What the gap assessment is for
A gap assessment compares how your company actually protects contract information with what the CMMC program and NIST SP 800-171 require. It answers three buyer questions: which requirements you already meet, which you do not, and what order to fix them in. If you want the background on the method itself, read our explainer What Is a NIST 800-171 Gap Assessment?. This page is about buying the service from Galaxy Consulting.
It is a readiness review, not an official assessment. Galaxy Consulting is a Cyber-AB Registered Provider Organization (RPO) with a Registered Practitioner (RP) on staff. We are not a C3PAO and we do not conduct official CMMC assessments; we help you prepare for your own self-assessment and SPRS affirmation.
What is included
- Scope and level determination: we confirm whether you handle Federal Contract Information (FCI), Controlled Unclassified Information (CUI) or both, and draw your system boundary.
- A review of every applicable practice: the 17 Level 1 practices or the 110 Level 2 requirements across 14 domains.
- Interviews with the people who run your IT, HR, facilities and contracts.
- Evidence review of settings, screenshots, policies and records against each requirement.
- A written report, a remediation roadmap and an SPRS score estimate, walked through with your leadership.
How it runs, week by week
A gap assessment typically takes two to three weeks. The schedule below is typical; very small or very complex environments move faster or slower.
| When | Phase | What happens |
|---|---|---|
| Week 1 | Kickoff and scoping | Contract and clause review, FCI vs CUI decision, system boundary, asset and data-flow inventory, evidence request list |
| Week 2 | Interviews and evidence review | Practice-by-practice interviews, configuration checks, document review, findings logged by domain |
| Week 2–3 | Report and roadmap readout | Written gap report, risk-prioritized roadmap, SPRS score estimate, recommended path, readout meeting with leadership |
Deliverables you keep
- A review of all applicable practices, each marked met, partially met or not met, with the evidence seen.
- A written gap report organized by domain, such as Access Control, Identification and Authentication, and Media Protection.
- A risk-prioritized remediation roadmap that puts high-value fixes like MFA and encryption first.
- An SPRS score estimate using the DoD Assessment Methodology, which starts at 110 and subtracts 1, 3 or 5 points per unmet requirement, to a minimum of -203. See our SPRS score guide.
- A recommended path: a Level 1 self-assessment or a Level 2 self-assessment.
Level 1 or Level 2 scope
| Level 1 | Level 2 | |
|---|---|---|
| Information | FCI | CUI |
| Requirements reviewed | 17 practices (FAR 52.204-21) | 110 requirements (NIST SP 800-171 Rev 2), 14 domains |
| What follows | Annual self-assessment and annual SPRS affirmation | Level 2 (Self): self-assessment every three years, annual affirmation |
Not sure which applies? Start with the Level 1 guide and the Level 2 guide. During the Phase 2 suspension announced on July 13, 2026, new requirements may only call for Level 1 (Self) or Level 2 (Self), and DFARS 252.204-7012 and NIST SP 800-171 Rev 2 still apply. Details are in our Phase 2 suspension explainer.
What you need to provide
- Your current contracts, subcontracts and any DFARS or CMMC clauses, including flow-downs from primes.
- A list of systems: email, file sharing, cloud apps, laptops, phones, servers and any outside IT provider.
- Existing documents, if any: SSP, policies, procedures, POA&M, network diagrams.
- A point of contact and a few hours from the people who manage IT, HR, facilities and contracts.
- Read-only access or screen-share sessions so we can look at settings rather than take them on trust.
What happens after the report
The roadmap is yours to act on with your own team or with us. Galaxy offers each next step as a separate service:
Remediation
Putting controls in place, including MFA, encryption, patching and verification testing to confirm each fix works.
Documentation
Writing your System Security Plan (SSP), policies and procedures, Plan of Action and Milestones (POA&M), CUI boundary documents and data-flow diagrams.
Self-assessment and SPRS
Supporting your self-assessment against the same requirements and your SPRS submission and affirmation. The Level 2 self-assessment guide explains that process.
See all CMMC services for the full list.
Who leads it
Galaxy Consulting, LLC is a Service-Disabled Veteran-Owned Small Business founded by Charles Cooks, a retired U.S. Army Communications and Electronics Officer. Our Registered Practitioner leads every gap assessment. Galaxy has affirmed its own CMMC Level 1 and Level 2 self-assessments in SPRS. We work from Fort Washington, Maryland, on site across Maryland, DC and Northern Virginia and remotely nationwide. Questions first? Read the CMMC FAQ or contact us.
Frequently asked questions
How long does the gap assessment take?
It typically takes two to three weeks: about a week for kickoff and scoping, a week for interviews and evidence review, and the final days for the written report and the roadmap readout. Larger or more complex environments can take longer.
Is a gap assessment the same as an official CMMC assessment?
No. A gap assessment is a readiness review. Galaxy Consulting is a Registered Provider Organization (RPO), not a C3PAO, and it does not conduct official assessments. The gap assessment shows where you stand and what to fix before your own self-assessment.
Do you cover Level 1 or Level 2?
Both. If you only handle Federal Contract Information, the review covers the 17 Level 1 practices. If you handle Controlled Unclassified Information, it covers the 110 NIST SP 800-171 Rev 2 requirements that make up Level 2.
Will I get an SPRS score?
You get an SPRS score estimate based on the DoD Assessment Methodology: start at 110 and subtract 1, 3 or 5 points for each requirement that is not met, down to a minimum of -203. You remain responsible for the score you submit and affirm in SPRS.
What do I need to provide?
Your contracts and clauses, a list of systems and where contract data lives, any existing policies, SSP or POA&M, and time with the people who run your IT, HR and facilities. We send a short request list at kickoff.
Can Galaxy also fix the gaps it finds?
Yes, if you want that. Galaxy offers remediation, documentation such as the SSP and POA&M, and self-assessment and SPRS submission support. You can also take the roadmap to your own IT team or provider.
Do you do this remotely?
Yes. We work on site across Maryland, DC and Northern Virginia and run gap assessments remotely for contractors anywhere in the United States.
Related CMMC pages
- What is a NIST 800-171 gap assessment?
- How the SPRS score works
- CMMC Level 2 requirements
- All CMMC services
- CMMC assessment checklist
Book a scoping call
Tell us about your contracts and systems in a free 30-minute call. We will confirm your likely CMMC level, outline the scope of the gap assessment and explain what we need from you. No obligation.
General information, not legal advice. Check your own contract clauses with your contracting officer or counsel.