Why CMMC matters so much in this region
The National Capital Region and the surrounding states are one of the places where defense contracting work concentrates in the United States. Washington, DC, Northern Virginia and suburban Maryland host federal headquarters, program offices and the prime contractors and small businesses that support them. Further out, several major Department of War (formerly DoD) installations anchor their own clusters of suppliers and service firms.
If your company supports any of that work, the contract clauses that bring in the Cybersecurity Maturity Model Certification (CMMC) program are likely to reach you, either directly in your own award or through a flow-down from a prime. The rules are the same everywhere; what differs locally is how many of your customers, primes and competitors are dealing with the same requirements at the same time.
Defense hubs across Maryland, DC and Virginia
These are some of the well-known installations and hubs where defense contracting work gathers in the region. We list them for orientation only; Galaxy Consulting does not claim to work with these installations or with their contractors.
| Hub | State | General mission area |
|---|---|---|
| Fort Meade | Maryland | Home to the National Security Agency and U.S. Cyber Command |
| Naval Air Station Patuxent River (Pax River) | Maryland | Naval aviation research, test and evaluation |
| Aberdeen Proving Ground | Maryland | Army test and evaluation |
| Marine Corps Base Quantico | Virginia | Marine Corps training and education |
| Norfolk and Hampton Roads | Virginia | Naval Station Norfolk and a major naval hub |
| National Capital Region | DC, Northern Virginia, suburban Maryland | Federal and defense headquarters, program offices and their contractors |
Firms that support these missions range from engineering, IT and professional services companies to construction, facilities and logistics subcontractors. Each one that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on its own systems falls inside CMMC scope.
Where CMMC stands today
The CMMC program rule, 32 CFR Part 170, took effect on December 16, 2024. The DFARS rule that puts CMMC into contracts, DFARS 252.204-7021, took effect on November 10, 2025, which started Phase 1. On July 13, 2026 the Department of War suspended the move to Phase 2, which had been due on November 10, 2026.
- During the suspension, new requirements may only call for Level 1 (Self) or Level 2 (Self).
- Program offices may not require Level 2 (C3PAO) or Level 3 while the suspension is in effect.
- DFARS 252.204-7012 and NIST SP 800-171 Rev 2 still apply, so CUI safeguarding obligations have not paused.
For a fuller explanation, read what the Phase 2 suspension means for contractors and our plain-language guide to the DFARS 7012, 7019, 7020 and 7021 clauses.
Level 1 or Level 2: the first question to answer
Your level follows the information you handle, not your size or location. CMMC Level 1 covers 17 practices drawn from the 15 requirements in FAR 52.204-21 and applies when you handle FCI. It requires an annual self-assessment and an annual affirmation in the Supplier Performance Risk System (SPRS).
CMMC Level 2 covers the 110 requirements of NIST SP 800-171 Rev 2 across 14 domains and applies when you handle CUI. Level 2 (Self) means a self-assessment every three years with an annual affirmation. Your SPRS score starts at 110 and loses 1, 3 or 5 points for each requirement that is not met, down to a minimum of -203. Our SPRS score guide walks through the math.
How we support contractors in the region
Galaxy Consulting has one Registered Practitioner (RP) on staff and offers the same services on site across Maryland, DC and Northern Virginia and remotely nationwide:
- Free discovery call. We read your clauses and talk through your likely level.
- Scope and level determination. We map your system boundary and separate FCI from CUI.
- Gap assessment. Our RP reviews all 17 Level 1 or 110 Level 2 practices and delivers a written gap report by domain, a risk-prioritized remediation roadmap, an SPRS score estimate and a recommended self-assessment path. See the gap assessment service.
- Remediation. Controls, MFA, encryption, patching and verification testing.
- Documentation. System Security Plan (SSP), policies, procedures, POA&M, CUI boundary documents and data-flow diagrams.
- Self-assessment and SPRS support. Help with your self-assessment, SPRS submission and affirmation.
The full list of offerings is on our CMMC services page.
Why a local, veteran-owned RPO
Galaxy Consulting, LLC is a Service-Disabled Veteran-Owned Small Business (SDVOSB) founded by Charles Cooks, President and CEO and a retired U.S. Army Communications and Electronics Officer. Our office is at 8507 Oxon Hill Road, Suite 200, Fort Washington, Maryland, in Prince George's County just south of DC. Galaxy has affirmed its own CMMC Level 1 and Level 2 self-assessments in SPRS, so we have worked through the same process we help you with.
Our past performance includes work for the Department of Veterans Affairs, U.S. Marine Forces Pacific, the Department of the Navy and Maryland DoIT. Being in the region means we can sit with your team, walk the office or plan room, and look at the actual laptops, shared drives and field devices that make up your scope.
Getting started
Gather your current contracts and any CMMC or DFARS clauses, a rough list of where contract information lives (email, file shares, cloud apps, laptops and phones) and the name of whoever manages your IT. Then book a free readiness call through our contact page or call 240-324-7888. You can also start on your own with the CMMC assessment checklist and the CMMC FAQ.
Frequently asked questions
Does Galaxy Consulting work on site in Maryland, DC and Virginia?
Yes. Galaxy Consulting works on site across Maryland, the District of Columbia and Northern Virginia from its office in Fort Washington, Maryland, and supports contractors elsewhere in the United States remotely.
Is Galaxy Consulting a C3PAO?
No. Galaxy Consulting is a Cyber-AB Registered Provider Organization (RPO) with a Registered Practitioner on staff. It helps you prepare and supports your self-assessment, but it does not conduct official CMMC assessments.
Which CMMC level do contractors in the region need right now?
It depends on the information you handle. Federal Contract Information calls for Level 1, and Controlled Unclassified Information calls for Level 2. During the Phase 2 suspension announced on July 13, 2026, new requirements may only call for Level 1 (Self) or Level 2 (Self).
Do I still have to meet DFARS 252.204-7012 during the suspension?
Yes. DFARS 252.204-7012 and NIST SP 800-171 Rev 2 still apply to contracts that include the clause. The suspension paused the move to Phase 2, not your existing safeguarding obligations.
How long does a gap assessment take?
A gap assessment typically takes two to three weeks, from kickoff and scoping through interviews, evidence review and the report readout.
Can you help a subcontractor that only received a flow-down clause from its prime?
Yes. Many small firms first meet CMMC through a prime contractor flow-down. We start by reading the clause with you, working out whether you hold FCI or CUI, and setting the smallest sensible scope.
Related CMMC pages
- CMMC overview
- NIST 800-171 gap assessment service
- CMMC Level 2 requirements
- CMMC for construction and facilities contractors
- What the Phase 2 suspension means
Talk it through with a Registered Practitioner
Galaxy Consulting is a veteran-owned Cyber-AB Registered Provider Organization (RPO) in Fort Washington, Maryland. A free 30-minute readiness call covers your contract clauses, your likely CMMC level and what to fix first. No obligation.
General information, not legal advice. Check your own contract clauses with your contracting officer or counsel.