The defense industrial base in Hawaii
Oahu is the center of U.S. military activity in the Pacific. U.S. Indo-Pacific Command is headquartered at Camp H.M. Smith, and Joint Base Pearl Harbor-Hickam, Pearl Harbor Naval Shipyard, Schofield Barracks and Marine Corps Base Hawaii at Kaneohe Bay together support a large local base of contractors.
Those contractors include construction and facilities firms, ship repair and maintenance companies, IT and communications providers, and professional services firms. Many are small local businesses working as subcontractors to larger primes, and many are meeting CMMC for the first time through a flow-down clause.
For most of them the question is Level 1 or Level 2. A firm that only handles FCI needs the 17 Level 1 practices and an annual self-assessment; a firm that handles CUI, such as drawings or technical data, needs the 110 requirements of Level 2. We schedule remote sessions in Hawaii business hours.
The neighbor islands have defense work too. The Pacific Missile Range Facility on Kauai tests missiles and missile defense systems, and on Maui the Air Force Research Laboratory runs the Maui Optical and Supercomputing site, with a cluster of optics, space-surveillance and computing firms around it. Construction and facilities contractors across the islands meet CMMC through Navy and Army facilities contracts as well.
Defense hubs in and near Hawaii
These are well-known public installations and industry clusters, listed for orientation only. Galaxy Consulting does not claim to work with these installations or with their contractors.
| Hub | General mission area |
|---|---|
| U.S. Indo-Pacific Command (Camp H.M. Smith) | Combatant command for the Indo-Pacific region |
| Joint Base Pearl Harbor-Hickam | Joint Navy and Air Force base |
| Pearl Harbor Naval Shipyard | Navy ship and submarine maintenance and repair |
| Schofield Barracks | Army installation, home of the 25th Infantry Division |
| Marine Corps Base Hawaii (Kaneohe Bay) | Marine Corps air and ground units |
| Pacific Missile Range Facility (Kauai) | Navy missile and missile defense test range |
| Maui Optical and Supercomputing site (AFRL) | Air Force space surveillance and optics research |
How we work with Hawaii contractors
Galaxy Consulting works remotely and on site by arrangement from its base in Fort Washington, Maryland. We do not have an office or a local phone line in Hawaii. Most CMMC readiness work runs well remotely: scoping workshops and interviews by video, evidence review over a secure file share, and documents drafted with your team. When a walk-through of your facility helps, we arrange on-site time.
- Free 30-minute readiness call. We read your clauses and talk through your likely level.
- Scope and level determination. We map your system boundary and separate FCI from CUI, so Level 1 or Level 2 covers only what it must.
- Gap assessment. A practice-by-practice review with a written gap report, a prioritized remediation roadmap and an SPRS score estimate. See what a NIST 800-171 gap assessment includes.
- Remediation and documentation. Control implementation support, the System Security Plan (SSP), policies, procedures and POA&M.
- Self-assessment and SPRS support. Help with your self-assessment, SPRS submission and annual affirmation.
The full list is on our CMMC services page.
Where CMMC stands today
The CMMC program rule, 32 CFR Part 170, took effect on December 16, 2024, and the contract clause, DFARS 252.204-7021, on November 10, 2025, which started Phase 1. On July 13, 2026 the Department of War (DoD) suspended the move to Phase 2. During the suspension, new requirements may only call for Level 1 (Self) or Level 2 (Self), and DFARS 252.204-7012 and NIST SP 800-171 still apply. Read what the Phase 2 suspension means.
Who you would work with
Galaxy Consulting, LLC is a Service-Disabled Veteran-Owned Small Business (SDVOSB) and a Cyber-AB authorized CMMC Registered Provider Organization (RPO), with a Registered Practitioner (RP) on staff to guide your CMMC Level 1 and Level 2 self-assessment preparation. Galaxy has affirmed its own CMMC Level 1 and Level 2 self-assessments in SPRS.
Other markets we serve
We support defense contractors in every state. These pages describe the defense industrial base in other areas where we work remotely and on site by arrangement; see all markets we serve.
- CMMC in Washington, DC
- CMMC in Maryland
- CMMC in Northern Virginia
- CMMC in San Antonio, TX
- CMMC in San Diego, CA
- CMMC in Seattle, WA
- CMMC in Dallas-Fort Worth, TX
- CMMC in Missouri
- CMMC in Colorado
- CMMC in Los Angeles, CA
- CMMC in Arizona
- CMMC in Utah
- CMMC in Huntsville, AL
- CMMC in Florida
- CMMC in Dayton, OH
- CMMC in Massachusetts
- CMMC in Oklahoma
- CMMC in North Carolina
- CMMC in Georgia
Frequently asked questions
What do CMMC Level 1 services for a Hawaii contractor include?
A review of your clauses and scope, a gap assessment against the 17 Level 1 practices, help closing the gaps, and support with your annual self-assessment and affirmation in SPRS.
Can you support a Honolulu company across the time difference?
Yes. We schedule workshops and interviews in Hawaii business hours and share evidence over a secure file share. On-site time on Oahu can be arranged when it helps.
We are a Hawaii construction or facilities subcontractor. Does CMMC apply to us?
If your DoD contract or subcontract has you hold Federal Contract Information, such as contract schedules or site details, Level 1 applies. If you receive CUI such as controlled drawings or specifications, plan for Level 2. We start by reading your clauses with you.
Does Galaxy Consulting have an office in Hawaii?
No. Galaxy Consulting is based in Fort Washington, Maryland, and has no office or local phone line in Hawaii. We work with Hawaii contractors remotely, and on site by arrangement when a visit helps.
Can Galaxy Consulting certify my company for CMMC?
No. Galaxy Consulting advises and prepares; it does not certify. As a Registered Provider Organization (RPO) we help you get ready and support your self-assessment. Official CMMC Level 2 certification assessments are conducted by an authorized C3PAO, and Level 3 assessments by DCMA’s DIBCAC.
Related CMMC pages
- CMMC overview: what an RPO does and how we help
- CMMC services and the free readiness call
- What a CMMC Registered Provider Organization (RPO) can and cannot do
- What a NIST 800-171 gap assessment includes
- All markets we serve nationwide
Book a free 30-minute call about CMMC in Hawaii
Galaxy Consulting is a veteran-owned Cyber-AB Registered Provider Organization (RPO) based in Fort Washington, Maryland, working with Hawaii contractors remotely and on site by arrangement. A free 30-minute readiness call covers your contract clauses, your likely CMMC level and what to fix first. No obligation.
General information, not legal advice. Check your own contract clauses with your contracting officer or counsel.