SCF Assessment Guides provide the detailed assessment criteria, control scoping, and assessment objectives for each SCF CAP certification. Each guide defines what a 3PAO assessor will evaluate, how controls are scored, and the evidence requirements for a successful conformity assessment.
SCF Assessment Guides are the authoritative reference documents that define the assessment criteria for each available SCF CAP certification. They serve three primary audiences: Organizations Seeking Assessment (OSAs), Registered Provider Organizations (RPOs), and Third-Party Assessment Organizations (3PAOs).
Each Assessment Guide provides a comprehensive mapping of the certification-specific requirements to the corresponding SCF controls, including the specific Assessment Objectives (AOs) that a 3PAO assessor will evaluate. The guides define the Minimum Security Requirements (MSR) control set for each certification, the tailored subset of SCF controls that must be implemented and assessed.
Assessment Guides also specify the evidence types expected for each control (examine, interview, and test artifacts), the scoring methodology used to determine conformity, and the thresholds required for successful certification.
Control Mapping: Complete mapping of certification requirements to SCF controls and Assessment Objectives.
MSR Control Set: The specific Minimum Security Requirements controls applicable to the certification.
Evidence Requirements: Detailed specifications for examine, interview, and test evidence artifacts. Scoring
Methodology: How controls are evaluated and scored. Certification Thresholds: Pass/fail criteria and conformity designation requirements.
Certification Thresholds: Pass/fail criteria and conformity designation requirements.
The following Assessment Guides are available for download. Each guide corresponds to an available SCF CAP certification and provides the complete assessment criteria for that specific conformity designation.
Assessment Guides serve different purposes depending on your role in the SCF CAP ecosystem. Here is how each audience should use them to prepare for or conduct a successful conformity assessment.
Use the Assessment Guide for your target certification to understand exactly which SCF controls are in scope, what evidence you need to prepare, and how your controls will be scored. The MSR control set defined in the guide becomes your implementation checklist. Start with the guide before engaging an RPO or 3PAO.
RPOs use Assessment Guides to structure their advisory and preparation services. The control mappings and evidence requirements define the scope of work for client engagements. RPOs should ensure their clients’ implementations address every Assessment Objective before recommending readiness for a 3PAO assessment.
3PAOs use Assessment Guides as the authoritative reference during conformity assessments. The guides define the examine, interview, and test procedures, the scoring methodology, and the certification thresholds. All assessment findings must be documented against the specific Assessment Objectives.
Assessment Guide Updates
SCF Assessment Guides are updated in alignment with changes to the underlying laws, regulations, and frameworks they cover. When a new version of a mapped authority is released, the corresponding Assessment Guide is updated to reflect revised control mappings and assessment criteria. Always verify you are using the current version before beginning an assessment.
%20(white).png)
.png)