How a Tiermark grade is worked out from public signals

A grade is Tiermark's opinion of a company's public security posture, formed by published rules from signals anyone can observe. This article is those rules, and they apply to every company alike.

What is observed

Every grade starts from the website your SAM.gov registration lists. Tiermark reads what any visitor to that domain could read, in four families:

• Mail authentication. The SPF record in the domain's TXT records; the DMARC record at _dmarc; DKIM keys at 17 common selector names (such as selector1, selector2 and google); the MX records; the MTA-STS record at _mta-sts and the TLS-RPT record at _smtp._tls.
• DNS. Whether the zone is DNSSEC-signed (the DS records and the resolver's authenticated-data flag), and whether a CAA record names the certificate authorities allowed to issue for the domain.
• The website's TLS. One TLS connection to the bare domain on port 443: whether anything answers, whether the certificate is trusted and when it expires, and which protocol version is negotiated.
• The website's response. One request for the home page over HTTPS: the Strict-Transport-Security header and the status code.

A fifth source, public certificate transparency logs, adds detail (wildcard certificates, how many hostnames have certificates) but never changes the score.

What the observation is not

It is passive. Nothing on your systems is tested, probed or touched: Tiermark looks up DNS records, makes one TLS connection and one web request, the way a browser does, and reads public logs. Active testing happens only with written authorization from the owner of the system. Nothing in a grade comes from anything you have told Tiermark.

How the score is worked out

Each company starts at 100. Each finding present subtracts a set number of points. The score is kept between 0 and 100, and the letter follows from it:

The findings and what each costs, from the rules in force (version 2026-09-01):

Four findings are informational and cost nothing: no TLS-RPT record, an HSTS max-age under 180 days, a wildcard certificate in the logs, and 25 or more hostnames in the logs. No MX records is informational too, and it does something else: a domain with no MX records takes no mail, so every mail finding on it is suppressed and costs nothing. Each finding carries its evidence: the record or response that was read, and when. A finding the rules do not name never changes the score.

When no grade is published

A grade is a claim about what was observed, so it is only published when every signal that can cost points was actually read. A lookup that fails (a resolver that cannot answer, a connection that times out) is not treated as "no record": no score or letter is published until a scan completes. "Could not observe" and "observed no issue" are different answers.

How often a grade is refreshed

• On a paid prime plan, every supplier on the map is graded again at least every 30 days. A supplier added by hand that has no grade yet is scanned when it is added; one that already has a grade keeps it until its next refresh.
• With Supplier Pro, a supplier can re-check its own grade once in 24 hours; a scan takes about two minutes.
• On Supplier Free, you see your grade and every finding behind it; a re-check needs Supplier Pro.

It is one grade: a re-check changes what every prime with your company on its map sees.

How to fix what it found

With Supplier Pro, every finding has How to fix under it: what it means, the steps, who usually does them, how to check, and what it costs your grade. See Your grade and how to fix what it found. DNS changes can take up to a day to be seen.

How to correct or dispute a finding

Write to help@tiermark.io with the finding's title; the evidence column shows exactly what was observed and when. Any company may ask us to re-read its public record or to correct a factual error, and we answer within ten business days. If SAM.gov lists the wrong website for your company, correct it in SAM.gov first, then write to us.

What a grade is not

A grade is an outside-in observation. It is not a CMMC assessment, not a certification, and not a determination of compliance with DFARS 252.204-7012, NIST SP 800-171 or CMMC. It says nothing about a company's internal controls, its compliance status or its fitness as a supplier, and must not be represented as doing so. Tiermark is not an assessor or a certification body. More short answers are in Questions people ask.