CMMC Registered
Provider Organization
for DoD Contractors Nationwide
A CMMC Registered Provider Organization (RPO) is a consulting firm authorized by the Cyber AB to help DoD contractors prepare for CMMC: it advises and prepares, and it does not conduct the official certification assessment.
Galaxy Consulting is a veteran-owned Cyber-AB authorized CMMC RPO that gets small DoD contractors ready for their CMMC Level 1 and Level 2 self-assessments — from gap assessment and remediation through the SSP, SPRS score and annual affirmation. We work with defense contractors in every state, remotely and on site by arrangement, from our office in Fort Washington, Maryland. See the markets we serve.
Understanding CMMC
What is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) is a U.S. Department of Defense (DoD) program that requires all DoD prime contractors and subcontractors to verify their cybersecurity practices before being awarded contracts.
If your company handles Federal Contract Information (FCI) — any information provided by or generated for the government under a contract — you are required to meet CMMC Level 1.
If your company handles Controlled Unclassified Information (CUI) — any information provided by or generated for the government under a contract — you are required to meet CMMC Level 2.
CMMC requirements in DoD solicitations and contracts can make the required CMMC level a condition of award. Phase 2 (third-party C3PAO Level 2 certification) is currently suspended, but Level 1 and Level 2 self-assessments still apply, and so do DFARS 252.204-7012 and NIST SP 800-171. Read our explainer: CMMC Phase 2 Is Suspended: What It Means for Small Defense Contractors.
Basic cyber hygiene to protect Federal Contract Information (FCI). Annual self-assessment required. Required for all DoD contractors handling FCI.
Learn moreAdvanced cybersecurity aligned with NIST SP 800-171 r2 to protect Controlled Unclassified Information (CUI). Self-assessment or third-party assessment, as the contract requires.
Learn moreEnhanced practices against advanced persistent threats (APTs). Reserved for the most critical DoD programs. Government-led DIBCAC assessment.
Our Role
What is a CMMC RPO?
A Registered Provider Organization (RPO)is a consulting firm officially authorized by the Cyber AB — the DoD's CMMC accreditation body — to provide advisory and preparation services to organizations seeking CMMC certification.
Read the full guide: CMMC Registered Provider Organization (RPO): what it is, what it can and cannot do, and how to verify one. Starting with NIST SP 800-171? See what a NIST 800-171 gap assessment includes.
RPO (Galaxy Consulting)
Helps you understand requirements, fix gaps, build documentation, and prepare for your assessment. Does NOT conduct the official certification assessment.
C3PAO
An accredited organization that conducts the official CMMC Level 2 certification assessments. Independent from RPOs. Level 3 assessments are conducted by the Government (DCMA's DIBCAC), after a Level 2 C3PAO certification.
OSC (You)
Your company — a DoD prime contractor or subcontractor that must meet the CMMC level its contracts require, usually through a self-assessment affirmed in SPRS.
CMMC RPO questions
What is a CMMC Registered Provider Organization (RPO)?
A CMMC Registered Provider Organization (RPO) is a consulting firm officially authorized by the Cyber AB to provide advisory and preparation services to organizations seeking CMMC certification. It helps you understand requirements, fix gaps, build documentation and prepare for your assessment. It does not conduct the official certification assessment. Galaxy Consulting is a Cyber-AB authorized CMMC RPO.
Is an RPO the same as a C3PAO?
No. An RPO advises and prepares you. A C3PAO is an accredited organization that conducts the official CMMC Level 2 certification assessments, and it is independent from RPOs. Level 3 assessments are conducted by the Government (DCMA's DIBCAC), after a Level 2 C3PAO certification.
What is a CMMC Registered Practitioner (RP)?
A Registered Practitioner (RP) is a Cyber AB-registered professional who guides your team through CMMC preparation. Galaxy Consulting has a Registered Practitioner on staff to guide your CMMC Level 1 and Level 2 self-assessment preparation.
What does CMMC Level 1 support from an RPO include?
