The NSA's Cyber Hygiene Guide Starts With Inventory. Most Inventories Stop at the Firewall.

Executive summary. On September 3, 2026 the National Security Agency published its Best Practices Guide for Cyber Hygiene, a Cybersecurity Information Sheet aimed at defending networks against adversaries who now use AI to accelerate and scale intrusions. The guide is organized into four maturity tiers, and the very first action in the very first tier is not a product purchase. It is an inventory. That is the right call - and it is also where most organizations quietly fail, because the inventory the guide describes is assembled entirely from the inside, while the attackers it is meant to stop enumerate you from the outside.

What the NSA actually published

The document is a Cybersecurity Information Sheet, Version 1.0, dated September 2026 and marked TLP:CLEAR, meaning it can be shared without restriction. It is an NSA publication rather than one of the multi-agency joint advisories, and it is written for network defenders and security leaders in the Department of War, the Defense Industrial Base, and National Security Systems - though the NSA notes it is broadly applicable.

The premise is that adversaries are using AI to automate the intrusion lifecycle, and that this makes poor hygiene more dangerous than it used to be. As the guide puts it, the frequency and scale of targeting “poorly configured and unpatched networks” have increased and will continue to. One detail is worth pausing on: the NSA says these mitigations were validated against AI-generated exploitation plans. This is not a generic best-practice listicle. It is a set of controls tested against the thing it claims to stop.

The guide draws on the NSA’s own red, blue, and hunt operations, and it says those engagements keep surfacing the same problems: default configurations, insufficient segmentation, and inadequate monitoring. It builds on NIST frameworks, the DoD CIO’s Brilliant at the Basics initiative, and the NSA’s Top Ten Cybersecurity Mitigation Strategies, and it asks defenders to hold five principles throughout: defense-in-depth, assume breach, least privilege, continuous validation, and human oversight of AI tools.

The four tiers are progressive and each builds on the last. Tier 0 is immediate risk reduction. Tier 1 is transition and remediation. Tier 2 is security orchestration, automation, and response. Tier 3 is adversarial emulation and final validation.

Tier 0 opens with knowing what you have

Tier 0 is described as the high-impact, low-complexity work that halts common exploits. Its first item is “identify security gaps,” and the first thing under that heading is a complete network inventory. The guide asks for four things:

• Establish a complete network inventory of hardware, software, user accounts, and data flows.
• Map assets to business functions, so risk can be reasoned about in mission terms.
• Identify gaps against security baselines.
• Use automated discovery tools to maintain currency.

Note the sequencing. Inventory comes before MFA, before patch automation, before SIEM, before EDR tuning. The guide is explicit about why: network inventory is foundational, because understanding what assets exist is what makes risk prioritization possible at all. Every control downstream is scoped by that list. Patch what you know about. Segment what you know about. Monitor what you know about. An incomplete inventory does not merely leave a gap - it silently shrinks the scope of every other mitigation you implement.

And note the fourth bullet, which is the one people skip: maintain currency. Not build an inventory. Keep one true.

The inventory in Appendix A is an inside-out inventory

Appendix A of the guide is a technical annex on building the inventory, and it is genuinely useful. Its Table 1 lays out the components to capture: hardware devices down to brand, model, firmware, and MAC address; operating system and application versions; IPs, subnets, VLANs, firewall rules, routing tables, DNS and DHCP; accounts, roles, and ACLs; antivirus, encryption, VPN, IDS and IPS configuration; topology diagrams; asset owners and physical locations; backup and recovery solutions.

Look closely at that list and a pattern emerges. Every single category is populated from a system you already administer. Your switch tells you the MAC addresses. Your DHCP server tells you the leases. Your endpoint agent tells you the OS versions. Your CMDB tells you the owners.

That inventory answers one question extremely well: what did we provision? It is necessary, it is authoritative, and you should build it. But it structurally cannot answer the question that actually gets organizations breached: what exists in our name that nobody provisioned?

The marketing team’s campaign subdomain does not appear in your DHCP logs. The staging environment a contractor stood up in a cloud account you did not know existed has no endpoint agent on it. The acquisition you closed last year brought a DNS zone nobody has audited. None of these are in Table 1, because Table 1 is a mirror. It reflects your intentions back at you.

Attackers do not read your CMDB

The guide names automated reconnaissance as one of the two AI-accelerated techniques it is specifically prioritizing defenses against, alongside living off the land. That framing deserves to be taken literally.

An adversary has no access to your inventory. They start where anyone can start: your domain name. From there they walk outward through certificate transparency logs, DNS records, passive datasets, JavaScript bundles that name internal API paths, and the small archaeological traces every organization leaves on the public internet. They are not confirming a list. They are building one, and they are building it from a completely different direction than you are.

What AI changes is the economics. Reconnaissance that used to be a skilled analyst’s week of patient work is now cheap, fast, and continuous. That produces an uncomfortable asymmetry: an attacker’s outside-in map of your organization can be more current than your own inside-out one. You update your CMDB quarterly. They re-enumerate whenever they feel like it.

