CMMC Consultant in Dayton, OH & Wright-Patterson AFB

The defense industrial base in Dayton

Dayton’s defense economy centers on Wright-Patterson Air Force Base, headquarters of Air Force Materiel Command and the Air Force Research Laboratory. The Air Force Life Cycle Management Center runs many aircraft and systems programs from the base, and the National Air and Space Intelligence Center and the Air Force Institute of Technology are there too.

That mix draws research, engineering, software, acquisition-support and test firms to the Dayton region, many of them small businesses doing research or program support under Air Force contracts. Research and engineering work frequently involves controlled technical data, which is CUI.

Elsewhere in Ohio, DLA Land and Maritime in Columbus buys spare parts for land and maritime weapon systems, which reaches manufacturers across the state, and the Joint Systems Manufacturing Center in Lima builds Army combat vehicles. A parts supplier to DLA can need CMMC as much as a research firm next to the base.

Defense hubs in and near Dayton

These are well-known public installations and industry clusters, listed for orientation only. Galaxy Consulting does not claim to work with these installations or with their contractors.

Hub	General mission area
Wright-Patterson Air Force Base	Air Force Materiel Command and Air Force Research Laboratory headquarters
Air Force Life Cycle Management Center	Aircraft and systems acquisition programs
National Air and Space Intelligence Center	Air and space intelligence analysis
DLA Land and Maritime (Columbus)	Spare parts for land and maritime weapon systems
Joint Systems Manufacturing Center (Lima)	Army combat vehicle production

How we work with Dayton contractors

Galaxy Consulting works remotely and on site by arrangement from its base in Fort Washington, Maryland. We do not have an office or a local phone line in Dayton. Most CMMC readiness work runs well remotely: scoping workshops and interviews by video, evidence review over a secure file share, and documents drafted with your team. When a walk-through of your facility helps, we arrange on-site time.

Free 30-minute readiness call. We read your clauses and talk through your likely level.
Scope and level determination. We map your system boundary and separate FCI from CUI, so Level 1 or Level 2 covers only what it must.
Gap assessment. A practice-by-practice review with a written gap report, a prioritized remediation roadmap and an SPRS score estimate. See what a NIST 800-171 gap assessment includes.
Remediation and documentation. Control implementation support, the System Security Plan (SSP), policies, procedures and POA&M.
Self-assessment and SPRS support. Help with your self-assessment, SPRS submission and annual affirmation.

The full list is on our CMMC services page.

Where CMMC stands today

The CMMC program rule, 32 CFR Part 170, took effect on December 16, 2024, and the contract clause, DFARS 252.204-7021, on November 10, 2025, which started Phase 1. On July 13, 2026 the Department of War (DoD) suspended the move to Phase 2. During the suspension, new requirements may only call for Level 1 (Self) or Level 2 (Self), and DFARS 252.204-7012 and NIST SP 800-171 still apply. Read what the Phase 2 suspension means.

Who you would work with

Galaxy Consulting, LLC is a Service-Disabled Veteran-Owned Small Business (SDVOSB) and a Cyber-AB authorized CMMC Registered Provider Organization (RPO), with a Registered Practitioner (RP) on staff to guide your CMMC Level 1 and Level 2 self-assessment preparation. Galaxy has affirmed its own CMMC Level 1 and Level 2 self-assessments in SPRS.

Galaxy Consulting advises and prepares; it does not certify. Official CMMC Level 2 certification assessments are conducted by an authorized C3PAO. Learn what a CMMC RPO does and how it differs in our C3PAO vs RPO comparison.

Other markets we serve

We support defense contractors in every state. These pages describe the defense industrial base in other areas where we work remotely and on site by arrangement; see all markets we serve.

Frequently asked questions

We do research for AFRL. Do we need CMMC Level 2?

Possibly. Fundamental research that will be published is generally not CUI, but controlled technical data and export-controlled results are. Your contract clauses and markings decide your level, so we start by reading them with you.

We sell parts to DLA. Does CMMC apply?

If the contract includes the CMMC clause or DFARS 252.204-7012 and you hold FCI or CUI, yes. Parts orders with controlled drawings usually involve CUI, which calls for Level 2.

Can you support a Dayton company remotely?

Yes. Scoping workshops, interviews and evidence review run well by video and secure file share, and on-site time can be arranged when a visit helps.

Does Galaxy Consulting have an office in Dayton?

No. Galaxy Consulting is based in Fort Washington, Maryland, and has no office or local phone line in Dayton. We work with Dayton contractors remotely, and on site by arrangement when a visit helps.

Can Galaxy Consulting certify my company for CMMC?

No. Galaxy Consulting advises and prepares; it does not certify. As a Registered Provider Organization (RPO) we help you get ready and support your self-assessment. Official CMMC Level 2 certification assessments are conducted by an authorized C3PAO, and Level 3 assessments by DCMA’s DIBCAC.

Related CMMC pages

Book a free 30-minute call about CMMC in Dayton

Galaxy Consulting is a veteran-owned Cyber-AB Registered Provider Organization (RPO) based in Fort Washington, Maryland, working with Dayton contractors remotely and on site by arrangement. A free 30-minute readiness call covers your contract clauses, your likely CMMC level and what to fix first. No obligation.

Free 30-minute readiness call CMMC assessment checklist

General information, not legal advice. Check your own contract clauses with your contracting officer or counsel.

CMMC Consulting for Dayton and Ohio Defense Contractors