A gap assessment against all 17 CMMC Level 1 practices, help implementing the controls and policies that close each gap, documentation including your System Security Plan (SSP), and preparation for the annual Level 1 self-assessment and affirmed score in the Supplier Performance Risk System (SPRS).
What We Do
CMMC Advisory Services
End-to-end CMMC Level 1 preparation — from your first gap assessment to your final SPRS score submission.
Gap Assessment
We evaluate your current security posture against all 17 CMMC Level 1 practices and identify exactly what needs to be fixed before your assessment.
Remediation & Preparation
We help you implement the technical controls, policies, and cybersecurity tools required to close every gap identified in your assessment.
Documentation
We draft your System Security Plan (SSP), policies, and procedures — the written evidence auditors need to confirm your compliance.
RP Staffing
Work with our Cyber-AB Registered Practitioner (RP), who guides your team through CMMC Level 1 and Level 2 self-assessment preparation in clear, actionable steps.
Plan your assessment
CMMC Guides and Tools for Buyers
Level 2 assessment cost
What small contractors pay for readiness, remediation and the assessment, as typical market ranges.
What a CMMC RPO is
RPO vs C3PAO vs Registered Practitioner, and how to verify an RPO on the Cyber AB Marketplace.
C3PAO vs RPO
Who runs the official assessment and who helps you prepare for it.
Assessment checklist
All 110 practices in 14 domains, with point values and the documents to gather.
SPRS score calculator
Mark each requirement met or not met and see your score from 110 to -203.
DFARS 7012, 7019, 7020 & 7021
What each clause in your contract asks of you, and what flows down to subs.
Markets we serve nationwide
CMMC readiness for contractors in every state, with pages for Texas, Hawaii, California, Florida and more.
Maryland, DC & Northern Virginia
On-site CMMC readiness across the National Capital Region, near our office.
NIST 800-171 gap assessment
The service: scope, 2-3 week timeline, deliverables and next steps.
Construction & facilities contractors
FCI vs CUI on a job site, Level 1 vs Level 2, flow-downs and first steps.
Remote nationwide · on site by arrangement
Markets We Serve
We support defense contractors in every state from our office in Fort Washington, Maryland: remotely, with on-site time by arrangement. On-site work is quickest to arrange in Maryland, DC and Northern Virginia. See all markets.
The Journey
How We Get You Assessment-Ready
Initial Consultation
We learn about your business, your DoD contracts, and your current IT environment — no technical jargon, no pressure.
Gap Assessment
Our Registered Practitioner (RP) guides you through all 17 CMMC Level 1 practices to find gaps, and we deliver a clear remediation roadmap.
Remediation & Documentation
We help you fix deficiencies, implement required controls, and produce all required documentation including your SSP.
Self-Assessment & Submission
You complete the annual CMMC Level 1 self-assessment and submit your affirmed score to the Supplier Performance Risk System (SPRS).
Why Choose Us
Why Galaxy Consulting as Your CMMC RPO?
- Cyber-AB authorized CMMC RPO — officially listed in the CMMC marketplace
- Galaxy has completed its own CMMC Level 1 and Level 2 self-assessments — we have done exactly what we guide you through
- A Registered Practitioner (RP) on staff to guide your CMMC Level 1 and Level 2 self-assessment preparation
- Veteran-led firm with 75+ years of DoD and government IT experience
- Plain-English guidance — we make CMMC understandable for small businesses
- Remote delivery to defense contractors in every state, with on-site time by arrangement
- Fixed-scope engagements so you know exactly what you are paying for
Galaxy's CMMC Credentials
Galaxy Consulting is listed in the official Cyber-AB CMMC Marketplace. We have completed our own CMMC Level 1 and Level 2 self-assessments and affirmed them in SPRS — meaning we have done exactly what we are guiding you to do.
Ready to Become CMMC Level 1 Compliant?
Contact Galaxy Consulting today for a free initial consultation. We will assess your current posture and give you a plain-English roadmap to your self-assessment.