This is the same structural problem we have written about in the modern threat landscape and in why bug bounty scope is your biggest blind spot. The NSA guide arrives at the same door from the direction of network defense.

Where OsintR fits

OsintR is our reconnaissance platform, and it is deliberately built to do the outside-in half of Tier 0 item one. It starts from a domain, not from a credential, and it maps what the internet can actually see. Concretely, against the guide:

• Tier 0: “use automated discovery tools to maintain currency.” OsintR enumerates subdomains across many independent sources and performs passive discovery against each host - robots.txt, sitemaps, security.txt, OpenID Connect configuration, web manifests, and favicons - to pull out assets and relationships that were never in anyone’s list. It clusters hosts by fingerprint so that a wall of load-balanced mirrors collapses into the handful of distinct systems actually behind them, which is the difference between an inventory a human will read and one they will not.
• Tier 0: validate patching and configuration. OsintR fingerprints the technology stack per host and cross-references it against CVE data, so “patch your systems” becomes a specific list of internet-facing hosts running something behind.
• Tier 0: “review and eliminate unnecessary network pathways,” and Tier 1: “eliminate shadow IT paths.” OsintR probes each host against 346 curated paths covering admin panels, debug and profiling endpoints, exposed version control directories, environment files, and backup artifacts. These are the unnecessary pathways, and they are almost never in the inventory precisely because nobody meant to create them.
• Appendix B: poor credential hygiene, mitigated by monitoring for leaks. OsintR analyzes JavaScript bundles and inline HTML for exposed secrets - API keys, tokens, hardcoded credentials, revealing comments, hidden form fields, and headers. The guide lists cleartext credentials as a recurring finding from NSA assessments. On the external surface, this is where they live.
• Appendix B: default configurations. Default consoles and management interfaces that are reachable from the public internet surface as findings with the evidence attached.
• Tier 3: adversarial emulation. Reconnaissance is phase one of every red team engagement. The external map is the target list, and having it before the exercise starts means the exercise spends its time on exploitation rather than discovery.

On the guide’s point about AI and human oversight

Appendix A encourages using AI as a defensive tool - feeding complete datasets in to get anomaly detection and risk prioritization out - and then immediately qualifies it: combine AI with human hunts, and re-assess after mitigation. “Human oversight of AI tools” is one of the five principles the guide opens with.

We think that caveat is the most important sentence in the appendix, and it matches our experience building OsintR. AI is genuinely good at validating whether a detected string is a live credential or a placeholder, and at summarizing a few hundred hosts into something a human can act on. It is also perfectly capable of generating confident nonsense at scale. The hard engineering in a discovery tool is not finding things; it is not reporting the things that do not matter. An inventory nobody trusts is an inventory nobody reads, and a report that cries wolf three hundred times has done negative work. Most of our development effort goes into suppression and evidence, so that what reaches a person is short, specific, and shows its work.

What OsintR does not do

It is worth being direct about this, because the guide is broad and the temptation to claim coverage is strong. Tier 0 has nine items. OsintR addresses parts of three of them. It does nothing at all for phishing-resistant MFA, network segmentation, SIEM log ingestion, EDR rule tuning, application allowlisting, user activity baselines, or incident response validation. Those are internal controls, and they need internal tooling and internal work.

OsintR does one slice deeply: it tells you what you have exposed, what is wrong with it, and when something new appears. If a vendor tells you their product covers this guide, read the guide.

If you are in the Defense Industrial Base

This guide is guidance, not regulation. It creates no compliance obligation and there is no assessment against it. But it is written explicitly for the DIB, it reflects what the NSA sees in its own hunt operations, and Appendix C maps every tier activity back to the NSA’s Top Ten Mitigation Strategies. If you are a defense contractor, this is a reasonable read on what your customer thinks good looks like.

It also lands on ground you already have to stand on. An accurate asset inventory is the backbone of your NIST 800-171 configuration management work and of the SPRS score you attest to - and as we argued when CMMC Phase II was suspended, the pause removed an exam, not the coursework. Knowing your true external footprint is coursework.

Where to start

• Build the internal inventory the guide describes. Appendix A Table 1 is a good specification. Use it.
• Then run the outside-in pass separately, from a domain rather than from a credential, and treat it as an independent source of truth rather than a validation of the first list.
• Diff the two. The delta is your real finding. Every asset that appears in the external map but not the internal inventory is something you do not patch, do not monitor, and do not segment, because you did not know it was yours.
• Make it recurring. The guide says maintain currency. A one-time scan tells you about one day.

How Inttelio helps

We run external attack surface discovery with OsintR and turn the output into something you can act on: the assets you did not know about, the exposed pathways, the leaked credentials, and the internet-facing software that is behind on patches - mapped against the tiers in this guide so you can see what you have covered and what you have not. For defense contractors we pair it with 800-171 gap work and an honest SPRS score. If you want to see what your organization looks like from the outside before someone else does, that is the conversation to have.

Source: NSA, Best Practices Guide for Cyber Hygiene, Cybersecurity Information Sheet, September 2026, Ver 1.0 (TLP:CLEAR).