These Terms of Service ("Terms") govern your access to and use of CMMC Map, a web-based CMMC Level 2 readiness guide operated by Hydromation Corporation ("Hydromation," "we," "us," or "our"). By creating an account or using the service, you agree to these Terms.

1. Description of Service

CMMC Map is a self-guided readiness tool that helps defense contractors in the Defense Industrial Base (DIB) prepare for CMMC Level 2 certification under NIST SP 800-171. The service provides control walkthroughs, AI-assisted Q&A, document generation templates, and progress tracking. It is an educational and preparation tool — not a certification authority, C3PAO, or legal/compliance service.

2. Eligibility

You must be at least 18 years old and have the legal authority to enter into these Terms on behalf of yourself or your organization. By using CMMC Map, you represent that you meet these requirements.

3. Accounts and Access

4. Subscriptions and Billing

Subscriptions renew automatically each month unless cancelled. You may cancel at any time; cancellation takes effect at the end of your current billing period. No partial-month refunds are issued except as required by law.

5. Acceptable Use

You agree not to:

6. Prohibited Information — No CUI, Classified, or Export-Controlled Data

CMMC Map is a readiness and preparation tool. It is not a FedRAMP-authorized environment and is not designed, intended, or approved for the storage, processing, or transmission of regulated or sensitive government information. You agree that you will not upload, enter, or transmit to the platform any: (a) classified national security information; (b) Controlled Unclassified Information (CUI), including Covered Defense Information (CDI); (c) Federal Contract Information (FCI) that your contracts require you to store only in an authorized environment; (d) technical data controlled under the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR); or (e) any other information that a contract, statute, or regulation prohibits from being stored in a commercial service of this kind. You are solely responsible for determining whether information you submit may lawfully be stored in the service and for all consequences of any submission made in violation of this section. We may, but are not obligated to, monitor for, block, or remove content we reasonably believe violates this section, and may suspend or terminate accounts that do.

7. AI-Powered Features

Certain features of CMMC Map use artificial intelligence, including the Anthropic Claude API, to generate draft content — such as answers, control narratives, System Security Plan (SSP) language, Plan of Action & Milestones (POA&M) items, and other documentation — based on information you provide. AI features are part of the paid plan and are provided through our own managed connection to the AI provider; you do not supply an API key. Requests are subject to fair-use limits, and the content you submit to these features is transmitted to the AI provider for processing. Do not submit CUI or other restricted information to AI features (see section 6).

AI features are disabled by default. An administrator for your organization must enable them in Settings, and AI runs only when you explicitly invoke it — for example, by asking the assistant a question or clicking "Analyze with AI" on an uploaded file. Uploaded evidence is stored without AI analysis unless and until you request analysis of a specific file.

AI-generated content is provided as a starting draft only. It may be incomplete, inaccurate, outdated, or unsuited to your specific circumstances, and may not reflect the most current CMMC, NIST SP 800-171, DFARS, or DoD requirements. You must review, verify, edit, and apply your own professional judgment to any AI-generated content before relying on it or submitting it to any third party or government system. We make no warranty as to the accuracy, completeness, or fitness for purpose of AI-generated content, and AI outputs do not constitute legal, compliance, or assessment advice.

8. AI Assistant Connector (MCP)

Paid plans include a connector, built on the Model Context Protocol (MCP), that lets you link your own AI assistant (such as Claude) to your CMMC Map workspace. The connection is authorized by you through a secure OAuth sign-in, and you may revoke it at any time. You are responsible for the security of the AI assistant account you connect, and for anything that assistant accesses or does at your direction. Your assistant's handling of data retrieved from your workspace is governed by that provider's own terms, not ours. Content your assistant produces from workspace data is AI-generated content subject to Section 7 — a draft you must verify before relying on it. We may suspend or revoke connector access as reasonably needed for security or to protect the service.

9. No Certification; SPRS Submissions and the False Claims Act

CMMC Map helps you organize and track your CMMC readiness. It does not provide legal advice, compliance advice, assessment services, or any form of certification. Scores, dashboards, templates, and other outputs are informational only and are not a determination that you are CMMC-compliant or assessment-ready. Only an authorized CMMC Third-Party Assessment Organization (C3PAO) or the appropriate government authority can issue a CMMC Level 2 certification.

The service may help you estimate a Supplier Performance Risk System (SPRS) score and prepare related documentation. You — including any senior official who affirms a score under DoD's CMMC and DFARS requirements — are solely responsible for the accuracy of all data entered into the service and for any score, attestation, or affirmation submitted to SPRS or any other government system. You acknowledge that submitting inaccurate self-attestations to the U.S. Government may expose you to liability under the False Claims Act and other applicable laws. Hydromation Corporation is not responsible for any submission you make to the government and makes no representation or warranty that any output of the service is accurate or sufficient to support such a submission.

10. No Government Affiliation

Hydromation Corporation and CMMC Map are an independent commercial provider and product. We are not affiliated with, sponsored by, or endorsed by the U.S. Department of Defense, the Cyber Accreditation Body (Cyber AB), the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), the Defense Contract Management Agency (DCMA), the National Institute of Standards and Technology (NIST), or any other government agency. References to CMMC, NIST SP 800-171, FAR, DFARS, SPRS, and similar terms are used for descriptive purposes only and do not imply any partnership, sponsorship, or endorsement.

11. Intellectual Property

The CMMC Map platform, interface, and underlying content are owned by Hydromation Corporation and protected by copyright and other intellectual property laws. NIST SP 800-171 control text is a U.S. Government publication in the public domain. Your organization's data entered into the platform remains your property.

12. Disclaimer of Warranties

THE SERVICE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR THAT ANY GENERATED DOCUMENTS WILL SATISFY YOUR SPECIFIC COMPLIANCE REQUIREMENTS.

13. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, HYDROMATION CORPORATION SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING FROM YOUR USE OF OR INABILITY TO USE THE SERVICE. OUR TOTAL LIABILITY FOR ANY CLAIM SHALL NOT EXCEED THE AMOUNT YOU PAID TO US IN THE THREE MONTHS PRECEDING THE CLAIM.

14. Indemnification

You agree to indemnify and hold harmless Hydromation Corporation and its officers, directors, employees, and agents from any claims, damages, or expenses (including reasonable attorneys' fees) arising from your use of the service, violation of these Terms, or infringement of any third-party rights.

15. Termination

We may suspend or terminate your account at any time for material violation of these Terms, with or without prior notice. You may terminate your account at any time by cancelling your subscription and contacting us at [email protected].

16. Governing Law

These Terms are governed by the laws of the Commonwealth of Virginia, without regard to conflict of law principles. Any disputes shall be resolved in the state or federal courts located in Fairfax County, Virginia.

17. Changes to These Terms

We may update these Terms from time to time. We will notify you of material changes by email or by posting a notice in the application. Continued use of the service after changes become effective constitutes acceptance of the updated Terms.

18. Contact

Questions about these Terms? Contact us at:

Hydromation Corporation
12015 US-50 Suite 600
Fairfax, VA 22033
[email protected]