The defense industrial base in San Antonio
San Antonio is one of the largest military communities in the country. Joint Base San Antonio brings together Lackland, Randolph and Fort Sam Houston, and JBSA-Lackland is home to Sixteenth Air Force (Air Forces Cyber), which gives the city a deep cyber and intelligence workforce.
Port San Antonio, on the former Kelly Air Force Base, hosts aerospace maintenance, cybersecurity and technology companies, and Fort Sam Houston is home to Brooke Army Medical Center and Army medical training. Around them is a broad base of IT, engineering, logistics, aircraft maintenance and medical-support contractors.
Many of those firms handle CUI such as technical data, maintenance records or controlled program information, which puts them in CMMC Level 2 scope. Others only handle FCI and need Level 1. Working out which applies is the first step.
Beyond the city, South and Central Texas carry their own defense work. Fort Hood near Killeen is one of the Army’s largest installations, Corpus Christi Army Depot overhauls and repairs Army helicopters, and Naval Air Station Corpus Christi and Laughlin Air Force Base in Del Rio train military pilots. We support contractors across Texas remotely; our Dallas-Fort Worth page covers the North Texas aerospace primes.
Defense hubs in and near San Antonio
These are well-known public installations and industry clusters, listed for orientation only. Galaxy Consulting does not claim to work with these installations or with their contractors.
| Hub | General mission area |
|---|---|
| Joint Base San Antonio (Lackland, Randolph, Fort Sam Houston) | Air Force training, cyber and Army medical missions |
| Sixteenth Air Force (Air Forces Cyber), JBSA-Lackland | Air Force cyber, intelligence and information warfare |
| Port San Antonio | Aerospace maintenance, cybersecurity and technology campus |
| Brooke Army Medical Center, Fort Sam Houston | Army medical care and training |
| Fort Hood (Killeen) | Major Army installation in Central Texas |
| Corpus Christi Army Depot | Army helicopter overhaul and repair |
How we work with San Antonio contractors
Galaxy Consulting works remotely and on site by arrangement from its base in Fort Washington, Maryland. We do not have an office or a local phone line in San Antonio. Most CMMC readiness work runs well remotely: scoping workshops and interviews by video, evidence review over a secure file share, and documents drafted with your team. When a walk-through of your facility helps, we arrange on-site time.
- Free 30-minute readiness call. We read your clauses and talk through your likely level.
- Scope and level determination. We map your system boundary and separate FCI from CUI, so Level 1 or Level 2 covers only what it must.
- Gap assessment. A practice-by-practice review with a written gap report, a prioritized remediation roadmap and an SPRS score estimate. See what a NIST 800-171 gap assessment includes.
- Remediation and documentation. Control implementation support, the System Security Plan (SSP), policies, procedures and POA&M.
- Self-assessment and SPRS support. Help with your self-assessment, SPRS submission and annual affirmation.
The full list is on our CMMC services page.
Where CMMC stands today
The CMMC program rule, 32 CFR Part 170, took effect on December 16, 2024, and the contract clause, DFARS 252.204-7021, on November 10, 2025, which started Phase 1. On July 13, 2026 the Department of War (DoD) suspended the move to Phase 2. During the suspension, new requirements may only call for Level 1 (Self) or Level 2 (Self), and DFARS 252.204-7012 and NIST SP 800-171 still apply. Read what the Phase 2 suspension means.
Who you would work with
Galaxy Consulting, LLC is a Service-Disabled Veteran-Owned Small Business (SDVOSB) and a Cyber-AB authorized CMMC Registered Provider Organization (RPO), with a Registered Practitioner (RP) on staff to guide your CMMC Level 1 and Level 2 self-assessment preparation. Galaxy has affirmed its own CMMC Level 1 and Level 2 self-assessments in SPRS.
Other markets we serve
We support defense contractors in every state. These pages describe the defense industrial base in other areas where we work remotely and on site by arrangement; see all markets we serve.
- CMMC in Washington, DC
- CMMC in Maryland
- CMMC in Northern Virginia
- CMMC in Honolulu, Hawaii
- CMMC in San Diego, CA
- CMMC in Seattle, WA
- CMMC in Dallas-Fort Worth, TX
- CMMC in Missouri
- CMMC in Colorado
- CMMC in Los Angeles, CA
- CMMC in Arizona
- CMMC in Utah
- CMMC in Huntsville, AL
- CMMC in Florida
- CMMC in Dayton, OH
- CMMC in Massachusetts
- CMMC in Oklahoma
- CMMC in North Carolina
- CMMC in Georgia
Frequently asked questions
Can a CMMC gap assessment for a San Antonio company be done remotely?
Yes. Scoping workshops, interviews and evidence review all run well by video and secure file share. If a walk-through of your facility helps, we can arrange on-site time.
Which CMMC level do San Antonio aerospace and maintenance suppliers need?
It follows the information you handle. If you hold CUI such as controlled technical data, plan for Level 2 and the 110 NIST SP 800-171 requirements. If you only hold FCI, Level 1 and its 17 practices apply.
Do you support contractors elsewhere in Texas?
Yes. We work with contractors across Texas remotely, including Killeen, Corpus Christi, Austin and Dallas-Fort Worth, with on-site time by arrangement.
Does Galaxy Consulting have an office in San Antonio?
No. Galaxy Consulting is based in Fort Washington, Maryland, and has no office or local phone line in San Antonio. We work with San Antonio contractors remotely, and on site by arrangement when a visit helps.
Can Galaxy Consulting certify my company for CMMC?
No. Galaxy Consulting advises and prepares; it does not certify. As a Registered Provider Organization (RPO) we help you get ready and support your self-assessment. Official CMMC Level 2 certification assessments are conducted by an authorized C3PAO, and Level 3 assessments by DCMA’s DIBCAC.
Related CMMC pages
- CMMC overview: what an RPO does and how we help
- CMMC services and the free readiness call
- What a CMMC Registered Provider Organization (RPO) can and cannot do
- What a NIST 800-171 gap assessment includes
- All markets we serve nationwide
Book a free 30-minute call about CMMC in San Antonio
Galaxy Consulting is a veteran-owned Cyber-AB Registered Provider Organization (RPO) based in Fort Washington, Maryland, working with San Antonio contractors remotely and on site by arrangement. A free 30-minute readiness call covers your contract clauses, your likely CMMC level and what to fix first. No obligation.
General information, not legal advice. Check your own contract clauses with your contracting officer or counsel.