Terms of Service

Last updated: February 2026

1. Agreement

By purchasing or using CMMC for Microsoft 365, you agree to these terms. CMMC for Microsoft 365 is a product of phraCTO LLC.

2. Product Description

CMMC for Microsoft 365 is a digital reference product providing pre-authored compliance content for CMMC Level 2 / NIST 800-171. It is not software-as-a-service. It is an information product delivered through a web application.

3. License & Access Term

Each purchase grants a single-user, non-transferable, non-exclusive license to access the product content for an initial term of three (3) years from the date of purchase (the “Initial Term”). At the end of the Initial Term, your license automatically renews for successive one-year terms at no additional cost, provided the Service remains available. No action is required on your part to renew.

One account per purchase. Accounts may not be shared, resold, sublicensed, or transferred to another individual or organization. Content updates published during your active license term are included at no extra charge.

4. Permitted Use

You may read, copy, and incorporate the reference content (SSP language, policies, procedures, configuration instructions, evidence guidance) into your own compliance documentation, System Security Plans, and internal processes.

5. Restrictions

  • No redistribution, republication, or resale of the content in any form.
  • No automated scraping, bulk downloading, or systematic copying of content.
  • No sharing of account credentials.
  • No derivative works based on the content for commercial distribution.
  • Content is watermarked and access is logged for intellectual property protection.

6. Intellectual Property

All content, design, and code within CMMC for Microsoft 365 is the intellectual property of phraCTO LLC. Your license grants usage rights for your own compliance purposes only — not ownership of the underlying content.

7. Disclaimer

CMMC for Microsoft 365 is a reference tool. It is not legal advice, compliance advice, or a guarantee of CMMC assessment outcomes. Content is provided “as-is” without warranty of any kind, express or implied. You are responsible for your own implementation and compliance decisions. phraCTO LLC makes no warranty that the content is error-free or that use of the content will result in a successful CMMC assessment.

8. Limitation of Liability

To the maximum extent permitted by law, phraCTO LLC's total liability arising from your use of the product shall not exceed the amount you paid for your license. phraCTO LLC shall not be liable for any indirect, incidental, consequential, or punitive damages.

9. Refund Policy

All sales are final. No refunds are provided. See our Refund Policy for details.

10. Termination & Discontinuation

We reserve the right to suspend or terminate access for violations of these terms, including unauthorized redistribution, scraping, or account sharing. No refund will be issued upon termination for cause.

We may discontinue the Service at our discretion by providing at least ninety (90) days' written notice to the email address associated with your account. Upon discontinuation, your license ends at the conclusion of the notice period. No refund or pro-rata credit is due upon discontinuation, as the one-time purchase price reflects the content delivered at the time of purchase.

11. Analytics

We use Google Analytics (GA4) to collect anonymized usage data, including pages visited, session duration, device type, and referral source. This data helps us understand how the Service is used and improve the user experience. Google Analytics uses cookies to distinguish unique users; no personally identifiable information is collected through this service. You may opt out by installing the Google Analytics Opt-out Browser Add-on. For more details, see our Privacy Policy.

12. Governing Law, Dispute Resolution & Binding Arbitration

12(a) Governing Law. These Terms are governed by the laws of the State of Georgia, without regard to conflict-of-law principles. The Federal Arbitration Act (“FAA”) governs the interpretation and enforcement of the arbitration provisions in this Section 12.

12(b) Mandatory Binding Arbitration. Except as expressly provided below, any dispute, claim, or controversy arising out of or relating to these Terms, the Service, or your relationship with phraCTO LLC (“Dispute”) shall be resolved exclusively through final and binding arbitration rather than in court.

12(c) Arbitration Rules & Venue. Arbitration shall be administered by the American Arbitration Association (“AAA”) under its Commercial Arbitration Rules then in effect. The arbitration shall be conducted by a single arbitrator. Unless the parties agree otherwise, the seat of arbitration shall be Atlanta, Georgia. The arbitrator's award shall be final, binding, and enforceable in any court of competent jurisdiction.

