This page explains how Suploris calculates the grade of a supplier.
Auditors and suppliers can see what a grade rests on. Every grade in the app traces back to the single measurement.
Grading schemas and version
- Suploris Security v1 (security-v1)
- Grade from the outside-in check alone. It applies while there is no questionnaire and no evidence.
- Suploris Security v2 (security-v2)
- Grade from outside-in check, questionnaire and evidence. This is the standard for assessed suppliers.
Every frozen assessment stores the version it used. A new rule gets a new version.
From points to grade
The calculation gives 0 to 100 points. The grade A to E follows from it.
| Grade | Points | Meaning |
|---|---|---|
| A | from 90 points | very good |
| B | from 75 points | good |
| C | from 60 points | with gaps |
| D | from 40 points | weak |
| E | below 40 points | critical |
Outside-in check: areas and checks
The outside-in check measures public data only: DNS records, the TLS handshake and public web pages.
Each area has a weight. Within an area, each check counts by its weight.
Email: Weight 40 %
| Check | Weight | Why |
|---|---|---|
| Mail servers | no points, basis for other checks | Shows whether the domain receives email. Other checks depend on it. |
| Permitted senders (SPF) | 3 | SPF defines which servers may send mail in the name of the domain. |
| Protection against forged senders (DMARC) | 3 | DMARC tells recipients what to do with forged mail in the name of the domain. |
| Encrypted delivery (MTA-STS) | 1 | MTA-STS prevents incoming mail from being diverted without encryption. |
| Reports on mail encryption (TLS-RPT) | 0.5 | TLS-RPT tells you when encrypted delivery fails. |
Web: Weight 40 %
| Check | Weight | Why |
|---|---|---|
| Encrypted website (HTTPS) | 4 | Without HTTPS, others can read along and change content. |
| Redirect to HTTPS | 1 | Visitors who type “http” should be connected securely without noticing. |
| Certificate | 4 | A valid certificate proves to visitors that they are on the real website. |
| Outdated encryption (TLS 1.0 and 1.1) | 2 | TLS 1.0 and 1.1 are considered insecure and should be switched off. |
| Enforce HTTPS (HSTS) | 2 | HSTS tells browsers to open the website only with encryption. |
| Security headers | 2 | These headers protect visitors from injected scripts and foreign frames. |
| Server version details | 0.5 | Version numbers help attackers find matching vulnerabilities. |
| Contact for security reports (security.txt) | 1 | People who find a flaw know whom to tell. |
DNS: Weight 20 %
| Check | Weight | Why |
|---|---|---|
| Signed DNS records (DNSSEC) | 2 | DNSSEC protects visitors from being sent to forged servers. |
| Permitted certificate authorities (CAA) | 1 | CAA defines who may issue certificates for the domain. |
| Domain expiry | 1 | If the domain expires, website and email are gone. |
Rules of the calculation
- An area that cannot be measured drops out. The remaining weights are scaled up.
- If HTTPS, SPF and DMARC cannot be measured, there is no grade. The app then shows “not gradable”.
- Some company types have exceptions. A host may, for example, allow several certificate authorities.
- An accepted answer counts 100 %, one still open 50 %. Rejected or questioned answers count nothing.
Schema v2: three parts
In schema v2 the grade is made of three parts. A missing part drops out of the calculation.
| Part | Weight | Content |
|---|---|---|
| Outside-in check | 40 % | Passive measurement of the primary domain, as described above. |
| Questionnaire | 40 % | The supplier's answers on the ten topics of § 32 (4) NISG 2026. Each topic counts the same. |
| Evidence | 20 % | Share of the evidence from the tier's profile that is accepted and valid. |
Confidence level
- Outside-in check: the grade rests on the outside measurement only.
- Self-disclosure: a questionnaire without checked evidence is added.
- Verified: all evidence the tier asks for is accepted and valid.
Check rhythm
Tier 1 is checked daily, tier 2 weekly, all others monthly. Each domain gets at most one measurement per day.
What the outside-in check does not see
- Open ports and services: Suploris does not look for them.
- Internal systems, processes and people.
- Subdomains other than the www address.
Questionnaire and evidence close these gaps. That is why the app shows the confidence level next to the grade.
Artificial intelligence
Suploris currently uses no AI for assessments. Grades come only from the rules on this page.
For proposals on register data, Neuralis GmbH i.G. uses Claude by Anthropic, USA. Only public register details are sent, no customer data. A person checks each proposal field by field. A proposal never changes a grade.
If AI is added, this page names provider, place of processing and labelling. AI never changes a grade without human confirmation.
Fair to the supplier
Suppliers see their findings, can correct them and provide evidence. Suploris does not publish results about third parties.
What the outside-in check retrieves and how to object: About the self-test.
Send questions on the methodology or report a measurement error to security@suploris.com.