For each IT Top 10 practice there's a simple test that separates 'we have it' from 'it works.' This is that test, at a glance — the outcome an assessor (or an attacker) would actually find. It's a quick self-check; the full step-by-step how-to lives in each practice guide.
The Top 10 at a glance
“What good looks like” isn't a document you bought or a box you checked — it's a result you can demonstrate. Here's the simple validation test for each IT practice.
| Practice | What good looks like |
|---|---|
| IT-01 Phishing-Resistant MFA | A password-only sign-in on a test account fails; admins and remote access use FIDO2/passkeys; legacy auth shows zero. |
| IT-02 Asset Inventory | Point at five random devices — all five are on one current list, each with an owner and a purpose. |
| IT-03 Technical Debt Reduction | The list of unsupported systems shrinks each quarter, and the stubborn ones have funded, dated plans. |
| IT-04 Flexible Stack | For each major tool you can name how you'd replace it, and your controls survive the swap. |
| IT-05 Segmentation | From a normal user PC, the systems you shouldn't reach are genuinely unreachable. |
| IT-06 Vulnerability Management | Exploited, critical findings close in days — and you have the trend line to show it. |
| IT-07 Security in the SDLC | A known-bad change is stopped by the pipeline, not caught by luck in production. |
| IT-08 Secure AI & Data Protection | Staff can name the approved AI tools, and a test paste of fake CUI is blocked. |
| IT-09 Backup & Recovery | A documented restore test exists: from backup to a working system, timed and repeatable. |
| IT-10 Workforce Readiness | Each person can name their role in an incident — because they practiced it this year. |
How to use this
Read each row as a yes/no question about your own program. Where the answer is “not yet,” that's your next priority. For a quick numeric read across all ten, run the self-assessment scorecard; for the step-by-step, open each practice guide.
Notice what every row has in common: it's a demonstrated outcome, not a purchase. That's the difference between a control that passes an assessment and one that only looks good on paper.
Sources
Cloud consoles and federal guidance change; confirm control text and clause language against the official publication that applies to your contract. This article is independent education and does not by itself establish compliance or confer CMMC certification.