12(d) CLASS ACTION / COLLECTIVE ACTION WAIVER. YOU AND PHRACTO LLC AGREE THAT EACH PARTY MAY BRING DISPUTES AGAINST THE OTHER ONLY IN AN INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, CONSOLIDATED, OR REPRESENTATIVE ACTION. THE ARBITRATOR MAY NOT CONSOLIDATE MORE THAN ONE PERSON'S CLAIMS AND MAY NOT PRESIDE OVER ANY FORM OF CLASS OR REPRESENTATIVE PROCEEDING.

12(e) Arbitration Fees. If your claim does not exceed the amount you paid for the Service (currently $997), phraCTO LLC will bear the filing, administration, and arbitrator fees. Otherwise, costs shall be allocated in accordance with AAA rules.

12(f) Small Claims Court Exception. Either party may bring an individual action in small claims court for Disputes within that court's jurisdictional limits.

12(g) Injunctive Relief for IP Claims. Nothing in this section prevents either party from seeking injunctive or other equitable relief in a court of competent jurisdiction to protect its intellectual property rights, including but not limited to claims arising under Sections 5 and 6 of these Terms.

12(h) 30-Day Opt-Out Right. You may opt out of this arbitration provision by sending written notice to support@cmmcm365.us within thirty (30) days of your first purchase. The notice must include your full name, email address associated with your account, and a clear statement that you decline arbitration. If you opt out, Disputes will be resolved exclusively in the state or federal courts located in Atlanta, Georgia, and you consent to personal jurisdiction in those courts.

12(i) Severability. If the class-action waiver in Section 12(d) is found unenforceable as to a particular claim or request for relief, then the entirety of this Section 12 shall be deemed void for that claim or request for relief only, and such claim or request shall proceed in court.

12(j) Survival. This arbitration provision survives termination of your account and these Terms.

12(k) Limitation Period. Any Dispute must be filed within one (1) year after it arises; otherwise, it is permanently barred.

13. Indemnification

13.1 No Legal or Compliance Advice. CMMC for Microsoft 365 provides pre-authored reference content only. It does not constitute legal advice, compliance advice, consulting services, or a guarantee of any assessment outcome. You are solely responsible for your own compliance decisions and implementations.

13.2 Indemnification Obligation. You agree to indemnify, defend, and hold harmless phraCTO LLC, its officers, directors, employees, agents, and licensors (collectively, “Indemnified Parties”) from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to:

  • your use of (or inability to use) the Service;
  • your breach of these Terms;
  • your violation of any applicable law or regulation;
  • any third-party claim related to your compliance program, System Security Plan, policies, or procedures;
  • your misuse, redistribution, or unauthorized sharing of the content; or
  • any failure to adequately protect Controlled Unclassified Information (CUI) in your environment.

13.3 Notice of Claims. The Indemnified Parties shall promptly notify you of any claim subject to indemnification; provided that failure to provide timely notice shall not relieve your obligations except to the extent you are materially prejudiced by such failure.

13.4 Defense and Control. You shall have the right to assume the defense and control of any claim subject to indemnification, at your own expense and with counsel of your choosing. The Indemnified Parties may participate in the defense at their own expense. You may not settle any claim in a manner that imposes obligations on, or admits fault by, any Indemnified Party without prior written consent.

13.5 Cooperation. The Indemnified Parties shall reasonably cooperate with you in the defense of any claim, at your expense.

13.6 Survival. This indemnification obligation survives termination of your account and these Terms.

14. Trademarks

Microsoft, Azure, Entra, Exchange, Intune, Microsoft 365, Microsoft Defender, Microsoft Purview, Microsoft Sentinel, OneDrive, Outlook, SharePoint, Teams, and Windows are trademarks of the Microsoft group of companies. CMMC for Microsoft 365 is an independent product of phraCTO LLC and is neither affiliated with, nor authorized, sponsored, or approved by, Microsoft Corporation. All other trademarks are the property of their respective owners.

15. Changes

We may update these terms. Continued use after changes constitutes acceptance.

16. Contact

For questions about these terms, contact us at support@cmmcm365.us.

Terms of Service | CMMC M365