Know your suppliers.
Keep the proof.
Tiermark helps you check your suppliers, collect signed answers about their security practices, and track what needs attention. All in one place.
When a customer asks how you checked a supplier, you have the answer and the record to back it up.
Start with public records. No supplier participation needed for the report.
Fictional supplier · Your supplier list
Business registration & public security signals
Security questionnaire, signed and dated
Open issue, responsible person & due date
Signed answers, review history, and risk follow-up.
Built for the person managing suppliers
without a dedicated risk team.
Why it matters
A supplier’s security gap, exclusion from federal contracting, or missed follow-up can become your problem.
But the information you need is usually scattered across public websites, emailed questionnaires, and spreadsheets. It is hard to see what is missing, who needs a reminder, or what you knew when a decision was made.
Tiermark puts those checks, answers, and actions in one record. You can see the gaps and show the work behind your decisions.
The rules behind the work
Defense contracts carry cybersecurity and supply chain clauses that reach your suppliers. What each asks, and what Tiermark does.
The clause holds contractors that handle covered defense information to NIST SP 800-171, 72-hour incident reporting and flow-down. Tiermark's campaigns ask your suppliers for a signed attestation on a DFARS 252.204-7012 baseline questionnaire. Every read of the answers is recorded.
CampaignsA CMMC Level 2 self-assessment scores the 110 requirements by the DoD method; the score is posted in SPRS. Our free calculator works it out as 32 CFR 170.24 has it: start at 110, and lose 5, 3 or 1 points for each requirement not fully met.
Work out your SPRS scoreCMMC Phase II was suspended on 13 July 2026. Phase I self-assessments, SPRS posting and annual affirmations continue. Supplier Pro's Compliance dates page works out when each is next due and emails your admins first.
The CMMC Phase II suspensionSigned 20 July 2026, the order directs rules for primes and subcontractors at any tier to map supply chains, vet suppliers, notify significant risks within 15 days of vetting and file a corrective action plan within 45. Rules are still to come. Tiermark builds the map and runs both clocks in your risk register from the day vetting is marked complete.
Executive Order 14415SAM.gov registrations and USAspending subawards are public. Tiermark reads both for your UEI to build your supplier map, then grades each supplier from public DNS, mail, certificate and TLS signals, touching nobody's systems.
Your supplier mapTiermark certifies nobody, assesses nobody, and posts nothing to SPRS. Your contracts decide your obligations.
What Tiermark does
A practical workflow for contracts, purchasing, and security teams.
Start with suppliers found in federal contract records, then add the ones public records miss. Review business registrations, exclusion-list matches, and public security findings.
Send suppliers a security questionnaire, track responses, and send reminders. Each signed response records who answered and when. Suppliers can reuse answers and choose who sees them.
Record risks, assign an owner, and track due dates. Export the signed answers, request history, and risk register together when your customer or contracting officer needs a record.
Your suppliers can answer requests and share their signed responses without buying a subscription.
The bigger picture
You do not need to know an executive order number to understand the job: know who you depend on, check for problems, and keep a record of what you did.
It is a July 2026 presidential directive to develop rules for mapping critical defense supply chains, vetting suppliers, and reporting significant risks.
The order calls for future regulations with 15-day risk notices and 45-day corrective-action plans, measured from completion of vetting. Those provisions are instructions for implementing rules, not a blanket statement that every contractor has the same deadline today.
Tiermark helps organize supplier checks and follow-up. Your contracts and applicable rules determine your obligations.
Read the official order, Section 3 Executive Order 14415, explainedA few clear answers
Built and operated by
Edwards Consulting Group
in Swansboro, North Carolina. About Tiermark
Suppliers found in federal award records, public security findings, and potential issues for review. It is a starting point: public records may be incomplete, and a possible match needs to be checked before you act.
No. The report uses public business records and external signals, such as email security settings and website certificates. These observations do not establish what is happening inside a company. Active scanning requires recorded authorization.
No. Tiermark records what suppliers report and what public checks show. A signed answer is a supplier’s statement, not an independent certification. The software helps you review, follow up, and document your decisions.
No. Controlled Unclassified Information (CUI) must never be entered or uploaded. Tiermark is for supplier information, signed answers, and supporting records that are not controlled.
Both. Contractors use the paid workspace to manage their supplier reviews. Suppliers use the free portal to answer requests and share signed responses with the customers they choose.
Start with a free report
Get a first look at the suppliers linked to your company and the issues worth a closer look. Then decide whether you need a shared workspace to manage the follow-up.
No account needed to request a report.
Your free supplier report