Questions people ask

About Tiermark

Is a Tiermark grade a CMMC assessment?

No. A grade is an outside-in observation of a company's public signals, not a determination of compliance. An attestation is the supplier's own signed statement. Neither replaces a CMMC assessment.

Where does the supplier map come from?

From the public record: awards and subawards reported on USAspending.gov, and registrations in SAM.gov. You can add any supplier yourself by its UEI. See Your supplier map.

How many suppliers can I add in a day?

A supplier Tiermark already holds (one on any customer's map, or looked up before) can be added at any time. A UEI nobody has looked up yet is checked with SAM.gov, and your organization may check three new UEIs a day. Your plan's supplier limit applies either way. See Your supplier map.

Does Tiermark scan or test anyone's systems?

No. Grades come from passive observation of public information only: DNS, mail authentication, certificates and TLS. Active testing happens only with written authorization from the owner of the system.

How is a grade worked out?

Each company gets a letter from A to F and a score out of 100, from findings such as a mail domain with no enforcing DMARC policy, a zone that is not DNSSEC-signed, or a website without HSTS. The same rules apply to every company, your own included. See How grades work.

How fresh are the grades?

On a paid prime plan, every supplier on your map is graded again at least every 30 days. A supplier you add by hand is assessed when you add it. With Supplier Pro, a supplier can re-check its own grade once a day.

My grade is wrong. What can I do?

Tell us at help@tiermark.io. A grade is our reading of public signals; if the public record has changed, we read it again. If you have fixed something, Supplier Pro's re-check reads it again straight away, and How to fix what it found says what each finding means.

Does Tiermark work out my SPRS score?

With Supplier Pro, the SPRS score calculator works it out from your own answers for the 110 NIST SP 800-171 requirements, by the DoD method. It is an estimate, not an assessment. Tiermark does not post anything to SPRS, and nobody outside your organization sees your answers.

Where does a prime see a supplier's SPRS score?

On the supplier's record in your console, under Attested SPRS: the score, its posting and assessment dates, the system security plan and the open requirements, as the supplier signed them in your DFARS questionnaire, with who signed and when. It is the supplier's own answer, not checked against SPRS. Opening the record counts as reading the supplier's answers, and the supplier can see that it was read. A supplier's SPRS score calculator is its own and is never shown to a prime. See Your supplier map.

Will Tiermark remind me when my CMMC affirmation is due?

With Supplier Pro, yes. Keep your dates on the Compliance dates page and your admins get an email before each self-assessment, SPRS posting and annual affirmation is due, and, if you hold a Conditional Level 2 (Self) status, before the day its POA&M has to be closed out.

Does Tiermark write my system security plan?

No. With Supplier Pro, the System security plan page puts your own entries in order: a short form about your system, and each requirement's status, objectives, statement, owner, evidence and plan of action from your self-assessment workspace, as an outline in a PDF. Every page says it was prepared from your organization's own entries and is not an assessment. It is a starting point for the plan your organization completes and keeps.

Attestations and answers

What is an attestation?

A supplier's signed answers to a questionnaire, today the DFARS 252.204-7012 baseline. A prime asks for one with a campaign; the supplier answers through Tiermark, and the answers come back signed.

Does a supplier pay to answer?

No. Answering, signing and sharing are free for ever.

Can I pause or cancel a campaign?

Not from the console: once sent, a campaign cannot be paused, cancelled or closed, and a sent invitation cannot be recalled. If a campaign has to stop, write to help@tiermark.io with its name. See Campaigns.

Why did my reminder not go?

Reminders go at seven days, three days and on the due date, and only the most urgent one the due date has reached: a request created two days before its due date gets the 3-day reminder straight away and the due-date reminder on the day, never the 7-day one. Once a more urgent point is reached, an earlier one not sent is skipped. No reminder goes to a contact who has unsubscribed, or for a request that is already responded or expired. The Last message column on Requests shows what was sent, and whether it was delivered. See Campaigns.

Can a supplier reuse answers it already signed?

Yes. When another customer asks for the same questionnaire, the supplier can share the answers it already signed instead of answering again, and revoke the share whenever it likes. Revoking takes effect immediately: the other customer's next read returns nothing. Each customer only ever learns that the answers were signed for another customer on a date, never which customer.

Who can see my answers?

The customer who asked, and anyone you share them with. Nobody else.

What are the clocks in the risk register?

When somebody marks vetting complete on a risk item, two clocks start: 15 days to notify, and 45 days for the corrective action plan. Both dates come from that one mark, and it cannot be undone. See The risk register.

Who gets the risk clock emails?

Every admin of your organization, seven days before each clock's date and on the day, as one email per run listing every item that needs attention. They carry no unsubscribe link, because they are about your own account. To change who receives them, write to help@tiermark.io. See The risk register.

What is an audit package?

One file to hand a contracting officer: every signed attestation you may read, as a PDF and as JSON, your request ledger and your risk register as CSV, and a manifest with a fingerprint (sha256) of every file. Each package is written to storage that cannot be changed or deleted. See Audit packages.

Your data

Can I upload CUI?

Never. Controlled Unclassified Information, classified information and export-controlled technical data may not be submitted to Tiermark. The platform is not built to hold them, and we delete them if found.

Can I upload evidence files?

No. The self-assessment workspace has an evidence register for each requirement: what the evidence is, where it lives (a link, or a place in your own systems), who keeps it, and when it was last reviewed. Only the words you write are saved. Tiermark does not open the links and keeps no files. Your evidence stays in your own systems.

Where is my data, and who can see it?

In Tiermark's own Amazon Web Services account in the United States, encrypted in transit and at rest. Your organization's records are visible to your organization; what you share is visible to the people you share it with. See the privacy notice.

Do you train AI on my information?

No. Nothing you give us is used to train anyone's artificial intelligence model.

How do I get my company out of the public directory?

A supplier can remove its company itself: Settings, then Remove my company from the public directory. It takes effect immediately, and you can reverse it the same way. Anyone else can ask at help@tiermark.io. See Your public company page.

How do I have my data deleted?

Write to help@tiermark.io. We answer within ten business days and usually sooner.

Plans and billing

What does it cost?

See Plans and prices. Supplier Free and Prime Free cost nothing; paid prime plans start at $900 a month.

Is sales tax included?

Yes. Where sales tax applies, it is part of the price shown, not added on top.

Is there annual billing?

Yes: twelve months for the price of ten. Switch to annual in Manage billing; see Starting or changing a plan.

How do I cancel?

In Manage billing. Your plan keeps working until the end of the period you paid for. See Cancelling a plan.

My card was declined. What happens?

Your plan keeps working for seven days while Stripe tries again; update your card in Manage billing. See Payments, invoices and failed cards.

Your account

How do I add someone to my organization?

Write to help@tiermark.io from an admin's address with their work address and their role: admin, contracts manager or viewer. See Setting up your organization.

I cannot sign in.

See Signing in. If that does not help, write to us from your account's address.

Who is Terry?

Tiermark's AI assistant, in the console once you are signed in and your organization is set up. It answers from the help center and your own organization's account, read-only; it cannot change anything, and it hands what it cannot settle to a person. See Asking Terry.

How do I reach a person?

Write to help@tiermark.io. A person reads every message. If you are signed in and see Ask Terry in the console, Talk to a person inside it hands your conversation to the team, who follow up by email. See Asking Terry.