CMMC Kit Terms

1. Who sells

The kits, review calls, Annual Refresh, Guided packages, and Hands-on Assessment are sold by Adams Cloud and Cybersecurity LLC, a California limited liability company ("we," "us," or "our"), 10006 Three Oaks Way, Santee, CA 92071. Payment is processed by Stripe, Inc. on its own checkout page.

2. What you receive

There is no subscription for the kits. Prices are in U.S. dollars and are shown on the kit comparison page:

• CMMC Level 1 Self-Assessment Kit, $297 one time. Digital files, delivered by email within minutes of payment as individual download links.
• CMMC Level 2 Self-Assessment Kit, $497 one time. Digital files, delivered the same way.
• Level 1 Kit with Review Call, $697 one time, and Level 2 Kit with Review Call, $997 one time. The kit, plus one review session described in section 7.
• Annual Refresh, planned at $497 for each year. The Annual Refresh is planned and not yet available. Once it opens, it is one payment each year, with a reminder email 14 days before your renewal date. Described in section 8.
• Guided Level 1 Package, $1,995 one time, and Guided Level 2 Package, $4,500 one time. Remote and document based, with no system access and no testing. Described in section 9.
• Hands-on Assessment, quoted per company, from $9,000. We test your actual systems, at a fixed price in a written proposal. On site in San Diego County and Orange County, and in Los Angeles County by arrangement. Described in section 9.

Prices do not include sales tax where the law requires us to collect it.

Download links stay active for 7 days. After that, reply to your delivery email and we will send fresh links. The free Level 1 starter is free and is governed by the notice on its download page.

3. License

Each purchase licenses one company. One company means one legal entity and all of its locations. An affiliated entity that has its own Commercial and Government Entity (CAGE) code needs its own license. Within that company you may adapt the templates, adopt them as the company's own policies, and copy, edit, print, and store the documents and workbooks for the company's own use.

You may not resell, sublicense, redistribute, publish, or share the files, or documents substantially copied from them, with anyone outside your company. You may not use the files to provide services to other companies or clients. A consultant, managed service provider, or other firm that wants to use a kit for clients needs a separate license for each client company. Each client license costs the same as the kit: $297 for Level 1 and $497 for Level 2. We keep all rights not granted here.

4. Header and footer

The kit files carry the Adams Cloud and Cybersecurity header and footer. The files are not stamped with your company name, your email address, or an order reference. You may remove the header and footer from documents you adopt as your own policies and plans. The license limits in section 3 still apply.

5. Refunds

Kits. If a file will not open or the kit is not as described on the sales page, email thabiti@adamscloudcyber.com within 20 days of purchase for a full refund. If you have not downloaded any file, you may ask for a refund within 20 days of purchase for any reason. Because downloaded files cannot be returned, a change of mind after download does not qualify for a refund. This is a refund window for the kit files. It does not guarantee any score, status, or contract result.

Refunds go back to the original payment method through Stripe. A refund ends the license, and the files must be deleted. If we see the same files shared after a refund, or a pattern of purchases followed by refunds, we may decline further orders.

Kits with a review call. The kit portion follows the rule above. For the review call portion, if we cannot hold the call or you cancel before it is held, we will reschedule or refund the call portion. The call portion is $400 for Level 1 and $500 for Level 2. If the review call is not held within 60 days of purchase, and we did not cause the delay, we refund the call portion ($400 for Level 1, $500 for Level 2) minus card processing fees. If the call has already been held, section 6 applies.

Annual Refresh, Guided packages, and Hands-on Assessment. See sections 8 and 9.

6. Correction and refund terms

Review call. If you are not satisfied with a review call, email thabiti@adamscloudcyber.com within 7 days of the session and ask for a free second session of up to 30 minutes. If you are still not satisfied after the second session, we refund the call portion ($400 for Level 1, $500 for Level 2). The kit portion follows section 5.

Guided packages. If the deliverables of a Guided package miss the written scope we confirmed, we correct them at no charge within 30 days of delivery. A refund applies only if we cannot deliver the package. Cancellation before delivery is covered in section 9.

