Evidence Request List

The SCF’s Evidence Request List (ERL) is designed to standardize and streamline the evidence request process for a SCF-based assessment. Beyond SCF assessments, the ERL can also be used as a guidebook for identifying reasonable artifacts to demonstrate evidence of due diligence and due care for other cybersecurity and/or privacy audits or assessments.

The ERL will be utilized as part of the SCF’s Conformity Assessment Program (CAP) to identify reasonably-expected artifacts and evidence to meet applicable SCF controls, since the identified evidence artifacts are mapped to SCF controls.

Since “time is money” when it comes to an audit or assessment, the ERL is specifically designed to make assessments more efficient, and therefore less expensive. The ERL is included as one of the tabs within the SCF download.

01

Levels the Playing Field

Establishes evidence expectations upfront so there are no surprises during an audit or assessment. Both the organization and the assessor know exactly what is expected.

02

Prevents Ad Hoc Requirements

Stops assessors from making up documentation requirements on the fly. The ERL provides a defined, reasonable baseline of expected evidence artifacts.

03

Reduces Assessment Costs

Since time is money in any audit, the ERL is specifically designed to make assessments more efficient — which translates directly into lower costs for the organization.

04

Mapped to SCF Controls

All identified evidence artifacts are mapped directly to SCF controls, providing a traceable link between evidence requested and control objectives being assessed.

💡

Use With the SCF’s Conformity Assessment Program

The ERL works hand-in-hand with the SCF Conformity Assessment Program (CAP) to establish a fair, predictable assessment process. Together, they ensure that both assessors and the organizations being assessed are aligned on what constitutes reasonable evidence.