When I read CMMC Level 1 it speaks extensively to patching, but when I review NIST there is clarity for systems that are not patched but adequately protected in other ways.

Can a system be unpatched and still compliant with Level 1 providing it is protected in other ways such as isolation?