CMMC Level 1 and Level 2 consulting services for defense contractors
CMMC Level 1 consulting covers scoping where your Federal Contract Information (FCI) lives, a gap assessment against the 17 Level 1 practices, help closing each gap, and preparation for your annual self-assessment and SPRS affirmation. Level 2 work covers the 110 NIST SP 800-171 Rev 2 requirements and adds a System Security Plan (SSP) and POA&M.
Six packages, from a first readiness check to ongoing compliance. A Cyber-AB Registered Practitioner leads every engagement. Veteran-owned and based in Fort Washington, Maryland, we work with defense contractors in every state, remotely and on site by arrangement.
As a Cyber-AB RPO we prepare you; certification assessments are performed by an authorized C3PAO. Galaxy Consulting advises and prepares. We do not conduct CMMC certification assessments and we do not issue CMMC status. C3PAO vs RPO explained, or read what a CMMC Registered Provider Organization can and cannot do.
Who it is for
Small DoD subcontractors
Firms that handle Controlled Unclassified Information (CUI) under DFARS 252.204-7012 and need Level 2.
Companies with a prime asking
Your prime wants your SPRS score, an SSP, or a CMMC status before it adds you to a team.
FCI-only contractors
Firms with Federal Contract Information only, who need a clean annual Level 1 self-assessment.
Companies with a date
You have chosen a C3PAO or a self-assessment date and want to arrive prepared.
Service packages
Take one package or several. Every engagement starts with the free call and a written scope.
Readiness Assessment
A short, scoped first look: which CMMC level your contracts point to, where your FCI or CUI lives, and the handful of gaps that matter most.
What you receive
- Review of your contract clauses (FAR 52.204-21, DFARS 252.204-7012, -7019, -7020, -7021)
- Likely CMMC level and assessment type for each contract
- First draft of your assessment scope and asset categories
- Top-ten gap list and a recommended next step
Best for: Companies that just saw CMMC language in a solicitation or a prime’s flow-down.
Gap Assessment
A practice-by-practice review against the 17 Level 1 practices or the 110 NIST SP 800-171 Rev 2 requirements, with evidence checked, not just interviews.
What you receive
- Written gap report by domain and practice
- Estimated SPRS score using the DoD Assessment Methodology
- Which open items could sit on a POA&M and which cannot (32 CFR 170.21)
- Risk-ranked remediation roadmap with owners and effort
Best for: Companies that need a defensible baseline before spending on tools.
SSP & POA&M
We write the System Security Plan that describes how each requirement is actually met in your environment, and a POA&M that is honest about what is not done yet.
What you receive
- System Security Plan tied to your real systems and boundary
- Plan of Action & Milestones with dates and responsible people
- Supporting policies and procedures (access, incident response, media, configuration)
- Network and CUI data-flow diagrams for the assessment scope
Best for: Companies that have controls in place but lack the written evidence.
Remediation Support
Hands-on help closing gaps with your IT team or managed service provider: configuration, MFA, logging, encryption, account reviews and the evidence trail for each.
What you receive
- Fix list worked in priority order, tracked against the POA&M
- Configuration guidance for identity, endpoints, logging and backups
- External service provider and cloud review (FedRAMP Moderate or equivalent under DFARS 252.204-7012)
- Evidence captured as each practice is closed
Best for: Companies with a gap report and a deadline, but not enough hands.
Mock Assessment Prep
A rehearsal run the way an assessor works: examine, interview and test, objective by objective, using NIST SP 800-171A. You see the weak spots before the real assessment does.
What you receive
- Objective-level walkthrough of every in-scope requirement
- Interview practice for the people an assessor will talk to
- Evidence binder index mapped to assessment objectives
- Findings list and a final fix window before your assessment date
Best for: Companies with a self-assessment or a C3PAO assessment on the calendar.
Ongoing Compliance
CMMC is not one-and-done. We keep the SSP, POA&M and SPRS entry current and prepare your senior official for the annual affirmation.
What you receive
- Quarterly control and evidence check-ins
- SSP and POA&M updates when your systems change
- Annual affirmation preparation for your Affirming Official (32 CFR 170.22)
- Registered Practitioner advice on call for CMMC questions
Best for: Companies that want CMMC kept current without hiring a full-time specialist.
Typical market prices for this work are on our Level 2 cost page. Your quote follows the free call and depends on scope. Every package is delivered remotely to contractors in any state; see the markets we serve.
How an engagement runs
- 01
Free 30-minute readiness call
We go through your contracts, what data you hold and what you already have in place. No obligation.
- 02
Scope and proposal
We agree the assessment scope and pick the packages you need. You get a fixed written scope before work starts.
- 03
Assess
Readiness or gap assessment, with your estimated SPRS score and a ranked fix list.
