M365 Audit Service Terms

• 1. What this service is

  The M365 & SharePoint Audit is a third-party assessment of the customer's Microsoft 365 tenant. It is a read-only, scripted assessment that documents the tenant's configuration against the frameworks selected for the engagement. The audit produces a written findings report, a prioritized remediation list, a license optimization analysis, and a stakeholder walkthrough.

  Agate and CCI are technology services providers. Neither Agate nor CCI is a law firm. Neither provides legal advice. Using this service does not create an attorney-client relationship.

• 2. Roles of the parties

  Agate Cybersecurity LLC sells the engagement, contracts with the customer for the sale, manages the commercial relationship, and is the customer's primary point of contact for scoping and billing.

  Computer Concepts Inc. performs the assessment work, holds the relevant cyber and professional liability insurance for tenant-level assessment activities, and is the delivery party named in the Master Services Agreement.

  The same individual operates the assessment activities under CCI. The dual-entity structure is a liability and insurance structure, not a separation of personnel.

• 3. Engagement structure

  Every M365 Audit engagement begins with a paid Tenant Scoping engagement. The Scoping engagement is a fixed-fee paid intake that confirms tenant size, framework alignment, access requirements, timeline, and the firm price for the audit phase. The Scoping fee is $1,500 USD as of the date of these Terms and is credited toward the audit phase if the customer signs a Statement of Work within thirty (30) days of the Scoping deliverable.

  The audit phase does not begin and access to customer systems is not requested until the Scoping engagement is complete and the customer has signed a Master Services Agreement and a Statement of Work for the audit phase.

• 4. Framework alignment

  The audit measures the customer's tenant against frameworks selected for the engagement. Default frameworks by customer type include, but are not limited to, the Center for Internet Security ("CIS") Microsoft 365 Foundations Benchmark v6, the NIST Cybersecurity Framework 2.0, the HIPAA Security Rule technical safeguards at 45 CFR § 164.312, the FTC Safeguards Rule at 16 CFR Part 314, the NIST AI Risk Management Framework, NIST SP 800-171, and ISO/IEC 27001 control overlay.

  The audit aligns to frameworks. The audit does not certify compliance with any framework, law, or regulation. The customer is responsible for obtaining counsel where regulatory interpretation is needed.

• 5. Access and scope

  The customer grants Agate and CCI read-only access to the customer's M365 tenant for the duration of the audit window. Access is granted through the customer's existing privileged identity management ("PIM") process or a temporary admin assignment. The customer retains Global Administrator at all times. Neither Agate nor CCI holds standing access between engagements.

  Access is limited to read-only operations necessary to perform the assessment. Specifically, Agate and CCI:

  • Will not modify tenant configuration
  • Will not change user, license, or permission assignments
  • Will not transmit, exfiltrate, or retain customer data beyond what is necessary for the engagement findings
  • Will close all access at engagement end

  The customer signs an Authorization Letter or scope document before access is granted.

• 6. Customer responsibilities

  The customer is responsible for:

  • The accuracy and completeness of information provided about the tenant, the business, the regulatory context, and the engagement scope
  • Granting and revoking access in accordance with the engagement scope
  • Executing remediation actions on findings (Agate and CCI do not remediate)
  • Cooperation of internal IT staff, contracted IT partners, and third-party software vendors as required for the audit
  • Determining whether the customer is subject to HIPAA, the FTC Safeguards Rule, state privacy laws, NIST 800-171/CMMC, or any other legal or regulatory requirement, and obtaining counsel where regulatory interpretation is needed
  • Reviewing, accepting, and implementing the deliverables
  • Maintaining the customer's own information security program, written policies, and staff training

• 7. No completeness guarantee

  No security assessment can guarantee discovery of every issue. Findings reflect what was assessed within the agreed scope and access window. The audit uses scripted forensics, configuration tracing, and discovery patterns chosen for the customer's tenant and the frameworks relevant to the customer's industry. The specific tooling stack is selected per engagement and is not disclosed publicly.

  Conditions in the customer's tenant may change between assessment and remediation through customer-side changes, vendor-side changes, third-party access, or other factors outside Agate and CCI control. The deliverable documents what was reviewed at the time of review.

  Agate and CCI do not represent or warrant that the assessment will identify every issue, every compliance gap, every license inefficiency, every misconfiguration, every security exposure, or every operational concern present in the tenant.

• 8. No regulatory determination

  Neither Agate nor CCI determines the customer's status, obligations, or compliance under any law, rule, regulation, framework, or industry standard. This includes but is not limited to HIPAA, HITECH, the FTC Safeguards Rule, the IRS Section 7216 rules, the Colorado AI Act, the Colorado Privacy Act, CCPA, CPRA, NY SHIELD, the Texas Data Privacy Act, NIST SP 800-171, CMMC 2.0, ISO/IEC 27001, SOC 2 criteria, PCI DSS, GDPR, and any state, federal, or international information security or privacy law.

