30-Day Implementation Plan Template

Brilliant at the Basics Resource Center · brilliantatthebasics.us · published by inDirectIT, Inc.

Independent educational material. Not affiliated with, sponsored by, approved by, or endorsed by the U.S. Department of War. Does not establish compliance, certification, or contractual standing.

Purpose

A structured first month. The horizons and actions come from the practice guides; the owner, date, and evidence columns are yours to fill in.

How to use it

Pick no more than six practices for the first month — fewer if you have no dedicated IT staff. Assign a named owner to each, not a department. A row without an owner and a date is a wish.

Scope this plan

Plan header

Organization	Plan owner	Start date	Review date

Practice in scope this month	Why it was chosen	Named owner	Target date

Actions by horizon

Copy the rows for the practices you selected above. The reference list below is generated from the practice guides.

Practice	24-hour actions	14-day actions	30-day actions
IT-01 — Phishing-resistant MFA	List accounts with admin or remote access; Enable MFA for those accounts today	Enroll every administrator on a phishing-resistant method and stop accepting SMS as an admin factor; Write down and test the break-glass procedure before you tighten enforcement further	Enroll the remote workforce; Pilot FIDO2 keys or passkeys with one team
IT-02 — Asset inventory	Name an inventory owner; Pull existing lists from MDM, identity provider, and procurement	Merge the endpoint, identity, and procurement exports into one record and mark the rows that appear in only one source; Flag every device with no owner and every account with no matching employee	Merge the sources into one record; Flag devices with no owner or no management agent
OT-01 — OT identity and access control	Find default and vendor-set passwords on reachable devices; List every shared/generic login in use	Change the default and vendor-set passwords you can safely change in the next approved maintenance window; Confirm break-glass access exists, is documented, and has been tested against an identity or network outage	Change safe-to-change default credentials in a maintenance window; Confirm break-glass access exists and is tested
OT-02 — Validated OT asset inventory	Name an inventory owner; Collect existing vendor and project asset lists	Walk down one production line and record make, model, firmware, connectivity, and criticality with the operators; Reconcile that line against the vendor and project documentation and investigate anything that appears in only one	Walk down one production line; Record make, model, firmware, and connectivity
IT-05 — Logical segmentation	Identify your most sensitive systems and where CUI lives; Confirm management interfaces are off the user network	Confirm management interfaces are unreachable from the standard user network and fix any that are; Move high-risk devices — legacy systems, IoT, guest Wi-Fi — off the general user segment	Define zones by function and trust level; Isolate high-risk devices (legacy, IoT, guest) onto their own segments
OT-03 — OT network segmentation	Map every connection between the business and OT networks; Flag any direct, unfiltered IT-to-OT paths	Map every connection between the business and OT networks, including forgotten links, cellular modems, and vendor tunnels; Close or broker the riskiest direct path in an approved window, with a tested rollback	Define OT zones and the boundary architecture with the process owner; Close or broker the riskiest direct connections in a window
OT-06 — OT remote access pathways	Inventory every remote and vendor access path into OT; Disable any unknown or always-on tunnel	Disable any remote pathway you cannot identify an owner and a business reason for; Route the highest-risk remaining pathway through a brokered jump host with strong authentication	Route remote access through a controlled jump host / DMZ; Require strong authentication (MFA) for all remote entry
IT-03 — Technical debt reduction	List systems already past end-of-support; Flag any that are internet-facing	Confirm no internet-facing system is running unsupported software; isolate anything that is; Disable the legacy protocols you can turn off without a project — SMBv1, TLS 1.0/1.1, basic authentication	Rank legacy systems by exposure and business impact; Isolate the worst offenders that cannot be retired yet
IT-06 — Risk-based vulnerability management	Confirm scanning covers internet-facing systems; Check for any known-exploited vulnerabilities already public	Run an authenticated scan across endpoints and servers and confirm it covered the full inventory; Check your estate against the known-exploited vulnerability catalogue and remediate those findings first	Run authenticated scans across endpoints and servers; Set remediation SLAs by severity
OT-05 — OT vulnerability management	Cross-reference the OT inventory against known-exploited and vendor advisories; Flag any internet-reachable OT device	Cross-reference the inventory against vendor advisories and the known-exploited catalogue, and rank by exposure and process impact; Apply compensating controls — isolation, access restriction — to the worst findings you cannot safely patch yet	Rank findings by exposure and process impact; Apply compensating controls (isolation, access limits) to the worst that cannot be patched now
IT-09 — Backup and disaster recovery	Confirm critical systems and CUI are actually being backed up; Verify at least one copy is offline or immutable	Perform one real test restore of a critical system and time it against what the business expects; Separate backup administration credentials from production administration and enforce MFA on them	Separate backup credentials from production admin accounts and add MFA; Define RTO/RPO for critical systems
OT-04 — OT incident response and recovery	Confirm whether any OT-specific response plan exists; List who to call for an OT incident, including engineers and vendors	Write the one-page version first: who to call, what may never be isolated without the process owner, and where the safe-state procedures are; Confirm backups of controller logic and configuration exist for your most critical line	Draft an OT IR plan with roles, contacts, and safe-state options; Confirm backups of controller logic/config exist
OT-08 — OT system resiliency	Confirm backups exist for controller logic and configurations; List critical single points of failure	Confirm that controller logic, configuration, and set points are backed up for your most critical line, and store a copy off the device; Write down the safe-state and manual-operation fallback with the operators who would use it	Define acceptable downtime for critical processes; Document safe-state and manual-operation fallbacks

