Terms of Service

These Terms of Service ("Terms") govern your access to and use of CMMC Map, also styled CMMCMAP, a web-based readiness tool for the self-assessed CMMC and SPRS obligations of U.S. defense contractors, operated by Hydromation Corporation ("Hydromation," "we," "us," or "our"). By creating an account or using the service, you agree to these Terms.

1. Description of Service

CMMC Map helps contractors in the Defense Industrial Base (DIB) work through the three self-assessed obligations they may carry: the CMMC Level 1 self-assessment, the CMMC Level 2 self-assessment, and the NIST SP 800-171 self-assessment score posted to SPRS. It provides a scoping wizard, plain-English walkthroughs of the requirements, evidence organization, evidence connectors, AI-assisted drafting, generated documents (System Security Plan, Plan of Action and Milestones, policies, and a Readiness Report), and progress tracking. It is a preparation tool, not a certification authority, C3PAO, assessor, or legal or compliance service.

2. Eligibility

You must be at least 18 years old and have the legal authority to enter into these Terms on behalf of yourself or your organization. By using CMMC Map, you represent that you meet these requirements.

3. Accounts, Members, and Access

• You are responsible for maintaining the confidentiality of your login credentials and for enabling multi-factor authentication where your obligations call for it.
• You must notify us promptly at [email protected] if you suspect unauthorized access to your account.
• A workspace owner may invite members. Members see the workspace they are invited to. You are responsible for who you add, for what they do, and for removing them when they should no longer have access.
• You must provide accurate account information, including a company name and a phone number where we can reach you.

4. Plans and Billing

• Free: the scoping wizard, the full assessment against all requirements for your path, your live SPRS score, and your gap list. No card, no time limit. Your work is kept.
• Paid plan ($149 per month): everything in Free, plus generated documents and exports (SSP, POA&M, policies, Readiness Report), the AI assistant and drafting features, evidence connectors, and training records.
• Client workspaces ($75 per month each): a consultant, MSP, or advisor on the paid plan may add separate workspaces for the organizations it serves. Client workspaces are billed to the consultant on the same invoice and prorated when added mid-cycle.

Prices are in U.S. dollars and exclude any applicable taxes. Subscriptions renew automatically each month unless cancelled. You may cancel at any time; cancellation takes effect at the end of your current billing period and your workspace returns to the Free plan with its data intact. No partial-month refunds are issued except as required by law. Subscribers who started on an earlier price keep that price for as long as their subscription remains active. We may change prices for new subscriptions at any time and will give existing subscribers at least 30 days' notice of any change that affects them.

5. Acceptable Use

You agree not to:

• Upload or store actual Controlled Unclassified Information (CUI) or classified data within the platform (see Section 6).
• Reverse engineer, scrape, or attempt to extract the platform's source code or proprietary content.
• Resell access to the service, or represent CMMC Map's output as a certification, assessment result, or government determination.
• Use the service to hold or work on another organization's information without that organization's authorization (see Section 8).
• Violate any applicable law, regulation, or third-party right in connection with your use of the service.

6. Prohibited Information: No CUI, Classified, or Export-Controlled Data

CMMC Map is a readiness and preparation tool. It is not a FedRAMP-authorized environment and is not designed, intended, or approved for the storage, processing, or transmission of regulated or sensitive government information. You agree that you will not upload, enter, or transmit to the platform any: (a) classified national security information; (b) Controlled Unclassified Information (CUI), including Covered Defense Information (CDI); (c) Federal Contract Information (FCI) that your contracts require you to store only in an authorized environment; (d) technical data controlled under the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR); or (e) any other information that a contract, statute, or regulation prohibits from being stored in a commercial service of this kind. You are solely responsible for determining whether information you submit may lawfully be stored in the service and for all consequences of any submission made in violation of this section. We may, but are not obligated to, monitor for, block, or remove content we reasonably believe violates this section, and may suspend or terminate accounts that do.

7. Evidence Connectors

The paid plan lets you connect your Microsoft 365 tenant or Google Workspace domain so the service can read configuration and metadata from it and file the results as evidence. You create and supply the read-only credentials, you represent that you are authorized to grant that access to the tenant, and you are responsible for the account used. The connector reads settings and metadata as described in our Privacy Policy; it does not read the contents of documents, email, or chat, and it does not change anything in your tenant. Evidence the connector files is a record of what it read at that time; deciding whether a requirement is met remains your responsibility. You may disconnect at any time, which removes the stored credentials.

8. Consultant and Client Workspaces

If you use CMMC Map to serve other organizations, each of those organizations gets its own client workspace under your account. You represent that each client has authorized you to hold and work on its information in CMMC Map and to send questions to the client contacts you add. You remain responsible for your professional judgment, your advice, and your relationship with the client; CMMC Map is the tool, not the engagement. Documents generated in a client workspace may carry your name as preparer; the workspace's data belongs to the client. If a client asks us for a copy of its workspace, or asks that it be separated from your account, we will work with both of you to do so. Consultants may describe their use of CMMC Map to clients; they may not describe the service as their own product or represent Hydromation as a party to their engagement.

9. AI-Powered Features

Certain features of CMMC Map use artificial intelligence, including the Anthropic Claude API, to generate draft content such as answers, control narratives, System Security Plan (SSP) language, Plan of Action and Milestones (POA&M) items, and other documentation, based on information you provide. AI features are part of the paid plan and are provided through our own managed connection to the AI provider; you do not supply an API key. Requests are subject to fair-use limits, and the content you submit to these features is transmitted to the AI provider for processing. Do not submit CUI or other restricted information to AI features (see Section 6).

