Help shape it before it ships.

Who we're looking for

Organizations that would actually use this in anger — not evaluators collecting screenshots. Specifically:

• Defense industrial base suppliers working toward CMMC 2.0 Level 2 — self-assessment, C3PAO preparation, or annual affirmation
• Community banks and credit unions preparing for examination — including BSA/AML programs and Bank Protection Act physical security
• Electric utilities and cooperatives with NERC CIP obligations, on the IT or the OT side
• Healthcare organizations assessing against the HIPAA Security Rule
• Law firms working from ABA Formal Opinion 477R
• Maritime facility security officers under 33 C.F.R. Parts 101 and 105
• Independent assessors and MSPs managing several client institutions at once

The ideal participant is the person who personally owns security or compliance assessment at their institution, has done it the hard way at least once, and has strong opinions about what the existing tools get wrong.

What you get

What we ask in return

This is a working pilot, not a free license. Participants are expected to:

1. Actually use it Run a real assessment, not a five-minute click-through.
2. Report what breaks Defects, confusing screens, missing capability, anything that made you close the application in frustration.
3. Verify the scoring Where we provide an independent worksheet for checking a generated score against a manual calculation, use it and tell us about any discrepancy. Scoring accuracy is the one thing we will not ship a commercial product without proving.
4. Keep a check-in cadence Periodic conversations about how it's going, at a frequency we agree on up front.
5. Make a considered call on data Synthetic or redacted data for evaluation and testing. If you choose to run live operational data, that's permitted — but read Article 7.3 first and make it a decision rather than a default.

The terms, in plain English

The full Beta Software License Agreement governs, and you should read it — but here is an honest summary so nothing is a surprise at signature.

It's free, and it's time-limited.

No fee. The pilot runs for a defined term and the license expires at the end of it.

You can use it in your actual business, not just in a sandbox.

The license covers testing and evaluation and use of the software and its outputs in your own business operations. On the Order Form you elect either internal operations only or client-facing use. If you say nothing, internal-only applies.

If you show outputs to your own customers, conditions attach.

Article 2.9 governs. In short: you own the accuracy of anything you produce and every decision made on it; any output leaving your organization carries a conspicuous notice saying it came from pre-release software, is self-reported, and is not an audit or certification; you don't imply Axiometrik verified or endorsed it; and your own customer agreements must carry disclaimers no weaker than the ones you're agreeing to here.

Feedback becomes ours.

Ideas, bug reports, and suggestions you give us are assigned to Axiometrik. This is standard for beta programs and it's the trade for free access — read Article 3 so you know exactly what you're agreeing to.

It's provided as-is, with no warranty.

Pre-release software. It may contain errors, and scoring logic and reference data may be incomplete or wrong. Our liability is capped and the cap is low. Articles 13 and 14 spell it out.

Don't file its output with a regulator.

Assessment output from beta software is not for filing, certification, or representation to any government agency, regulator, examiner, auditor, or insurer. For CMMC specifically, Article 6.4 bars using output in connection with the DFARS cybersecurity clauses — while expressly preserving your right to determine and submit your own SPRS score.

For CMMC, the judgment has to be yours.

You keep the right to determine and submit your own SPRS score. But Article 6.4 is explicit that the implementation status of each requirement must be your own determination. You may use the software to organize, record and calculate — re-checking the arithmetic of a score is not the same thing as independently deciding whether a control is met. Worth understanding before you start, not after.

Use sensible data.

Synthetic, redacted, or non-sensitive data for evaluation and testing wherever practicable. The agreement acknowledges that using it in live operations may require live data — and Article 7.3 puts that decision, and the responsibility for it, on you.

Keep the software confidential; the contract isn't.

The software, its interface, scoring methodology, and output formats are confidential, and no public reviews, benchmarks, or screenshots without written consent. The terms of the agreement itself are expressly not confidential — share them with your counsel, your board, or your vendor-management team freely.

If your legal or vendor-management team wants to review before you commit, send them straight to the full agreement — it's published, not gated.

How to apply

Email beta@axiometrik.net — the link opens a message with these fields already laid out, so you can fill them in and send:

• Organization name and type — bank, credit union, DIB supplier, utility, other
• Rough size — asset size, headcount, or number of covered systems, whichever fits
• Your name and role, and whether you personally own compliance assessment
• Which frameworks or examinations you're preparing for — this determines which assessment templates get enabled on your pilot license, so be specific
• What you use today, and what you dislike about it
• Your timeline — when you'd want to start, and what's driving it

Every application gets a reply. If it's not a fit for this round we'll say so plainly rather than leaving you waiting.

Axiometrik does not guarantee compliance with any law, regulation, standard, or framework, and is not endorsed by or affiliated with any regulator or standards body. See Article 6 of the Beta Software License Agreement.