Validation and evidence

Practice	First validation check	Evidence to retain
IT-01	Attempt sign-in with password only on a test account — it must fail.	MFA policy with named owner and scope; Identity-policy export showing enforcement
IT-02	Pick ten devices from the network at random; all ten must appear in the inventory with an owner.	Inventory policy naming the owner, sources, and cadence; Inventory export covering hardware, software, cloud apps, and identities
OT-01	Pick a production device and confirm it no longer uses a default or vendor-set password.	OT access-control policy including vendor and break-glass procedures; Account inventory and privilege assignments per system
OT-02	Pick five random devices on the floor; all five must appear in the inventory.	Inventory ownership and update policy; Inventory export with firmware and connectivity fields
IT-05	From a standard user device, attempt to reach a server-zone or management interface — it must be blocked.	Network segmentation design and zone policy; Firewall/ACL rule exports enforcing inter-zone controls
OT-03	From a business-network host, attempt to reach an OT controller directly — it must be blocked.	OT segmentation architecture and zone/conduit policy; Boundary/DMZ and firewall rule exports enforcing default-deny
OT-06	Attempt to reach an OT device remotely without going through the jump host — it must fail.	Remote/vendor access policy with time-bound and emergency procedures; Jump-host/DMZ design and remote-access account settings
IT-03	Confirm no internet-facing system is running unsupported software.	Lifecycle/retirement policy and the funded roadmap; Evidence legacy protocols are disabled and systems are isolated
IT-06	Confirm the last authenticated scan actually covered the full asset inventory, not a subset.	Vulnerability management policy with severity SLAs; Scanner coverage/configuration showing authenticated scans
OT-05	Confirm every high-risk OT vulnerability has either an applied patch or a documented compensating control.	OT vulnerability/patch policy including compensating-control criteria; Vulnerability-to-asset mapping and applied compensating controls
IT-09	Perform an unannounced test restore of a critical system and time it against the RTO.	Backup and DR policy with RTO/RPO targets; Backup job configuration and immutability/offline settings
OT-04	Confirm the OT plan names specific people and reachable after-hours contacts, not just titles.	OT incident-response and recovery plan with roles and safe-state procedures; Inventory of controller logic/config backups used for recovery
OT-08	Test-restore a controller's logic/configuration and confirm the process resumes correctly.	OT resiliency/contingency plan with downtime targets and fallbacks; Controller backup inventory and redundancy/spares list

Limitations

Production and safety come first

Nothing on this list should be actioned on a live operational-technology system without the process owner's agreement, an approved maintenance window, a tested rollback, and a safety review. Where a security action conflicts with safe operation, the safe operation wins and the control is compensated instead.

What this asset is and is not

This is independent educational material. It supports planning and evidence collection; it does not establish compliance with NIST SP 800-171, DFARS 252.204-7012, CMMC, export-control obligations, or any contract requirement, and it is not an assessment. Tailor every item to your own technical, operational, contractual, regulatory, and safety requirements.

All downloads

Printing produces a paginated document. Choose “Save as PDF” in the print dialog and name it batb-30-day-implementation-plan-template to keep filenames consistent across your team.