Start with the relationship, then the tier
A tier describes where a supplier sits relative to a particular contract. It does not describe everything the company does. “Subprime” is commonly used for a major contractor below the prime, while “aggregator” describes a commercial role such as coordinating or consolidating supply. Neither term creates a separate cyber compliance level.
Start with what the company does in this relationship.
Prime
Which requirements apply to the work you award? What do you need to establish about the suppliers performing it?
Major subcontractor or integrator
Your customer sets requirements for your work. Some also apply to the work you buy from other suppliers. Track both sides.
Aggregator or distributor
Check which information and services your team handles and which work passes to other firms. The commercial label alone won’t tell you what applies.
Manufacturer or specialist provider
Your team needs to implement the requirements for its work and support its customer response with evidence.
One company can play several of these roles. Keep each answer tied to the work it covers. A response to one customer won’t always fit another.
A network is harder to understand than a supplier list
GAO’s July 2025 report on defense foreign dependencies found limited visibility into lower-tier sources. Its subject was the origin of materials and goods, not the prevalence of cyber noncompliance. The practical lesson for a supplier program is to establish which relationships its information covers. Read the GAO report.
Consider an illustrative subsystem built by an integrator using parts from two distributors. Both distributors depend on the same specialist manufacturer. Two purchase orders can depend on the same shop. Find out what that shop does for the program, which requirements apply, and who will ask for a response.
A map of company names will not answer those questions on its own. You’ll also need to agree who takes part and which records they can share. A relationship map doesn’t grant access to another firm’s information.
Combine visibility with the ability to improve
Seeing a supplier gap is useful when the responsible team can act on it. Deep Fathom connects the buyer’s need for oversight with a platform suppliers use to work through compliance requirements, assigned actions, evidence, and continued maintenance.
The commercial model can follow the network. A prime can discuss a program for selected suppliers. A major subcontractor can use the same approach for the suppliers it buys from. Suppliers maintain their own work while providing the information agreed for each relationship.
Start with the program whose dependencies you need to understand. Explore multi-tier assurance, or work through your own responsibilities as a supplier and buyer.