Tier 1 is the spend you control directly. You buy from a supplier, you cut the check, you know exactly who they are. Tier 2 is the spend your suppliers control on your behalf, and it's where most programs either find real numbers or quietly invent them.
A Tier 2 program asks your largest suppliers a simple-sounding question: of the dollars we pay you, how much did you pass through to small and certified diverse businesses? Get that right and you can credibly report an inclusion footprint several times larger than your direct spend. Get it wrong, or skip the validation, and you're reporting a number you can't defend when a customer's audit team asks how you got it.
This is a buyer's playbook for standing one up. If you're a prime on federal work, parts of this are not optional. FAR 52.219-9 and the subcontracting-plan rules in FAR 19.7 require subcontract reporting on covered contracts regardless of what any company decides about voluntary programs. The 2025 rollback of Executive Order 11246 hit voluntary corporate initiatives, not the statutory subcontracting obligations. Those still bind every covered prime.
Which suppliers to enroll firstDon't email all 4,000 vendors on day one. Tier 2 follows a Pareto curve, and your reporting effort should too.
Start with the suppliers that already owe this reporting to the government. Any company holding a federal contract above the subcontracting-plan threshold (generally $750,000, or $1.5 million for construction) is required by FAR 52.219-9 to maintain a small business subcontracting plan and report against it. They already collect the data. Asking them for a Tier 2 number is asking them to share a report they're producing anyway.
Then layer in by spend. Pull your top suppliers by annual dollars and work down until you've covered roughly 80% of addressable indirect spend. For most corporate programs that's somewhere between 40 and 150 suppliers, not thousands. Exclude categories where pass-through doesn't make sense (pure commodity utilities, some financial services) and flag them so the gap is documented rather than ignored.
For each enrolled supplier you want a named contact who can actually pull the data, usually someone in their finance or supplier diversity function, not the sales rep who owns your account. The sales rep will promise a number and then chase it internally for a quarter.
The data you actually collectKeep the intake tight. A bloated survey gets ignored. At minimum, per supplier, per reporting period:
- Total dollars your company paid them (the denominator they're reporting against).
- Direct Tier 2 spend: dollars they paid to small or diverse businesses on subcontracts and purchases specifically tied to serving your account.
- Indirect Tier 2 spend: a prorated share of their company-wide diverse spend, allocated to you by your share of their revenue.
- A breakdown by category: minority-owned (MBE), women-owned (WBE), veteran and service-disabled veteran-owned (VBE/SDVOSB), LGBTQ-owned (LGBTBE), disability-owned (DOBE), HUBZone, and small business overall.
- The certifying body and certificate status behind each claimed diverse dollar. A number is only as good as the certification underneath it.
That last point is where weak programs leak credibility. A supplier reporting "$2M to diverse businesses" should be able to name the bodies behind it (NMSDC for MBE, WBENC for WBE, NaVOBA for VBE, NGLCC for LGBTBE, Disability:IN for DOBE, or the relevant government certification). If you don't know who certified a supplier, you can't stand behind the dollar. Our certifying body directory lets you confirm which organizations actually issue each certification so a supplier's claim checks out.
Direct vs indirect: get the definitions straight before you collectThis is the distinction that derails Tier 2 reporting, so settle it in writing before the first survey goes out.
Direct (sometimes "first-tier" Tier 2) is clean. Your supplier ran a project for you, hired a certified minority-owned subcontractor to deliver part of it, and can tie those dollars to your account. You can claim the full amount.
Indirect is an allocation. Your supplier spends, say, 18% of its total procurement with diverse businesses across its whole book, and you represent 3% of its revenue. The indirect Tier 2 credit attributed to you is your revenue share applied to their overall diverse spend. It's a real and accepted method, but it's an estimate, and you should label it as one. Mixing direct and indirect into a single undifferentiated total is the fastest way to lose an auditor's trust.
Decide your house rule and apply it to every supplier the same way. The two common rules: count direct plus indirect (larger, defensible if you document the allocation math) or count direct only (smaller, harder to argue with). Pick one. Inconsistency across suppliers is worse than either choice.
The portal-and-spreadsheet realityEnterprise tools exist for this, and supplier.io, CVM, and similar platforms will collect and roll up Tier 2 surveys for you. They're worth it past a certain scale. Below that scale, most programs run on a structured spreadsheet and a recurring email, and that's fine if the spreadsheet is disciplined.
On the federal side the mechanics changed recently, and it matters for any prime. The old eSRS.gov system was retired on February 20, 2026, and Individual Subcontract Reports (ISR) and Summary Subcontract Reports (SSR) are now filed inside SAM.gov. The ISR is filed semiannually and at contract completion against a specific contract's plan. The SSR summarizes a contractor's subcontracting performance and is filed annually, historically due October 30. NAICS and PSC codes are no longer required on those reports after the migration. If your Tier 2 program and your federal subcontracting reports pull from different spend systems, reconcile them, because a customer reading both will notice when they disagree.
A practical spreadsheet setup: one row per supplier per period, columns for total spend, direct diverse spend, indirect diverse spend, each socioeconomic category, certifying body, and a validation status flag. Lock the formulas. Version it. The spreadsheet that "someone edited last quarter" is how a clean program turns into a number nobody can reproduce.
How to validate the numbersA reported number you haven't validated is a liability, not an achievement. Three checks catch most of the trouble.
Reconcile the denominator. The total spend a supplier reports for your account should match your accounts-payable record for them, within a small variance. If a supplier says you paid them $8M and your AP says $5M, stop. Either they're including affiliates you don't recognize or they're padding the base to make a percentage look better.
Verify the certifications behind the diverse dollars. Spot-check claimed diverse subcontractors against the issuing certifying body. This matters more after 2024: SDVOSB self-certification was eliminated, and a firm now has to be certified through the SBA's VetCert program for those dollars to count toward federal goals. The same direction of travel hit other categories. A supplier reporting old self-certified status as if it still counts is reporting a number that won't survive scrutiny. For the government-side SDB representation, a subcontractor can still self-represent in good faith under the FAR, so know which rule applies to which dollar.
Sample the source documents. Once a year, ask three or four suppliers for the underlying subcontract or invoice detail behind their reported figure. You're not auditing everyone. You're establishing that the numbers trace to something real, which is exactly what your own customers will ask you to demonstrate.
When a supplier's report fails a check, don't quietly drop it. Flag it, document the gap, and follow up. A program that reports a slightly smaller, fully validated number beats one that reports a big number it can't reproduce.
Where to source the suppliers in the first placeTier 2 only grows if your enrolled suppliers can actually find certified small and diverse subcontractors to spend with. That's the sourcing side of the same program, and it's where you can help your primes instead of just measuring them.
Point them, and yourself, at real certified suppliers. The supplier directory lets you search certified diverse and small suppliers by certification type, NAICS code, and capability, so a prime working a category gap can find qualified firms instead of reporting a zero. To understand which corporate programs and certifications are in play across your supply base, the corporate program directory maps who runs what. And if you're a prime trying to win or report on federal work specifically, our breakdown of the cheapest path to federal contracts in 2026 covers the registrations and representations that have to be in place first.
Run the program for one full reporting cycle, validate hard, and report the number you can defend line by line. That's worth more than a larger figure you'd have to walk back.
