# DoD Leaves Cybersecurity Scope Unclear

The Department of Defense’s “Brilliant at the Basics” cybersecurity practices do not specify which contractor systems, data, personnel, or service providers fall within scope. The practices are guidance, not current contractual requirements, but their broad language may lead contractors to anticipate expanded expectations and uncertain compliance costs. This differs from existing NIST and CMMC scoping provisions intended to define system boundaries and help control costs.

- Contractors should not treat the practices as binding contractual requirements unless DoD makes them mandatory; they can document their current scope assumptions while awaiting clarification.
- Procurement and security teams can compare the cost implications of applying controls to defined enclaves versus enterprise-wide environments, since the guidance does not establish which approach is expected.
- The lack of scoping detail may complicate pricing and risk allocation for defense contractors and their service providers; existing NIST and CMMC scoping provisions offer relevant context for assessing system boundaries.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity
**Published:** October 15, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- National Institute of Standards and Technology (NIST)
- Office of the DoD Chief Information Officer (DoD CIO)

### Vendors
- Summit 7 ()

### Key Quotes
> The increased administrative burden that came with CMMC scoping guidance ... was the single most useful thing in the last decade of defense cyber security requirements for reducing cost and burden.
> — Video speaker (identity unclear)

### Sources
- [Why is there no scoping guide for "Brilliant at the Basics"?](https://www.reddit.com/r/CMMC/comments/1x6okhy/why_is_there_no_scoping_guide_for_brilliant_at) - reddit-cmmc