1.5
03
Asset & Account Inventory
Keep a live list of every device, identity, and app you defend.
IT-023.4.1CM.L2-3.4.1
04
Logging, Monitoring & Audit
Record important events and watch for trouble.
3.3.1AU.L2-3.3.1
05
Network Segmentation & Boundary Protection
Keep one compromised thing from reaching everything else.
IT-053.13.5SC.L2-3.13.5
06
Vulnerability & Patch Management
Find weak spots and fix the risky ones first.
IT-063.11.2RA.L2-3.11.2
07
Data Protection & Encryption
Scramble sensitive data so only the right people can read it.
3.13.11SC.L2-3.13.11
08
Backup & Recovery
Be able to restore your data after an attack or outage.
IT-093.8.9MP.L2-3.8.9
09
Secure Configuration Baseline
Start every service from a known-good, hardened setting.
3.4.2CM.L2-3.4.2
10
Secure AI Adoption & Data Loss Prevention
Use AI and share files without leaking sensitive information.
IT-083.1.3AC.L2-3.1.3
Coverage at a glance
Every requirement is covered for every cloud
Click any cell to jump straight to that guide.
Educational, not a compliance guarantee
These guides are independent education. Cloud consoles and product names change often, so confirm each step against the provider’s own documentation. Following these steps does not by itself establish compliance, satisfy a contract clause, or confer CMMC certification. Content last reviewed 2026-07-21.