AI features are on when a workspace is created. A workspace owner or admin can switch them off in Settings at any time, and that switch is enforced on our servers. AI runs only when you explicitly invoke it, for example by asking the assistant a question or clicking "Analyze with AI" on an uploaded file. Uploaded evidence is stored without AI analysis unless and until you request analysis of a specific file.

AI-generated content is provided as a starting draft only. It may be incomplete, inaccurate, outdated, or unsuited to your specific circumstances, and may not reflect the most current CMMC, NIST SP 800-171, DFARS, or DoD requirements. You must review, verify, edit, and apply your own professional judgment to any AI-generated content before relying on it or submitting it to any third party or government system. We make no warranty as to the accuracy, completeness, or fitness for purpose of AI-generated content, and AI outputs do not constitute legal, compliance, or assessment advice.

10. AI Assistant Connector (MCP)

Paid plans include a connector, built on the Model Context Protocol (MCP), that lets you link your own AI assistant (such as Claude) to your CMMC Map workspace. The connection is authorized by you through a secure OAuth sign-in, and you may revoke it at any time. You are responsible for the security of the AI assistant account you connect, and for anything that assistant accesses or does at your direction. Your assistant's handling of data retrieved from your workspace is governed by that provider's own terms, not ours. Content your assistant produces from workspace data is AI-generated content subject to Section 9, a draft you must verify before relying on it. We may suspend or revoke connector access as reasonably needed for security or to protect the service.

11. No Certification; Self-Assessments, SPRS Submissions, and the False Claims Act

CMMC Map helps you organize and track your readiness. It does not provide legal advice, compliance advice, assessment services, or any form of certification. Scores, dashboards, generated documents, the Readiness Report, and other outputs are informational only and are not a determination that you are compliant or assessment-ready. Only an authorized CMMC Third-Party Assessment Organization (C3PAO) or the appropriate government authority can issue a CMMC certification, and only your organization can make a CMMC Level 1 or Level 2 self-assessment affirmation.

The service may help you estimate a Supplier Performance Risk System (SPRS) score and prepare related documentation. You, including any senior official who affirms a score or a self-assessment under DoD's CMMC and DFARS requirements, are solely responsible for the accuracy of all data entered into the service and for any score, attestation, or affirmation submitted to SPRS or any other government system. You acknowledge that submitting inaccurate self-attestations to the U.S. Government may expose you to liability under the False Claims Act and other applicable laws. Hydromation Corporation is not responsible for any submission you make to the government and makes no representation or warranty that any output of the service is accurate or sufficient to support such a submission.

12. No Government Affiliation

Hydromation Corporation and CMMC Map are an independent commercial provider and product. We are not affiliated with, sponsored by, or endorsed by the U.S. Department of Defense (Department of War), the Cyber Accreditation Body (Cyber AB), the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), the Defense Contract Management Agency (DCMA), the National Institute of Standards and Technology (NIST), or any other government agency. References to CMMC, NIST SP 800-171, FAR, DFARS, SPRS, and similar terms are used for descriptive purposes only and do not imply any partnership, sponsorship, or endorsement.

13. Intellectual Property

The CMMC Map platform, interface, and underlying content are owned by Hydromation Corporation and protected by copyright and other intellectual property laws. NIST SP 800-171 control text is a U.S. Government publication in the public domain. Your organization's data entered into the platform, and the documents generated from it, remain your property.

14. Disclaimer of Warranties

THE SERVICE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR THAT ANY GENERATED DOCUMENTS OR CONNECTOR RESULTS WILL SATISFY YOUR SPECIFIC COMPLIANCE REQUIREMENTS.

15. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, HYDROMATION CORPORATION SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING FROM YOUR USE OF OR INABILITY TO USE THE SERVICE. OUR TOTAL LIABILITY FOR ANY CLAIM SHALL NOT EXCEED THE AMOUNT YOU PAID TO US IN THE THREE MONTHS PRECEDING THE CLAIM.

16. Indemnification

You agree to indemnify and hold harmless Hydromation Corporation and its officers, directors, employees, and agents from any claims, damages, or expenses (including reasonable attorneys' fees) arising from your use of the service, violation of these Terms, information you submit in violation of Section 6, use of a client workspace without the client's authorization, or infringement of any third-party rights.

17. Termination

We may suspend or terminate your account at any time for material violation of these Terms, with or without prior notice. You may close your account at any time by cancelling any subscription and emailing [email protected]. Data handling after closure is described in our Privacy Policy.

18. Governing Law

These Terms are governed by the laws of the Commonwealth of Virginia, without regard to conflict of law principles. Any disputes shall be resolved in the state or federal courts located in Fairfax County, Virginia.

19. Changes to These Terms

We may update these Terms from time to time. We will notify you of material changes by email or by posting a notice in the application. Continued use of the service after changes become effective constitutes acceptance of the updated Terms.

September 12, 2026 revision: described all three self-assessed paths; replaced the tiered plans with the current Free plan, $149 paid plan, and $75 client workspaces; removed per-tier user limits; added the evidence connector and consultant workspace sections; consolidated contact addresses to [email protected].

20. Contact

Questions about these Terms? Contact us at:

Hydromation Corporation
12015 US-50 Suite 600
Fairfax, VA 22033
[email protected]