The defense industrial base in Northern Virginia
Northern Virginia is home to the Pentagon, Fort Belvoir, the Defense Logistics Agency and the National Geospatial-Intelligence Agency, and to the headquarters of several of the largest defense prime contractors. The corridors through Arlington, Tysons, Reston, Herndon and Chantilly hold government contractors of every size, from global primes to small subcontractors.
That makes CMMC flow-downs a daily fact of life here. A prime that must protect CUI under DFARS 252.204-7012 passes those requirements, and the CMMC level, down to its subcontractors. If you are a small firm on a prime’s team, expect to be asked for your SPRS score and your CMMC status.
Further south, Marine Corps Base Quantico, Naval Surface Warfare Center Dahlgren and the Hampton Roads naval hub around Norfolk support their own supplier bases. We support contractors across Virginia, with on-site work most practical in Northern Virginia.
Defense hubs in and near Northern Virginia
These are well-known public installations and industry clusters, listed for orientation only. Galaxy Consulting does not claim to work with these installations or with their contractors.
| Hub | General mission area |
|---|---|
| The Pentagon (Arlington) | Department of Defense headquarters |
| Fort Belvoir | Defense Logistics Agency headquarters; NGA campus nearby in Springfield |
| Marine Corps Base Quantico | Marine Corps training, education and systems acquisition |
| Naval Surface Warfare Center Dahlgren | Navy weapons and systems research and development |
| Hampton Roads / Naval Station Norfolk | Major Navy fleet hub, shipbuilding and ship repair |
How we work with Northern Virginia contractors
Galaxy Consulting works remotely and on site by arrangement from its base in Fort Washington, Maryland. Northern Virginia is part of our home market, so on-site sessions, office walk-throughs and evidence reviews are straightforward to schedule.
- Free 30-minute readiness call. We read your clauses and talk through your likely level.
- Scope and level determination. We map your system boundary and separate FCI from CUI, so Level 1 or Level 2 covers only what it must.
- Gap assessment. A practice-by-practice review with a written gap report, a prioritized remediation roadmap and an SPRS score estimate. See what a NIST 800-171 gap assessment includes.
- Remediation and documentation. Control implementation support, the System Security Plan (SSP), policies, procedures and POA&M.
- Self-assessment and SPRS support. Help with your self-assessment, SPRS submission and annual affirmation.
The full list is on our CMMC services page.
Where CMMC stands today
The CMMC program rule, 32 CFR Part 170, took effect on December 16, 2024, and the contract clause, DFARS 252.204-7021, on November 10, 2025, which started Phase 1. On July 13, 2026 the Department of War (DoD) suspended the move to Phase 2. During the suspension, new requirements may only call for Level 1 (Self) or Level 2 (Self), and DFARS 252.204-7012 and NIST SP 800-171 still apply. Read what the Phase 2 suspension means.
Who you would work with
Galaxy Consulting, LLC is a Service-Disabled Veteran-Owned Small Business (SDVOSB) and a Cyber-AB authorized CMMC Registered Provider Organization (RPO), with a Registered Practitioner (RP) on staff to guide your CMMC Level 1 and Level 2 self-assessment preparation. Galaxy has affirmed its own CMMC Level 1 and Level 2 self-assessments in SPRS.
Other markets we serve
We support defense contractors in every state. These pages describe the defense industrial base in other areas where we work remotely and on site by arrangement; see all markets we serve.
- CMMC in Washington, DC
- CMMC in Maryland
- CMMC in San Antonio, TX
- CMMC in Honolulu, Hawaii
- CMMC in San Diego, CA
- CMMC in Seattle, WA
- CMMC in Dallas-Fort Worth, TX
- CMMC in Missouri
- CMMC in Colorado
- CMMC in Los Angeles, CA
- CMMC in Arizona
- CMMC in Utah
- CMMC in Huntsville, AL
- CMMC in Florida
- CMMC in Dayton, OH
- CMMC in Massachusetts
- CMMC in Oklahoma
- CMMC in North Carolina
- CMMC in Georgia
Frequently asked questions
Our prime asked for our SPRS score. What does that mean?
Your SPRS score comes from a self-assessment against the 110 requirements of NIST SP 800-171. It starts at 110 and loses 1, 3 or 5 points for each requirement not met. Primes ask for it to confirm that subcontractors handling CUI meet DFARS 252.204-7019 and 7020.
Do you work on site in Northern Virginia?
Yes, by arrangement. Galaxy Consulting is based in Fort Washington, Maryland, across the Potomac from Northern Virginia, and works on site across Maryland, DC and Northern Virginia as well as remotely.
Where is Galaxy Consulting based?
Galaxy Consulting is based in Fort Washington, Maryland, in Prince George’s County just south of DC. We work remotely and on site by arrangement across Maryland, DC and Northern Virginia, and remotely with contractors nationwide.
Can Galaxy Consulting certify my company for CMMC?
No. Galaxy Consulting advises and prepares; it does not certify. As a Registered Provider Organization (RPO) we help you get ready and support your self-assessment. Official CMMC Level 2 certification assessments are conducted by an authorized C3PAO, and Level 3 assessments by DCMA’s DIBCAC.
Related CMMC pages
- CMMC overview: what an RPO does and how we help
- CMMC services and the free readiness call
- What a CMMC Registered Provider Organization (RPO) can and cannot do
- What a NIST 800-171 gap assessment includes
- CMMC readiness across Maryland, DC and Northern Virginia
- All markets we serve nationwide
Book a free 30-minute call about CMMC in Northern Virginia
Galaxy Consulting is a veteran-owned Cyber-AB Registered Provider Organization (RPO) based in Fort Washington, Maryland, working with Northern Virginia contractors remotely and on site by arrangement. A free 30-minute readiness call covers your contract clauses, your likely CMMC level and what to fix first. No obligation.
General information, not legal advice. Check your own contract clauses with your contracting officer or counsel.