Service area · Huntsville, Madison County
Huntsville's defense supply chain, at small-business scale
OneBody works with small Huntsville-area companies in the defense and aerospace supply chain — about an hour from our Jackson County base. Huntsville is Alabama's most populous city, with Redstone Arsenal and Cummings Research Park's 300-plus companies in it. This page is not aimed at the primes. It's aimed at the 10- to 100-person suppliers who receive their requirements and have to answer them.
The scale, and why it doesn't reach a 30-person supplier
Redstone Arsenal is a 38,000-acre federal research and engineering center that hosts over 65 federal organizations and contractor operations, employs over 45,000 people, and manages more than $50 billion in annual federal budgets, per the Huntsville/Madison County Chamber. Cummings Research Park next door is the second-largest research park in the country, with more than 300 companies and 26,000 employees, and 48% of Huntsville residents hold a bachelor’s degree or higher (City of Huntsville). None of that scale reaches down to the shop that just found a DFARS clause in a purchase order.
What flows downhill
Requirements move from the arsenal to the primes to their suppliers, and they do not shrink on the way. A CyberSheath/Merrill Research survey put the median contractor SPRS score at 60 against the required 110, and a Kiteworks–Coalfire study found 57% of surveyed defense-industrial-base leaders had not completed a NIST SP 800-171 gap analysis. Enforcement phases tighten again on November 10, 2026. If a questionnaire is already in your inbox, the path is on the Cybersecurity & CMMCpage — that page is the detail, this one is the geography.
Why work with someone based outside Huntsville
Because the overhead of a Huntsville office would show up in your invoice, and an hour’s drive is not an obstacle to scheduled on-site work. The experience behind the work is 14 years of Department of Defense IT, cybersecurity, and systems engineering. Every engagement is scoped in writing, with the number, before anything starts — and you own the accounts, code, and data from day one.
What we do for businesses here
Cybersecurity & CMMC
CUI scoping, the 800-171 gap assessment most suppliers haven't done, an SSP, and a POA&M in score order. You attest, not us.
See the service →
Fractional CISO & CIO
From $1,500/mo — someone who owns the security program and answers the questionnaires, without a full-time salary.
See the service →
Automation & Custom Software
From $4,000. Quality records, order data, and delivery evidence handled once instead of re-keyed for each customer's portal.
See the service →
Manufacturing & Defense Suppliers
The specific ways small shops and parts suppliers lose money — and what we'd fix first.
See the service →
About an hour away
On-site days are scheduled in advance; monitoring, build work, and status calls run remotely.
Frequently asked questions
Can you get us CMMC certified?
No consultant can — certification comes from an accredited third-party assessor, not from whoever prepares you. What we do is the work before that: CUI scoping, a NIST SP 800-171 gap assessment, the System Security Plan, and a POA&M in score order. CMMC work is quoted after scoping, never sight-unseen.
Does your small-business status matter to us?
It might, if you're a prime tracking small-business subcontracting goals. OneBody is an SBA-certified Service-Disabled Veteran-Owned Small Business, dual-certified SDVOSB and VOSB, CAGE code 17GT3, SAM.gov UEI EVYVLZ1CA1P5, registration active. If you're a commercial buyer, it should not change your decision at all.
We're a 25-person subcontractor with no IT staff. Where do we start?
With the two-week assessment: $3,500 or $4,500 fixed depending on size. It produces a written, ranked list of what your manual work and security gaps cost per year, and the report is yours whether or not you hire us for the fixes.
Got a flow-down requirement and no one to hand it to?
Say “DFARS” when you write in and you go to the front of the line.