Terms of Service

Effective September 6, 2026 · Version 2026-09-06

1. The service

Cyber Readiness Kit is a guided cyber readiness platform for small and midsize businesses. It helps organizations establish a readiness baseline, prioritize important exposures and unknowns, work through practical improvements, organize supporting evidence, verify progress, collaborate with providers, prepare readiness documentation, and maintain readiness over time. The service is not a managed security service, incident-response retainer, insurance policy, legal service, regulatory certification, or guarantee that an attack will be prevented or contained.

2. Authority and accounts

You must be authorized to act for the organization whose information you submit. You are responsible for accurate account information, safeguarding credentials and MFA methods, and activity performed through your account. Do not upload passwords, authentication secrets, or information you are not authorized to provide.

3. Fees, first year, and recurring billing

Current list pricing is $1,495 for the first year, then $99 per month unless future renewal is canceled. A count-limited founding offer may be available to eligible early customers: $299 for the first year, then $29 per month, grandfathered for life for that founding cohort. The exact price and continuation rate applicable to your purchase are disclosed before checkout and recorded with your billing account.

Evidence analysis, including deeper analysis for eligible complex submissions, is included with paid platform access and is subject to fair-use and platform AI spending controls; it is not sold as a separate add-on.

4. Cancellation, refunds, and the Results Guarantee

Cancellation affects future renewal and does not retroactively cancel a paid period. Refund eligibility is governed by the Refund & Cancellation Policy, which is incorporated into these Terms.

Eligible first-year purchases made on or after September 6, 2026 may also qualify for the Cyber Readiness Results Guarantee. Under that guarantee, an eligible customer may request a full refund of the eligible first-year Cyber Readiness Kit platform charge within 60 days if the customer establishes the tracked readiness baseline, works through the first three recommended priority actions (or all recommended actions if fewer than three exist), and uses CRK's proof process for each of those priority actions, but CRK does not document measurable readiness improvement. Merely opening or starting an action does not satisfy the fair-shot requirement. A CRK-prepared working document by itself does not satisfy the proof requirement unless it has been independently verified. Requests are reviewed before a refund is issued. The Results Guarantee does not reimburse third-party costs and does not apply to monthly continuation or rejoin charges except where applicable law requires otherwise.

5. Results Guarantee limitations

The Results Guarantee is a readiness-results promise, not a security, compliance, insurance, or financial-outcome guarantee. Measurable readiness improvement can include a significant exposure being resolved, an important protection being verified with evidence, an unknown condition being clarified into a confirmed condition, or another meaningful readiness improvement documented by CRK. The guarantee does not promise that an attack will be prevented, systems will be secure, compliance will be achieved, an insurer or customer will accept an answer or document, or a particular financial loss will be avoided.

6. Customer data and evidence

You retain your rights in information, readiness responses, and evidence you submit. You grant Cyber Readiness Kit the limited right to host, process, transmit, analyze, back up, and otherwise use that information as necessary to provide, secure, support, and administer the service. Your use of the service remains subject to the Privacy Policy.

7. Cybersecurity and compliance limitations

Recommendations, readiness states, scores, and reports depend on information provided, available evidence, the selected scope, and the platform methodology at the time of review. A favorable score, verified item, or report does not establish that systems are secure, that all vulnerabilities have been identified, or that any law, framework, insurer, customer, contracting officer, assessor, or regulator will consider the organization compliant. CUI and other regulatory overlays are readiness guidance only and are not certifications, authorizations, or legal conclusions.

8. Acceptable use

You may not use the service to violate law, infringe rights, probe or attack systems without authorization, upload malicious code, interfere with the platform, bypass access restrictions, resell access without permission, or submit data you lack authority to process.

9. Availability and changes

We may maintain, update, or modify the service and methodology over time. We aim for reliable availability but do not promise uninterrupted or error-free operation. Material changes to these Terms will be posted with an updated effective date, and additional notice may be provided when appropriate.

10. Disclaimers

To the maximum extent permitted by applicable law, the service and its outputs are provided on an “as available” basis without warranties of uninterrupted operation, guaranteed security, guaranteed risk reduction beyond the express eligible refund right described in the Results Guarantee, fitness for a particular compliance or insurance outcome, or non-infringement beyond warranties that cannot legally be excluded.

11. Limitation of liability

To the maximum extent permitted by applicable law, Cyber Readiness Kit will not be liable for indirect, incidental, special, exemplary, punitive, or consequential damages, lost profits, lost revenue, lost business, or loss of data arising from use of the service. To the maximum extent permitted by law, aggregate liability for claims relating to the service will not exceed the fees paid for the service during the twelve months preceding the event giving rise to the claim. These limitations do not apply where applicable law does not permit them and do not eliminate an approved refund due under the Results Guarantee.

12. Suspension and termination

We may suspend access when reasonably necessary to protect the platform, other customers, or third parties; respond to suspected misuse; or address unpaid or invalid billing. Ending paid access does not automatically delete workspace data, but continued retention is not guaranteed indefinitely. Data handling after cancellation is described in the Privacy Policy.

13. Contact and applicable law

Mandatory rights under applicable law are not waived by these Terms. Questions about these Terms may be sent to support@cyberreadinesskit.com.