Access Gate covers 8 of the OT Top 10.
The Department of War asks the defense industrial base to get the OT fundamentals right. Brilliant at the Basics lists ten of them. Access Gate covers eight out of the box, without touching a machine.
Last updated:
Brilliant at the Basics is the Department of War's push to get the defense industrial base to nail cybersecurity fundamentals. Its OT Top 10 lists ten foundational controls for operational technology.
Trout Software's Access Gate and the OT Top 10:
- covers 8 of the 10 in full out of the box
- contributes to the other two
- enforces all of them in front of the asset, from your existing network, with nothing installed on it
The focus moved from certification to fundamentals.
In July 2026 the Department of War suspended CMMC Phase II and opened a 60-day reform review. Phase II was the mandatory third-party Level 2 certification. The audit mandate is paused, but the security obligation remains. Phase 1 self-assessment and the NIST 800-171 controls that protect CUI still apply, and Brilliant at the Basics is where the fundamentals-first focus now points.
For operators, that is good news. The fastest way to be ready, whichever way the rules land, is to cover the basics on the equipment that is hardest to secure: legacy OT. The OT Top 10 is exactly that list.
Each OT Top 10 control maps to Access Gate.
Each row is a pillar of the Brilliant at the Basics OT Top 10, how Access Gate delivers it, and where to go deeper.
Access Gate delivers five controls without touching a machine.
One agentless overlay delivers these core capabilities. The PLC, HMI and SCADA server stay unchanged, and production keeps running.
Identity and Access Control
MFA is enforced at the network boundary against your identity provider. Every session is tied to a named user, not a shared credential, and the OT asset never sees the identity directly.
Validated Asset Inventory
Netflow ingestion populates a dynamic inventory of every device on the network, including legacy PLCs and HMIs that no agent can reach. That inventory becomes the authorization baseline.
Strict Network Segmentation
An overlay enforces per-asset boundaries on top of the existing network, aligned to IEC 62443 zones and conduits. Safety and control assets can share a VLAN yet stay isolated.
Remote Access Pathways
Vendor and contractor sessions are identity-verified, time-bound, recorded, and revocable, with no standing access or shared credentials left open between visits.
Continuous Monitoring
Every session is logged with user, time, asset, protocol, and payload, hash-chained and signed, then forwarded to your SIEM as audit evidence rather than raw alerts.
The gate is the first service you run, not the last.
Secure your plants today. Control your digitalization tomorrow.
Access Gate puts compute on the wire, next to your assets. Once the gate is in, the same box hosts the services that pull OT in securely: remote access, protocol gateways, DNS and time, historian, update server. Accelerate your digitalization, in control.
Common questions about the OT Top 10.
Brilliant at the Basics is a Department of War CIO initiative that helps the defense industrial base, especially small and mid-sized suppliers, get cybersecurity fundamentals right instead of chasing complexity. It publishes an IT Top 10 and a separate OT Top 10 of foundational controls.
The OT Top 10 is the operational-technology half of Brilliant at the Basics. It lists ten foundational controls for physical operations: Identity and Access Control, Validated Asset Inventory, Strict Network Segmentation, OT-Specific Incident Response and Recovery, Manage Known Vulnerabilities, Remote Access Pathways, Continuous Monitoring, System Resiliency, Supply Chain Security, and Review Processes.
The mandatory third-party CMMC Level 2 certification (Phase II) is suspended, and a reform review is underway. The underlying obligations did not go away: Phase 1 self-assessment and the NIST 800-171 and DFARS controls that protect CUI still apply. Brilliant at the Basics is where that fundamentals-first focus is now pointed, and the OT Top 10 is the operational-technology piece.
Access Gate delivers eight of the ten pillars in full out of the box: identity and access control, asset inventory, network segmentation, vulnerability isolation, remote access, continuous monitoring, resiliency, and review reporting. It contributes to the other two, incident response and supply chain security, through detection and third-party access control.
No. Access Gate enforces at a network boundary in front of the asset. Nothing is installed on the PLC, HMI, or SCADA server, the Layer 2 topology does not change, and there is no production downtime to deploy it.
There are no agents to roll out and no network to re-architect. An Access Gate overlay is typically installed in a day, while a certification-driven program assumes months. You get identity, segmentation, remote access, inventory, and audit as one appliance.
The gate is the first service you run, not the last.
Cover the OT basics with one appliance.
One overlay covers identity, inventory, segmentation, remote access and audit. Nothing to install on machines, no rewiring, no downtime.