Overview
If you provide guard, patrol, or physical security services on federal sites and installations, your contracts, post orders, schedules, incident reports, and access rosters are Federal Contract Information. That triggers FAR 52.204-21 and a CMMC Level 1 self-assessment with an annual SPRS affirmation.
Guard and patrol work is usually Level 1. CUI enters only in narrow cases: sensitive security plans, force protection details, and facility security configurations that the agency marks. Standard guard services run on FCI.
Security contractors run scheduling and reporting systems, guard mobile devices, and an email tenant. Level 1 covers the systems that hold FCI: email and files for post orders and schedules, the office and mobile devices, and the access rosters.
Typical contracts you'll see
- Guard and patrol services on federal buildings and installations
- Access control and visitor management staffing
- Subcontracts under a facilities or security prime
- Special event and surge security contracts
- Set aside security contracts (8(a), HUBZone, SDVOSB)
What FCI actually looks like for you
Anything below is Federal Contract Information and triggers FAR 52.204-21. None of it is CUI on its own.
Common pitfalls in this industry
- Running scheduling and reporting through personal email, which fails FAR 52.204-21 (b)(1)(i) and (iii).
- Sharing one office or guard device login across the team, which fails (b)(1)(i) and (ii).
- Leaving access rosters and post orders unsecured at the guard post, which works against (b)(1)(viii).
- Letting subcontract guards use the owner's credentials.
- Assuming guard services are out of scope. The FCI in the contract and rosters is what triggers CMMC.
- Treating marked security plans as Level 1 when they are CUI.
Your Level 1 action plan
- 01Inventory the systems that hold contract FCI: scheduling and reporting tools, office and guard devices, email, and backups.
- 02Move contract email and scheduling onto a paid Microsoft 365 or Google Workspace tenant with MFA enforced.
- 03Give office staff and supervisors named accounts and protect guard mobile devices with passcodes and encryption.
- 04Set post order and roster access to least privilege so only the assigned team can see them.
- 05Secure access rosters and post orders at the guard post, and keep a visitor log.
- 06Write a short boundary description naming the systems that hold contract FCI and who can access them.
- 07Run the 15 practice self-assessment, then have a senior official affirm the score in SPRS and re-affirm annually.
Most common NAICS codes
Use these when searching SAM.gov, filing for set-asides, or checking size standards.
- 561612Security Guards & Patrol Services
- 561611Investigation & Personal Background Check Services
- 561621Security Systems Services (except Locksmiths)
- 561613Armored Car Services
- 561210Facilities Support Services
Frequently asked questions
Q.We just provide guards on a federal site. Do we need CMMC?
Yes, once you hold a federal contract or subcontract. The contracts, post orders, schedules, and access rosters are Federal Contract Information, and FAR 52.204-21 applies to the systems that hold them. The 15 practices apply to your scheduling and reporting systems and email, not to the guards on post.
Q.Could security services be Level 2?
In narrow cases. If the agency gives you marked security plans, force protection details, or facility security configurations under DFARS 252.204-7012, that work is Level 2 and needs a controlled boundary. Standard guard and patrol services are Level 1.
Q.Does the prime cover us as a security sub?
No. CMMC flows down. If you receive FCI from the prime, you have your own FAR 52.204-21 obligation and need your own SPRS affirmation. The prime cannot affirm for you.
Q.Do I need an SSP at Level 1?
No. Level 1 does not require a System Security Plan under 32 CFR Part 170. You need evidence the 15 practices are met for the systems that hold FCI, plus a short boundary description and a current list of authorized users.
Related clauses
Related terms
Read more in the Library
- CMMC Level 1: All 15 FAR Safeguarding Requirements Explained in Plain English (2026 Guide)Every CMMC Level 1 safeguarding requirement, in language a non-cybersecurity founder can act on — what each control means, what evidence satisfies it, and where teams trip up.
- CMMC Level 1: The Complete 2026 Guide for Small DoD ContractorsThe single page to read first. What CMMC Level 1 is, who it applies to, what's actually required, what it costs, and the fastest honest path through it in 2026.
- How to Do CMMC Level 1 Yourself (Free, Complete Guide) — 2026CMMC Level 1 is self-assessed. You don't need a consultant. Here is the entire DIY path, with every template you'll need, written for the small defense contractors actually doing the work.
- CMMC Level 1 Scoping — How to Draw the Boundary (Free Worksheet) — 2026Treating the whole company as in-scope doubles your work for no compliance benefit. Here's the right way to scope CMMC Level 1.
- What to Tell Your Prime When They Ask for Your SPRS Score (And You're Level 1)If your prime is asking for a 0–110 SPRS score and you're a Level 1 contractor, the answer is not zero. It's that you're a different tier of the regulation. Here's how to say that without losing the contract.
- CMMC Level 1 vs Level 2: Which One Do You Actually Need? (2026 Plain-English Guide)Most small defense contractors are Level 1, not Level 2 — but the wrong answer here costs you a year and tens of thousands of dollars. Here's the single question that decides it.