No promise of results. None of these terms is tied to a score, a pass, a certification, or a contract award, and we do not guarantee any of them.

7. What the review call includes

A review call is one session of 45 minutes with Thabiti Adams to review the completed workbook you send before the session. The review covers whether your answers match your evidence, whether any answer looks overstated or unsupported, and what to fix before your senior official affirms. We send written notes within 2 business days after the session.

The review call does not include writing your System Security Plan or policies for you, testing or scanning your systems, a CMMC assessment, a certification, a score we sign off on, submitting anything to the Supplier Performance Risk System (SPRS), or legal advice. Please send the completed workbook at least 2 business days before the session, and do not include Controlled Unclassified Information in it. To book, use the booking link in your delivery email. We offer the first available time within 5 business days of purchase, and a purchased call is valid for 60 days from purchase. If the review call is not held within 60 days of purchase, and we did not cause the delay, we refund the call portion ($400 for Level 1, $500 for Level 2) minus card processing fees. You may reschedule once at no charge with at least 24 hours notice. If you do not attend and do not give notice, the call is used.

8. Annual Refresh

The Annual Refresh is planned and not yet available. This section describes how it is planned to work. The Annual Refresh costs $497 for each year. It includes an updated kit version for the level you use, a re-score check of your workbook, a reminder as your affirmation season approaches, and a short review, which is one 30 minute call booked within 60 days of payment. The Refresh is for a company that owns the kit for that level. We email the refreshed files within 2 business days of payment, or within 2 business days of the yearly release of the refreshed set if that comes later.

One payment each year, with no automatic renewal. By default you pay once for one year, and nothing renews on its own. We email you 14 days before your renewal date, and you renew by paying again.

Refunds. You may ask for a refund within 14 days of any Annual Refresh payment, including a renewal payment, if you have not downloaded the refreshed files or used the review for that period.

9. Guided packages and Hands-on Assessment

Guided packages. A Guided package starts when you contact us by email or telephone. We read what you tell us, reply in writing within 2 business days, and confirm the package, the scope, and the delivery window in writing. You pay only after you agree to that scope, and we send your payment link with the written scope confirmation. If a kit suits you better, we will say so.

Guided packages are remote and document based. The deliverables are based on the information and documents you provide. We do not log in to your systems, scan them, or test them, and we do not verify that your answers are complete or correct. The score estimate in the Guided Level 2 Package is an estimate based on your answers and is not a validated score. Work outside the confirmed scope is quoted separately and is not started without your written agreement. Delivery times depend on you providing complete answers and documents promptly. Guided Level 1 is delivered within 10 business days and Guided Level 2 within 15 business days, counted from the written scope confirmation and your payment. The delivery date moves one business day for each business day we wait on your answers or documents. Each package includes one call: 60 minutes for Level 1 and 90 minutes for Level 2.

Hands-on Assessment. In a Hands-on Assessment we test your company's actual systems. It is quoted per company, starting at $9,000. The terms are:

• Price. A fixed price stated in a written proposal before work begins. The price depends on scope.
• Payment. 50 percent to begin and the remaining 50 percent on delivery of the findings report, by bank transfer (ACH) or check. We send the invoice when you accept the proposal in writing, and work begins once we receive the deposit.
• Written scope first. Before the assessment begins, you sign a one-page assessment boundary worksheet that lists the people, systems, and data in scope.
• Access. Read-only access to the systems in scope, for example a read-only Microsoft 365 assessment account. We make no changes to your environment during the assessment.
• Deliverables. The assessment is measured against all 110 requirements of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 2 and their 320 assessment objectives. You receive a findings report that scores each requirement as met, partially met, or not met; the current SPRS score, confirmed and explained; a prioritized remediation roadmap; and a firm fixed price for any remediation work, which is separate and optional.
• Timeline. We complete the findings package within two weeks once the deposit, the signed scope, and the access are in place.
• Where. On site in San Diego County and Orange County, and in Los Angeles County by arrangement, with any travel cost stated in the written proposal. Outside that area we offer the Guided packages.
• Cancellation. If you cancel before work begins, we refund the deposit in full. After work begins, the deposit is not refundable, and you owe the balance only if we deliver the findings report.
• Upgrade credit. The full amount you paid for a kit is credited toward the Hands-on price.
• No promise of results. We do not promise a score, a pass, a certification, or a contract award.