- 04
Fix and document
Remediation support, SSP and POA&M, evidence collected as each practice closes.
- 05
Rehearse
Mock assessment against the assessment objectives, then a final fix window.
- 06
Assessment and after
You self-assess and affirm in SPRS, or an authorized C3PAO assesses you. We stay on for POA&M closeout and annual affirmations.
What happens at the C3PAO assessment, and how we prepare you
A certification assessment is run by an authorized CMMC Third-Party Assessment Organization (C3PAO), never by your consultant. The C3PAO requirement is suspended for new solicitations while the Department of War reviews CMMC Phase 2, but contractors may still choose a voluntary C3PAO assessment, and many primes ask for one. What the Phase 2 suspension means.
The assessment follows the CMMC Assessment Process in four phases, set by 32 CFR Part 170:
Plan and prepare
You choose an authorized C3PAO from the Cyber AB Marketplace. It confirms your scope, asks for your SSP and evidence list, and may hold a readiness review before the assessment is scheduled.
We hand you a clean scope statement, a current SSP, asset inventory and an evidence index, so this step is short.
Conduct the assessment
The C3PAO assessment team examines documents, interviews your staff and tests systems against each assessment objective in NIST SP 800-171A. Each requirement is scored MET, NOT MET or not applicable.
The mock assessment rehearses exactly this: the same objectives, the same three methods, the same people.
Report results
The C3PAO enters the results in the DoD’s CMMC eMASS system. You receive a Final status, or a Conditional status if only limited items remain open on a POA&M under 32 CFR 170.21.
The gap assessment tells you early which items may sit on a POA&M and which must be fixed before the assessment.
Close out and maintain
Any POA&M items must be closed and verified within 180 days of a Conditional status. A Final status lasts three years, with an affirmation by your senior official every year.
Ongoing Compliance keeps the evidence, POA&M and affirmation on schedule.
As a Cyber-AB RPO we prepare you; certification assessments are performed by an authorized C3PAO. Galaxy Consulting advises and prepares. We do not conduct CMMC certification assessments and we do not issue CMMC status. C3PAO vs RPO explained, or read what a CMMC Registered Provider Organization can and cannot do.
Frequently asked questions
What does CMMC Level 1 consulting include?
Scoping where your Federal Contract Information (FCI) lives, a gap assessment against the 17 Level 1 practices with an estimated SPRS score, help closing each gap, and preparation for your annual Level 1 self-assessment and SPRS affirmation. Level 2 work covers the 110 NIST SP 800-171 Rev 2 requirements and adds a System Security Plan (SSP) and POA&M.
Where does Galaxy Consulting work?
Nationwide. Galaxy Consulting is veteran-owned and based in Fort Washington, Maryland, and works with defense contractors in every state: remotely, with on-site time by arrangement. On-site work is quickest to arrange in Maryland, DC and Northern Virginia. Most readiness work runs well remotely: scoping by video, evidence over a secure file share and documents drafted with your team.
Can Galaxy Consulting issue our CMMC certification?
No. Galaxy is a Cyber AB Registered Provider Organization (RPO). RPOs advise and prepare; they do not assess or certify. A CMMC certification assessment is performed only by an authorized C3PAO, and the C3PAO that assesses you cannot be the firm that consulted for you.
Do we need a C3PAO assessment right now?
Check your contract. The Department of War suspended the CMMC Phase 2 requirements on July 13, 2026, so new solicitations may not require a C3PAO assessment during the suspension. Self-assessments, annual affirmations and DFARS 252.204-7012 still apply, and a voluntary C3PAO assessment remains available.
What happens on the free 30-minute readiness call?
A Registered Practitioner reviews your contract clauses, what kind of data you handle and what you already have in place, then tells you your likely CMMC level and the first things to fix. There is no obligation and no sales deck.
How long does a gap assessment take?
For most small contractors, a NIST SP 800-171 gap assessment takes about two to three weeks from kickoff to written report. Remediation time depends on what the assessment finds.
Book a free 30-minute readiness call
Tell us a little about your contracts and we will reply within one business day to set a time. On the call a Registered Practitioner covers:
- The CMMC and DFARS clauses in your contracts or solicitations
- Whether you hold FCI, CUI or both, and your likely level
- What you already have in place, and the first three things to fix
- Which packages, if any, you actually need
Prefer the phone? 240-324-7888(Mon–Fri, 8 AM–6 PM ET)
As a Cyber-AB RPO we prepare you; certification assessments are performed by an authorized C3PAO. Galaxy Consulting advises and prepares. We do not conduct CMMC certification assessments and we do not issue CMMC status. C3PAO vs RPO explained, or read what a CMMC Registered Provider Organization can and cannot do.