  The audit deliverable provides indicators against the named frameworks. It is not a legal opinion. It is not a regulatory audit. It is not a compliance certification. It is not a business associate agreement. The customer is responsible for obtaining counsel where regulatory interpretation is needed.

• 9. No insurance carrier opinion

  Neither Agate nor CCI represents that the audit deliverable will satisfy the specific requirements of any cyber insurance carrier, broker, reinsurance entity, or insurance trade association. Carriers establish their own requirements and review processes. The audit produces independent third-party evidence of the customer's tenant posture, which the customer may submit to their carrier or broker. The customer's carrier or broker makes the determination of whether the evidence is sufficient for their purposes.

• 10. No remediation

  Agate and CCI do not perform remediation. The audit produces a prioritized remediation list. The customer's IT team, the customer's contracted IT partner, or another party engaged by the customer executes the remediation actions. This boundary is by design. It keeps the audit independent and reduces access risk for the customer.

  If the customer requires remediation services after the audit, that work is a separate engagement under separate scope and pricing. Neither Agate nor CCI will accept remediation work on the same tenant that was audited under this Statement of Work unless the customer and the parties expressly agree in writing to a follow-on remediation Statement of Work.

• 11. Data handling

  The audit reviews tenant configuration and operational metadata. The audit does not require Agate or CCI to ingest customer business data, email content, file content, or end-user data outside of the configuration scope. To the extent any customer data is incidentally observed during the assessment, that data is treated as confidential, is not retained beyond the engagement window, and is not used for any purpose other than producing the audit deliverable.

  For customers subject to HIPAA, if the audit scope involves access to environments containing protected health information ("PHI"), the parties shall execute a Business Associate Agreement with CCI as the business associate prior to such access. The Scoping engagement confirms whether PHI access is in scope.

• 12. Customer-IT remediation handoff

  Upon delivery of the prioritized remediation list, responsibility for executing the remediation actions transfers to the customer's IT team or designated remediation party. Agate and CCI are not responsible for the customer's execution of remediation actions, the timing of remediation actions, the completeness of remediation actions, or any consequences of the customer's choice to defer or modify recommended remediation actions.

• 13. Master Services Agreement and Statement of Work

  Each engagement is governed by a written Master Services Agreement ("MSA") signed by the customer, Agate, and CCI. A workflow-specific Statement of Work ("SOW") for each phase (Scoping, audit) is signed under the MSA. The MSA and SOW define scope, exclusions, assumptions, customer responsibilities, acceptance criteria, payment terms, change process, intellectual property, confidentiality, limitation of liability, and termination.

  These Terms describe the general scope and boundary of M365 Audit engagements. The MSA and SOW govern the specific engagement. Where these Terms and the MSA or SOW conflict, the MSA or SOW controls.

• 14. Limitation of liability

  To the maximum extent permitted by law, the aggregate cumulative liability of Agate and CCI, individually and combined, arising out of or relating to any M365 Audit engagement is limited to the amount paid by the customer for the specific engagement during the twelve (12) months preceding the claim. Neither Agate nor CCI is liable for indirect, incidental, consequential, special, exemplary, or punitive damages, or for lost profits, lost revenue, lost data, business interruption, regulatory fines, penalties, or insurance carrier denials, even if Agate or CCI has been advised of the possibility of such damages.

• 15. Confidentiality and findings ownership

  The findings, deliverables, and any related materials produced for the engagement are confidential and owned by the customer upon payment in full. Agate and CCI may retain a copy of the engagement record for internal quality, regulatory, and insurance purposes, subject to confidentiality obligations.

  Neither Agate nor CCI will disclose customer identity, findings, or engagement details to any third party without the customer's prior written consent, except as required by law, court order, or insurance carrier audit.

• 16. Acceptable use

  The audit deliverable is licensed for the customer's own business use. The customer may share the deliverable with the customer's cyber insurance carrier or broker, the customer's formal auditor (SOC 2, HIPAA, ISO, PCI, or similar), the customer's board, the customer's executive team, the customer's contracted IT remediation party, the customer's counsel, or a counterparty in an acquisition or vendor diligence process. The customer may not resell, redistribute, or repackage the deliverable as a competing product or service.

• 17. Changes to these Terms

  Agate and CCI may update these Terms as services, market conditions, vendor relationships, or applicable laws change. The version of these Terms in effect on the date the customer signs an MSA or SOW applies to that engagement.

• 18. Governing law

  These Terms are governed by the laws of the State of Colorado, without regard to conflict-of-law rules. Disputes arising out of or relating to these Terms shall be resolved in the state or federal courts located in Denver, Colorado.

Sold by Agate Cybersecurity LLC, 801 Wyandot Street, Denver, Colorado 80204. Engagement delivered through Computer Concepts Inc., the insured delivery entity. Software and services, not legal advice. For questions about these Terms, contact Agate through the Contact page. For security reports, see the Security and Vulnerability Disclosure page.