Guides Running a supplier program
Running a supplier cyber risk register at a defense prime
A supplier cyber risk register for a defense prime: what to record per risk, the clocks the rules set (EO 14415, DFARS 7012, POA&M), a template, and closeout.
By Chris Edwards, Edwards Consulting Group · Updated
A supplier cyber risk register is one list of what you know is wrong or unknown about each supplier's cybersecurity, with a severity, an owner, a status and dates. It is where the answers a supplier signed, the findings you observed and the gaps you wrote down yourself turn into work with a deadline, and it is the record you produce when someone asks what you did about them. Executive Order 14415 directs rules that would add 15-day and 45-day clocks to it; those rules are not in force yet.
This guide explains the rules as of October 21, 2026. It is not legal advice: the clauses in your contract decide what applies to you.
What to record for each supplier risk
A register needs few fields, but each has to be there every time. The model below is the one Tiermark's register uses, and a reasonable minimum for a spreadsheet.
| Field | What goes in it |
|---|---|
| Item | One line saying what the risk is, in plain words ("No system security plan", "Cloud service below FedRAMP Moderate"). |
| Supplier | The company it is about, with its UEI. An item can also be about your own organization: a policy gap, a clause you have not flowed down. |
| Severity | Critical, high, medium or low. |
| Source | Where it came from: a signed attestation, a scan finding, a disclosure, or you. A reader must be able to tell a derived item from a judgement call. |
| Basis | For a derived item, the rule that fired and the answer values it read; for a manual one, what you saw. Never free text a supplier typed. |
| Owner | A named person in your organization, or "Nobody yet", which is itself a finding. |
| Status | Open, mitigating, corrective action plan, closed. Forward only. |
| Mitigation | What is being done. |
| Vetting completed | The date you marked your vetting of the item complete. The EO 14415 clocks, when they arrive, would run from completing vetting, not from discovery. |
| Notify by, Plan by | Fifteen and 45 days after that date. |
| Closeout | What was done and why the item is finished. Required before closing. |
| History | Every change, dated and attributed: added, derived, updated (which fields), vetting marked complete. |
Which rules put a clock on a supplier risk?
Only some register items are time-sensitive under a rule. These are the ones, with their status.
| Rule | Clock | Status on October 21, 2026 |
|---|---|---|
| Executive Order 14415, Sec. 3(c) | "within 15 days of completing the vetting activities, notify the Department of War of any significant supply chain risks"; "within 45 days of completing the vetting activities, submit a written, confidential corrective action plan"; then "a closeout report upon completing the corrective action plan" | Directed, not in force. The order tells the Secretary of War to write policy within 180 days and regulations 90 days after that. No implementing rule or clause has been published that we have found. See Executive Order 14415 explained. |
| DFARS 252.204-7012 (a), (c), (e) | "Rapidly report" means "within 72 hours of discovery of any cyber incident"; preserve images and monitoring data "for at least 90 days from the submission of the cyber incident report" | In force in every contract that carries the clause. Under (m)(2)(ii) a subcontractor passes the DoD incident report number up to you. |
| 32 CFR 170.21(b) and 170.16(a)(1)(ii)(B) | A supplier's Conditional Level 2 (Self) status expires if the POA&M "is not successfully closed out within the 180-day timeframe" from the Conditional CMMC Status Date | In force. If it expires during performance, "standard contractual remedies will apply". See POA&M rules. |
| DFARS 252.204-7021 (a), "Current" | A Final Level 2 (Self) status is current only if "Not older than 3 years" with an affirmation "not older than 1 year" | In force where the clause is in the contract. |
A supplier whose status is Conditional is therefore an item with a date: 180 days from its status date, which the supplier knows and you do not until you ask. The three-year and one-year dates behind "current" are the same kind of item.
How to derive risks from supplier answers
Derive mechanically, from the structured answers, and by rules you have written down. A rule that a reviewer can read and check against the clause is worth more than a judgement nobody can reproduce. The thirteen rules below are the ones Tiermark applies to its DFARS 252.204-7012 baseline questionnaire (the questions are in A DFARS 7012 supplier questionnaire). "Not applicable" is an answer, not a finding, and a question left blank fires nothing.
