How We Score - Tierlyn

Tierlyn publishes researched comparisons. We do not publish our own test scores, and we do not assign numeric scores to products on researched pages. The weights below show what matters most in each category and how we order a list. They are editorial weights, not test results.

Security compliance: weights that add to 100

Framework coverage and clause mapping: 30. Does the tool map controls to ISO 27001:2022 Annex A, and to other frameworks the buyer needs, without manual work for every control?
Evidence automation and integrations: 25. Does it collect evidence from cloud, identity, and code tools on a schedule, and does it flag a failed control before an audit?
Policy, risk, and audit workflow: 20. Does it provide policy templates, a risk register, a Statement of Applicability workflow, and auditor access?
Price clarity and total cost: 15. Is the price published, what does the first framework cost, and what is excluded, such as the audit fee?
Support, onboarding, and auditor network: 10. Does the vendor guide a first-time team, and can an auditor work inside the tool?

Identity and access: weights that add to 100

Access control and sharing: 30. Can an admin set vault permissions by role, share a client credential without exposing the password, and revoke access at once?
Offboarding and audit trail: 25. Does offboarding remove access in one step, and does the log show who accessed, shared, or changed a credential?
Authentication and directory fit: 20. Does it support multi-factor authentication, single sign-on, and directory sync for the team's identity provider?
Compliance fit: 15. Does it support the duties a firm must document, such as the FTC Safeguards Rule Written Information Security Plan for tax and CPA firms?
Price clarity and admin effort: 10. Is the per user price published, what is included, and how much admin time does enrolment take?

Backup and recovery: weights that add to 100

Workload coverage: 30. Does it back up Exchange, OneDrive, SharePoint, and Teams, including channel data where stated, and not only mail?
Restore speed and granularity: 25. Can an admin restore one mail, one file, or one site without restoring a whole tenant, and how fast is a typical restore?
Retention, storage, and independence: 20. How long can data be kept, where is the copy stored, and is it separate from the production tenant?
Security and ransomware controls: 15. Does it support immutable or air-gapped copies, encryption, and anomaly checks on restore?
Price clarity and restore costs: 10. Is the per user price published, are storage or egress fees separate, and what does a large restore cost?

Evidence sources

For each tool we review vendor documentation, the vendor's own pricing page, changelogs, public reviews, and published benchmarks. We link to the vendor page for every price. If a price is not published, we write "Quote only". We do not present a reseller price as a vendor price, and we do not present a review site rating as our own test result.

What "Researched comparison" means

A "Researched comparison" means we compared published sources and vendor documentation. It does not mean we installed the product, ran a trial, or measured performance ourselves. We only publish researched comparisons, so every list on Tierlyn carries that label. That limit is deliberate. It keeps our claims inside what our sources can support.

How to read a list

Read the "Best for" line first, then the cons, then the price and what it excludes. A tool at the top of a list is the best fit for the stated buyer problem, not the best tool for every team. A lower tool may fit a larger team, a different framework, or a stricter retention rule. Check scope, price, and the stated limits before you buy.