Passkey, Patch, and Protect

You have known what to do for a long time, and you already own the platform that does it.

Most breaches come through one of a few doors: a sign-in that could be phished, a system that was not patched, an endpoint nobody was watching, or an incident nobody could reconstruct because no log existed. The controls that close those doors are not new, not controversial, and not expensive. They are settings in the tenant you already pay for: sign-in that cannot be phished, systems that are patched, endpoints that are protected, and logs that exist when something goes wrong.

None of them needs a new product. None needs a consultant. None waits on a regulator, a task force, or a prime contractor marking its documents correctly. The seat belts came with the car. The only step left is to buckle them. Passkey, patch, and protect. Then get back to the work that grows the business.

Two kinds of controls

The 110 requirements of NIST SP 800-171 sit on two different cost curves. The full argument is in Chapter 37: Asset Inventory; the short version follows.

Hygiene controls cost the same per device and per user whether your company holds one CUI document or ten thousand. Multi-factor authentication, patching, antivirus and endpoint detection, least privilege, audit logging. They need no decision about which documents are CUI, no scoping ruling, and no assessor. A machine can check most of them. Apply them to every device you own and never vary them by data sensitivity.

Boundary controls cost more with every system, vendor, facility, and person inside the boundary. Validated encryption on every component that touches CUI, FedRAMP equivalency for every cloud service, the 72-hour reporting clock, media and personnel and physical process controls, specialized equipment. These depend on marking and scope: on a prime labeling what it sends you, on a scoping position an assessor will accept, on which cloud services count. They are the arguments worth having, and the place where outside help earns its fee. Have them after the hygiene tier is built, not instead of building it.

A compliance program that is stuck is nearly always stuck on the second kind, with the first kind still unfinished. Finish the first kind. It takes a quarter, and nothing anyone decides will change it.

What the Department said

In July 2026 the Department of War paused the third-party certification phase of the Cybersecurity Maturity Model Certification program (CMMC), with no restart date as of late October. The contract did not pause with it: DFARS 252.204-7012 still requires every contractor that handles Controlled Unclassified Information (CUI) to implement NIST SP 800-171 and to report a cyber incident within 72 hours, DFARS 252.204-7019 and 7020 still require a self-assessment score in the Supplier Performance Risk System (SPRS) that a senior executive affirms, and the Department of Justice has settled False Claims Act cases over scores that did not match the tenant behind them.

Alongside the pause, the DoW Chief Information Officer published a "Brilliant at the Basics" campaign: a voluntary top-ten list of IT practices for the defense industrial base, with a companion list for operational technology (published at dowcio.war.gov/BrilliantBasics/). Read it as the hygiene tier in the Pentagon's own words: phishing-resistant MFA is item one. Two things are missing from it on purpose. It does not say how to implement any practice on a given platform, and it ships no assessment method or evidence standard. The government told you what. It left how, and how to prove it, to you.

The crosswalk: ten practices on one tenant

The table below is the missing layer for a Microsoft 365 or GCC High tenant. For each practice it names what the practice means in tenant terms, where the free online edition of Securing GCC High walks through the build, and what proves the practice is in place: check IDs from the 75-check assessment framework and policy rows from the Open Intune Baseline Layer 1 deployment. Rows 1 and 6 are passkey, patch, and protect; start there. Three practices sit mostly outside a tenant, and the table says so rather than forcing a fit.

#	Practice (DoW CIO)	On a Microsoft 365 or GCC High tenant	Where the book shows how	What proves it
1	Phishing-resistant MFA	Passkeys, Windows Hello for Business, or certificate-based sign-in for everyone; a Conditional Access authentication strength that refuses anything weaker; SMS and voice turned off	Chapter 9: Phishing-Resistant Authentication; Chapter 14: Conditional Access	Checks I06, I09, I10, I11; OIB Layer 1 row 6 (Windows Hello for Business)
2	Comprehensive asset inventory management	Every device enrolled in Intune with no gap against the Entra device list; labeled data visible in Content Explorer; cloud apps and app registrations discovered and governed	Chapter 37: Asset Inventory	Checks D01, A01, A04; the Entra-versus-Intune gap report in Chapter 37
3	Strategic technical debt reduction	Legacy authentication blocked; POP and IMAP off; legacy MFA and self-service password reset policies migrated; the Group Policy estate retired into Intune policy by policy	Chapter 35: GPO-to-Intune Migration; Chapter 14: Conditional Access	Checks I08, I20, E10
4	Flexible, modular technology stack	Cloud-only Entra join, Autopilot provisioning, no gold images: a device you can rebuild from code in an afternoon	Chapter 18: Entra Join; Chapter 17: Provisioning with Windows Autopilot	A posture, not a single check: the evidence is check D01 plus a rebuild you have actually done
5	Logical segmentation to limit lateral movement	CUI contained on Azure Virtual Desktop session hosts behind Azure Firewall; Windows Firewall on every endpoint; Conditional Access that admits only compliant devices	Chapter 21: AVD Dedicated Sovereign Tenant; Chapter 22: AVD Enclave in Existing Tenant	Checks D09, D13, N02; OIB Layer 1 row 5 (Windows Firewall)
6	Risk-based vulnerability management	Defender for Endpoint on every device with its vulnerability data flowing; Windows Update for Business enforced; attack surface reduction and exploit protection on; risk-based Conditional Access for identities	Chapter 31: Defender for Endpoint; Chapter 50: Threat Defense	Checks D04, D07, D10, I22, I23; OIB Layer 1 rows 1, 15, 17
7	Integrate security early in the development lifecycle	Mostly outside a tenant guide. The tenant-side piece is governance of app registrations and OAuth consent	Chapter 37: Asset Inventory (cloud application inventory)	Checks A02, A03, A04, A05, I12, I13
8	Secure AI adoption and data protection	Sensitivity labels with encryption on CUI; data loss prevention including the Microsoft 365 Copilot location; Copilot grounded only on data the asker may already see	Chapter 42: Sensitivity Labels; Chapter 43: Data Loss Prevention Policies; Chapter 48: Copilot Data Readiness; Securing Copilot	Checks P01 to P05, P08, P09
9	Resilient backup and disaster recovery	Azure Backup for session hosts and provisioning state. Microsoft 365 retention is not backup, and organization-wide disaster recovery is outside a tenant guide	Chapter 21: AVD Dedicated Sovereign Tenant	No Tier 1 check; the evidence is a restore you have rehearsed
10	Continuous technical workforce readiness	A program, not a tenant control	The Awareness and Training rows (3.2.x) in Appendix A carry the compliance mapping	Training records, not telemetry

Every row in the first six practices can be checked by a machine against the live tenant. That is the evidence standard the campaign left out, and it is the part a contractor can generate for itself.

Why this holds under every outcome

Suppose certification comes back. Everything above is the assessment preparation an assessor expects to find, and the telemetry that proves it is the evidence package. Suppose it does not, and self-assessment with government spot checks becomes the permanent model. Everything above is what the SPRS score and the executive's affirmation rest on. Suppose nothing is decided for another year. The same settings are the first thing a cyber insurer, a prime, or an incident responder asks about, and they are the ones you can finish this quarter.

There is no version of the next two years in which doing the basics was the wrong call. Passkey, patch, and protect. Then get back to the work that grows the business.