| Item | Severity | Fires when the supplier answered |
|---|---|---|
| SPRS score not posted | high | Handles CDI, and the score is not posted in SPRS |
| No NIST SP 800-171 self-assessment | high | No self-assessment completed |
| No system security plan | high | No system security plan |
| More than twenty requirements not implemented | medium | 21 to 50 requirements not yet fully implemented |
| More than fifty requirements not implemented | high | More than 50 |
| Cannot meet 72-hour incident reporting | critical | Cannot discover, report through DIBNet and preserve evidence within 72 hours |
| No DoD medium assurance certificate for DIBNet reporting | medium | Handles CDI, and holds no certificate |
| Multifactor authentication not enforced everywhere | high | MFA not enforced for every account, including privileged and remote |
| FIPS 140 validated cryptography not in use | medium | CDI not protected with FIPS 140 validated cryptography at rest and in transit |
| Cloud service below FedRAMP Moderate | high | A cloud service holds CDI without FedRAMP Moderate or an equivalent |
| DFARS 252.204-7012 not flowed down | medium | Not flowed down to subcontractors that handle CDI |
| Incident in the past twelve months | medium | A cyber incident affecting CDI in the past twelve months |
| CMMC not started | medium | Handles CDI, and CMMC status is "Not started" |
Three habits make derived items trustworthy:
- Carry the basis, not the prose. An item records which rule fired and the answer values it read, and links to the signed answers. Free-text answers stay on the attestation.
- Derive once per answer set. Deriving again from the same answers adds nothing, and an existing item keeps its owner, mitigation and status.
- Keep observation separate from attestation. A finding from an outside-in look at a supplier's public infrastructure is a different source from what the supplier signed. Record high and critical findings as items; leave the rest on the supplier's record.
Add manual items for what no rule can see: a subcontract that went out without 7012 in it, a supplier that has not answered by the due date, a Conditional status with its closeout date approaching.
A supplier risk register template
| Item | Supplier (UEI) | Severity | Source | Owner | Status | Mitigation | Vetting completed | Notify by | Plan by | Closeout |
|---|---|---|---|---|---|---|---|---|---|---|
| Cannot meet 72-hour incident reporting | Example Machining (UEI) | critical | attestation | J. Smith | mitigating | Supplier obtaining medium assurance certificate; tabletop with our IR lead | 2026-10-14 | 2026-10-29 | 2026-11-28 | |
| No system security plan | Example Coatings (UEI) | high | attestation | Nobody yet | open | Starts at vetting | Starts at vetting | |||
| 7012 missing from subcontract 4471 | Your own organization | medium | manual | R. Lee | closed | Modification issued | 2026-09-30 | 2026-10-15 | 2026-11-14 | Mod P00003 inserts 252.204-7012 without alteration; copy filed 2026-10-02 |
Sort by severity, then by the nearest clock. The line above the table should say two numbers: how many items are open and how many have a clock past due.
How to close out a supplier risk
- Move the status forward only. Open, then mitigating, then corrective action plan, then closed. An item that goes backwards has no history a reader can follow.
- Write the mitigation while it is live, in enough detail that someone else could carry it on.
- Close with a closeout. Say what was done and why the item is finished; refuse an empty one. For a supplier's POA&M item, that is the supplier's confirmation that its closeout self-assessment is done and posted; for a flowdown gap, the modification number.
- Keep the closed items. Under EO 14415 Sec. 3(c)(v) the corrective action plan ends with "a closeout report", and the regulations it directs would require contractors to "track active mitigation actions until closure". A register with history does both.
- Do not undo the vetting mark. Both clocks run from one date. If vetting has to be redone, that is a new item.
EO 14415 corrective action plan tracking
The order has not been implemented, so no contract yet requires a notification at day 15 or a plan at day 45. Running the register as if it did costs little: Sec. 3(c)(iv) asks for "a written, confidential corrective action plan detailing implemented mitigations and a strict projected timeline for complete implementation", which is the mitigation and plan columns of every open item, dated. Sec. 3(b)(ii) asks for "written procedures" for vetting; the rules you derive items by are the first page of that procedure. "Significant" is not yet defined; until it is, record severity by your own written scale.
Where Tiermark fits
Tiermark's risk register holds the fields above. Derive from signed answers and findings on a supplier's record runs the thirteen rules over its newest signed answer set and adds one item per published high or critical finding; pressing it again adds nothing. Mark vetting complete on an item starts the 15-day and 45-day clocks from that date, with email notices to admins seven days before each date and on the day, and the history records every change. The register goes into every audit package as CSV. Tiermark notifies the Department of nothing; the register is yours.
Sources
Still have a question?
Write to help@tiermark.io and a person will answer.