Starting the Brilliant at the Basics Top 10 rarely fails on hard technology. It stalls on avoidable patterns: trying to do all twenty practices at once, mistaking a purchase for a working control, enabling MFA but not enforcing it, treating a vendor spreadsheet as a validated inventory, and never testing a backup restore. Fix these five and you'll move faster than most.
The good news about the Top 10 is that almost none of it requires exotic technology. The bad news is that programs stall anyway — not on the hard parts, but on a handful of predictable patterns. Here are the ones we see most, and the small changes that fix them.
1. Boiling the ocean
Teams try to start all twenty practices at once, spread themselves thin, and finish none. The Top 10 has a recommended sequence for a reason: identity and inventory first, because everything else depends on them.
Pick the first two moves — phishing-resistant MFA for admins and one asset inventory — and finish them before starting anything else. Momentum compounds; scattered effort doesn't.
2. Mistaking 'we bought it' for 'it works'
A purchased tool is not an implemented control. Buying an EDR license, a backup product, or an MFA add-on feels like progress, but an assessor — and an attacker — cares whether it is configured, enforced, and producing evidence.
For every tool, ask: is it turned on for everyone in scope, is it enforced, and can I show a record that it works? If not, it's shelfware, not a control.
3. Enrolling MFA but not enforcing it
The single most common identity gap: MFA is available and some users enrolled, but it is not required. Legacy authentication protocols are often left open, letting attackers bypass MFA entirely.
Enforce phishing-resistant MFA for admins and remote access first, then block legacy authentication. Enrollment without enforcement is not completion.
4. Treating a spreadsheet as a validated inventory
A vendor's asset list or a year-old spreadsheet is a starting point, not a validated inventory. On the OT side especially, the list must be confirmed against reality — and kept current through change control, not re-created once a year.
Validate the list against what's actually there, assign an owner, and tie updates to your change process so it stays true.
5. Never testing a restore
Backups exist; restores are assumed. Then ransomware hits and the team discovers the backups were incomplete, reachable by the attacker, or simply broken. An untested backup is a hope, not a recovery plan.
Restore-test your single most critical system now. One real restore tells you more than a year of green backup dashboards.
What to do instead
- Sequence, don't scatter. Finish identity and inventory before expanding.
- Enforce, don't just enable. A control that isn't required isn't a control.
- Validate, don't assume. Confirm inventories and test restores.
- Keep the evidence. If you can't show it worked, it didn't — for audit purposes.
- Right-size the pace. A steady two-week cadence beats a heroic month that burns out.
Sources
Cloud consoles and federal guidance change; confirm control text and clause language against the official publication that applies to your contract. This article is independent education and does not by itself establish compliance or confer CMMC certification.