For suppliers
A prime has asked you for proof: an SPRS score, a CMMC Level 2 self-assessment, or a signed DFARS 252.204-7012 attestation. Here is what each one means, free tools to work it out, and one place to keep the work.
Got a request from a prime? Answering is free.
What your customer wants
What they want. Your NIST SP 800-171 self-assessment score out of 110, as you posted it in SPRS, and the date.
What you do. Assess the 110 requirements by the DoD method, post the score in SPRS yourself, and give the prime the number. A prime cannot look it up: SPRS shows a company its own data.
The free SPRS score calculator SPRS score explainedWhat they want. A current Level 2 (Self) status: a self-assessment every three years, the score and status date in SPRS, and an annual affirmation by your Affirming Official. CMMC Phase II is suspended; Phase I self-assessments still apply.
What you do. Keep the assessment current, close any POA&M within 180 days of a Conditional status date, and affirm each year.
The CMMC Phase II suspension POA&M rulesWhat they want. Your signed statement on covered defense information, NIST SP 800-171, 72-hour incident reporting, cloud and flow-down.
What you do. If your prime uses Tiermark, open the link in its message, confirm your company, answer seven short sections and sign. About ten minutes, and free.
Answering a request DFARS and FAR clausesFree, no account
Mark each of the 110 requirements of NIST SP 800-171 Rev 2 as met, partly met, not met or not applicable. The score changes as you answer, by the DoD method in 32 CFR 170.24: start at 110, and lose 5, 3 or 1 points for each requirement not fully met. Each requirement shows its points and how to meet it. Nothing is saved and nothing is sent.
Plain English, dated, with the primary source for each rule. None is legal advice.
Free, for ever
A customer that uses Tiermark sends you a message with one button: Open your request. The page shows who is asking, the questionnaire and the due date. You confirm you are answering as your company.
Before you can sign, Tiermark confirms that you represent the company. An address on the website SAM.gov lists for the company is verified at once. Otherwise a one-time code goes to an address there, or a person confirms it within one business day.
The questionnaire asks only what DFARS 252.204-7012 and NIST SP 800-171 already require of you, in seven sections. Save a draft and come back. Nothing is sent until you sign. A signed answer set cannot be edited or deleted by anyone, Tiermark included, and your request page lists every read of it.
When a second customer asks for the same questionnaire, share the answers you signed instead of answering again. That customer learns they were signed for another customer on a date, never which. Revoke whenever you like: it takes effect at once, and they keep nothing.
Answering, signing and sharing are free, for ever. How answering works · Sharing your answers
Supplier Pro
Everything in Supplier Free, plus six tools, for $99 a month or $990 a year.
Cancel any time. What you entered stays, and you can still read it.
Questions suppliers ask
Tiermark does not certify, assess or post to SPRS. Your contracts decide what applies to you.
No. Answering, signing and sharing your answers are free, for ever. Open the link in your customer's message; it takes about ten minutes. Supplier Pro is a separate, optional plan. Answering a request.
No. A grade is an outside-in observation of your company's public signals (DNS, mail authentication, certificates and TLS), not a determination of compliance with DFARS 252.204-7012, NIST SP 800-171 or CMMC. A signed attestation is your own statement. Neither replaces a CMMC assessment. How a grade is worked out.
DoD publishes no threshold called "good". 110 means every requirement is met or not applicable, which a Final Level 2 (Self) status needs. 88 is the floor for a Conditional status with a plan of action: only 1-point requirements may be on the plan (3.13.11 may be on it at 3 points), six never may, and it must be closed out within 180 days. Below 88 rules out a Conditional status, but the score is still posted. SPRS score explained.
Not in SPRS itself, as far as the public rules go. A prime's SPRS account shows its own CAGE hierarchy; a vendor may view, download and distribute its own data, which is how a score reaches a prime: the supplier gives it. In Tiermark, your prime sees only what you sign in its questionnaire. Your calculator and workspace are never shown to a prime. How primes check their suppliers.
A plan at $99 a month ($990 a year) that adds six tools to the free account: an SPRS score calculator that keeps your answers, a self-assessment workspace with NIST SP 800-171A objectives, POA&M and evidence register, a system security plan outline as a PDF, compliance dates with email reminders, how to fix each finding behind your grade, and a daily grade re-check. Plans and prices.
No. The calculator gives an estimate by the DoD method from your own answers; you enter your score in SPRS yourself, and your Affirming Official makes the affirmation there. Tiermark never reads SPRS and posts nothing to it. The SPRS score calculator.