Skip to content

Due diligence

Assess NOMARK as a service provider.

Assessing a service provider is your obligation, at paragraph 48 and paragraph 59. Nothing here discharges it. What it does is show you the material you would ask us for, as it stands today. The questionnaire, the security addendum, the residency statement and the subprocessor register are written. Counsel has cleared none of it, and three things are still missing because only the owner can supply them: a registered office, the insurance particulars and a dedicated security@ alias. The entity name and the ABN are printed in the footer of this page, and left blank in the pack along with every other owner field.

Drafted for counsel review. Not a contractual representation.

01

Every blank field has a name against it.

The pack sorts every field by who can clear it. That sort is published here; the fields themselves are not. You can see what is outstanding before you ask for any of it.

OWNER-FACT
Only the owner can supply it, so it stays blank. A plausible value would be a false one, and this is the first field an analyst checks against a public register.
The owner supplies it.
INFRA-FACT
Verified against the running deployment, or absent. Nobody can stand behind a deployment claim they did not check.
A check of the live deployment supplies it.
PROPOSAL
Drafted so a reviewer can redline it instead of drafting from nothing. It binds nobody until counsel has reviewed it and the owner has signed.
Counsel reviews it, then the owner signs.

A class is not a score. A blank owner field is not worse than a drafted proposal field; the two sit with different people.

02, Occurrences is the gate metric (D-2): the pack stays gated while any DRAFT marker remains, because the thing being cleared is a marker rather than a line, so the figure falls monotonically as counsel clears markers. Matching lines are a secondary figure and are never summed into the gate metric — each figure is rendered beside its own command (I-4).

How much counsel still has to clear.

116 unresolved markers

Counted by grep -ro 'DRAFT' docs/vendor-assessment/ | wc -l

docs/vendor-assessment

112 matching lines

Counted by grep -rc 'DRAFT' docs/vendor-assessment/

docs/vendor-assessment

8 documents

Counted by grep -rl 'DRAFT' docs/vendor-assessment/ | wc -l

docs/vendor-assessment

Each figure counts the same drafting work from a different angle, and the three are never added together. Markers is the figure that gates the pack, because that is what counsel clears. The per-document split stays inside the pack. It was not reworded to get it onto this page early.

03, .nomark/ship-queue.json

Two items stand between you and the pack.

Both are entries in the register named beside this block. The ids below resolve there.

SQ-OWNER-FACTS

Three owner-held facts are still missing: a registered office, which the city named in the site footer is not; the insurance particulars, from insurer to certificate of currency; and a dedicated security@ alias. The entity name and the ABN are published in that footer, and every owner field in the pack stays blank until the owner ratifies it.

Cleared by the owner

SQ-COUNSEL

The proposal fields are drafted to a standard a reviewer can redline, and are not ratified. Until counsel has reviewed them and the owner has signed, they commit nobody.

Cleared by counsel, then owner signature

04

What you get when both items clear.

The register above becomes the published pack: the field index row by row, the documents themselves, and the classes filled in.

No target is set for that. Asking for the pack under a confidentiality agreement is faster than waiting, and the answer is the same either way.

Request the pack under a confidentiality agreement

The link opens the briefing page, which carries the address to send that request to.

05

The three questions a committee asks next.

What paragraphs 48 and 59 require of you is set out clause by clause. If NOMARK stops, records you already hold still verify on your own machines, and that page shows how. The certifications register lists nothing, because none has been issued, and it is published empty.

Provenance

Derived at 2026-10-13T21:23:07.203Z

From commit be2f6c5568b6d2dfc9f370a3b85c0a7ab3277613