Brilliant at the Basics 20-Practice Executive Checklist

Brilliant at the Basics Resource Center · brilliantatthebasics.us · published by inDirectIT, Inc.

Independent educational material. Not affiliated with, sponsored by, approved by, or endorsed by the U.S. Department of War. Does not establish compliance, certification, or contractual standing.

Purpose

A single sheet an executive can carry into a review: all twenty practices in the order we recommend tackling them, who should own each one, roughly what it costs in effort, and the one question that separates real implementation from a purchase order.

How to use it

Read down the sequence column. For each practice, ask the question in the final column and score the answer against the maturity ladder. Anything below 'Deployed' is not yet protecting you; anything below 'Measured' cannot be reported honestly.

The maturity ladder

Use the same ladder for every practice so scores are comparable across the programme.

Score each practice against this ladder. The distinction that matters most is between having a tool, deploying it to the correct scope, and operating it consistently.

Level	Name	What it means	The question that separates it from the level below
0	Absent	The capability does not exist in any form.	Is there anything at all — a tool, a document, a person who owns it?
1	Documented	Intent exists on paper. Deployment has not happened or is incomplete.	Is the intent written down, with a named owner and a scope?
2	Configured	The technology or process is configured, but not yet applied to the intended scope.	Is it switched on and set up somewhere — even if only in part of the estate?
3	Deployed	It is applied across the scope it was meant to cover.	Does it cover everything in scope, with the exceptions written down?
4	Operating	It functions consistently during normal operations, not only when someone is watching.	Does it keep working through a normal month without manual rescue?
5	Measured	Coverage and effectiveness are measured, monitored, and exception-handled.	Can you state a number for coverage or effectiveness, and show the trend?
6	Governed	Ownership, scheduled review, continuous improvement, and evidence retention are established.	Is there an accountable owner, a review cadence, and retained evidence?

All twenty practices, in recommended sequence

Official campaign numbering is authoritative. This ordering is the Resource Center's independent recommendation for resource-constrained teams and carries no official status.

#	Practice	Track	Stage	Suggested owner	Effort	The question to ask
1	IT-01 — Phishing-resistant MFA	IT	1 · Know and control	Identity administrator	Medium	Can we state a number for phishing-resistant coverage — privileged?
2	IT-02 — Asset inventory	IT	1 · Know and control	IT leader	Medium	Can we state a number for managed coverage?
3	OT-01 — OT identity and access control	OT	1 · Know and control	Plant / OT leader	Medium	Can we state a number for devices on default credentials?
4	OT-02 — Validated OT asset inventory	OT	1 · Know and control	Plant / OT leader	Medium	Can we state a number for walk-down coverage?
5	IT-05 — Logical segmentation	IT	2 · Contain compromise	Network administrator	High	Can we state a number for any-any rules?
6	OT-03 — OT network segmentation	OT	2 · Contain compromise	OT / network administrator	High	Can we state a number for unbrokered it-to-ot paths?
7	OT-06 — OT remote access pathways	OT	2 · Contain compromise	OT / network administrator	Medium	Can we state a number for brokered access share?
8	IT-03 — Technical debt reduction	IT	3 · Reduce exposure	IT leader	High	Can we state a number for unsupported systems in production?
9	IT-06 — Risk-based vulnerability management	IT	3 · Reduce exposure	IT leader / MSP	Medium	Can we state a number for scan coverage?
10	OT-05 — OT vulnerability management	OT	3 · Reduce exposure	OT engineer	Medium	Can we state a number for high-risk findings addressed?
11	IT-09 — Backup and disaster recovery	IT	4 · Recover operations	IT leader	Medium	Can we state a number for backup coverage?
12	OT-04 — OT incident response and recovery	OT	4 · Recover operations	Plant / OT leader	Medium	Can we state a number for plan currency?
13	OT-08 — OT system resiliency	OT	4 · Recover operations	Plant / OT leader	High	Can we state a number for controller backup coverage?
14	IT-04 — Flexible technology stack	IT	5 · Engineer securely	IT leader	Medium	Can we state a number for baseline coverage?
15	IT-07 — Security in the development lifecycle	IT	5 · Engineer securely	Engineering lead	Medium	Can we state a number for pipeline gate coverage?
16	IT-08 — Secure AI adoption	IT	5 · Engineer securely	Engineering lead	Medium	Can we state a number for sanctioned-tool share?
17	OT-09 — OT supply chain security	OT	5 · Engineer securely	Procurement + OT	Medium	Can we state a number for agreements with security terms?
18	OT-10 — OT change review	OT	5 · Engineer securely	Plant / OT leader	Low	Can we state a number for reviewed change rate?
19	IT-10 — Technical workforce readiness	IT	6 · Sustain performance	Executive sponsor	Low	Can we state a number for single-person dependencies?
20	OT-07 — OT continuous monitoring	OT	6 · Sustain performance	OT engineer	Medium	Can we state a number for monitored zone coverage?

Limitations

What this asset is and is not

This is independent educational material. It supports planning and evidence collection; it does not establish compliance with NIST SP 800-171, DFARS 252.204-7012, CMMC, export-control obligations, or any contract requirement, and it is not an assessment. Tailor every item to your own technical, operational, contractual, regulatory, and safety requirements.

All downloads

Printing produces a paginated document. Choose “Save as PDF” in the print dialog and name it batb-20-practice-executive-checklist to keep filenames consistent across your team.