FederalShield blog
CMMC Level 1, in plain English
Practical guidance for small defense contractors on the 15 FAR 52.204-21 requirements and the SPRS affirmation.
October 22, 2026
Is there a CMMC deadline in October or November 2026? (And what about 2028?)
Some pages still warn about a CMMC deadline this fall, and others say CMMC was pushed to 2028. Neither is right for a Level 1 contractor. Here is what actually applies today.
October 22, 2026
PHP2Shell: what small defense contractors should do today
Two critical PHP flaws let attackers take over web servers without a password. If your website, WordPress site or client portal runs on PHP, here is how to check and what to do today.
October 20, 2026
Your annual SPRS affirmation: what a company officer is actually signing
Every year, a senior official at a CMMC Level 1 company affirms in SPRS that the company meets the requirements. Here is what that statement means, who should make it and how to back it up.
October 20, 2026
FCI or CUI? How to tell whether you need CMMC Level 1 or Level 2
The CMMC level your company needs depends on the kind of information you handle. Here is how to tell Federal Contract Information from Controlled Unclassified Information, and what each one means for you.
October 19, 2026
CMMC Phase 2 is paused: what still applies to your Level 1 contract
The third-party assessment phase of CMMC is on hold, but FAR 52.204-21, the Level 1 self-assessment and the annual SPRS affirmation are not. Here is what a small contractor still has to do.