Upgrade credit. If you move from a kit to a Guided package or a Hands-on Assessment, the full amount you paid for the kit is credited toward the price. If you bought a kit with a review call, the full amount you paid is credited. One credit for each kit purchase. The credit is valid for 12 months from the kit purchase date and is void if the kit is refunded. For example, the $297 Level 1 Kit credited toward Guided Level 1 at $1,995 leaves $1,698 to pay, and the $497 Level 2 Kit credited toward Guided Level 2 at $4,500 leaves $4,003 to pay. We state the credit in the written scope confirmation or quote.

We keep what you send us to scope a package or quote confidential and use it only to prepare your package or quote. We keep those answers for 2 years and order records for 7 years. Please do not send Controlled Unclassified Information, passwords, or technical data.

Refunds. Work on a Guided package begins when we have your payment and the confirmed written scope. If you cancel before work begins, we refund the full price. If you cancel after work begins and before delivery, we refund 50 percent. Deliverables that miss the written scope are covered in section 6.

10. Download records

When a file is downloaded, we record the time, the Internet Protocol (IP) address, the browser type, and the file name with your order. We use these records to confirm delivery, to decide refund requests under section 5, and to respond to payment disputes. They are kept with the order record for seven years, as described in our Privacy Policy.

11. Not a certification, and not legal advice

Not a certification. No kit, review call, Annual Refresh, Guided package, or Hands-on Assessment gives your company a CMMC certification, and none of them confers a CMMC Status. A self-assessment status comes only from your own completed self-assessment and affirmation, entered by your company in SPRS. Selling these products does not make us part of the government's assessment process. A Level 1 result and a Level 2 self-assessment result are your own company's assessment. Where a contract requires an assessment by a Certified Third-Party Assessment Organization, only that official process produces the result.

Not legal advice. The files, calls, and deliverables are general information and planning tools. They do not create an attorney-client relationship. Ask qualified counsel about your contract and your legal exposure.

The affirmation is yours. Under the CMMC rule (Title 32 of the Code of Federal Regulations, Part 170), a senior official of your company affirms the result and then affirms continuing compliance every year. That official is responsible for the accuracy of the statement. A false or inaccurate affirmation can create liability under the False Claims Act (Title 31 of the United States Code, sections 3729 to 3733). We do not make the affirmation, we do not enter your results in SPRS, and we do not accept responsibility for it.

We do not guarantee outcomes. We do not guarantee any score, any assessment outcome, or any contract award. The accuracy of your answers, your evidence, and your score is your company's responsibility.

Adams Cloud and Cybersecurity LLC is not affiliated with, endorsed by, or authorized by the Department of Defense, The Cyber AB, or ISACA. CMMC Certified Professional (CCP) is a credential issued to an individual by ISACA. These products are not a CMMC assessment and do not provide or imply any CMMC Status.

12. Controlled information

Please do not send us Controlled Unclassified Information, Federal Contract Information documents, passwords, or technical data, whether in a form, an email, or a workbook. Describe your systems in general terms. If you send controlled information to us anyway, you are responsible for that disclosure under your contracts.

13. Support

Questions about using the kit files are answered by email at thabiti@adamscloudcyber.com. We answer support email within 2 business days. Support does not include legal advice or a review of your answers, except in the review call, Guided package, and Hands-on Assessment options. Those are separate paid services.

Need an invoice or an Internal Revenue Service (IRS) Form W-9 for your purchasing department? Email thabiti@adamscloudcyber.com.

14. Limits

To the extent the law allows, the products are provided as described on the sales pages and in these terms, without other warranties, and our total liability for any claim about a product is limited to the amount you paid for it.

15. Governing law and changes

These terms are governed by the laws of the State of California. The terms shown at the time of your purchase apply to that purchase. If we change these terms, the new version applies only to later purchases.

16. Contact

Effective November 5, 2026.