A shared CyberVadis scorecard excludes its evidence documents
CyberVadis says a shared scorecard exposes assessment results and an improvement plan, while each supporting document has its own sharing setting. Reviewers need a recipient-specific disclosure receipt that shows which scorecard version and evidence files were actually accessible, when access began, and when it ended.
Third Party Current editorial graphic. Source material: CyberVadis scorecard-sharing help; analysis and presentation by Third Party Current.
Record the disclosure as a recipient-specific event
The direct answer is that receipt of a scorecard does not prove receipt of its underlying evidence. CyberVadis describes scorecard sharing and document sharing as separate controls. The disclosure record should identify the assessed legal entity, scorecard and assessment version, selected recipient and organization, invitation or share event, access start, overall and topic results exposed, improvement-plan version, document-sharing state, and the platform receipt or acknowledgement available at that time. [1]
Do not convert a general shared status into a universal evidence state. Two recipients can receive different document sets, and a later permission change can alter access without changing the score shown in an earlier review. Preserve sender, approver, stated purpose, recipient identity, data classification, permitted use, expiration, revocation, and any download or access evidence the platform and parties actually retain. Unknown receipt should remain unknown. [1]
Inventory every evidence document independently
For each supporting file, retain its title, evidence category, issuing or source organization, covered entity and scope, document date, validity period, language, classification, checksum or stable identifier, scorecard topic, sharing setting, recipients, approval, and later withdrawal or replacement. A visible document name is not proof that the recipient opened it, that its scope matches the assessed service, or that it remained current when a decision was made. [1]
Apply the organization's disclosure rules before changing a file's sharing setting. Supplier teams may need to redact personal, customer, security-sensitive, export-controlled, confidential, or contract-restricted material, obtain approval, or provide a bounded substitute. Preserve what was withheld, why, who approved that decision, and what alternative evidence was supplied. Never infer a control failure only from a lawful or justified disclosure restriction.
Reconcile receipt before beginning review
The receiving team should compare the expected evidence package with the accessible package before review starts. Record the scorecard version, requested documents, files received, inaccessible links, superseded files, scope gaps, questions, supplier response, reviewer, and resolution. A reviewer comment should cite the exact artifact and version used rather than a generic platform profile. If access is revoked later, preserve the review-time receipt and any retention limits without copying material beyond authorized use.
This disclosure receipt supports review logistics; it does not make the risk decision. Keep evidence delivery, evidence sufficiency, control finding, remediation, exception, and engagement-specific acceptance as separate governed states with their own owners. A recipient can have a complete delivery record while the organization's assessment and engagement decision remain open. [2]
Test different recipients and a revoked document
A representative test should share one scorecard with two recipients, expose different documents to each, replace one file, revoke another, and request review after those changes. Reviewers should reproduce which scorecard, scores, plan, and files each recipient could access at the decision time; which materials were intentionally withheld; which acknowledgements exist; and whether later changes preserve the prior disclosure history. [1]
CyberVadis's official help and assessment pages support the attributed sharing controls and provider positioning. They do not establish a customer's configuration, file contents, recipient access, review quality, control effectiveness, remediation, risk acceptance, compliance, or outcome. Qualified supplier, risk, security, privacy, procurement, compliance, records, and legal owners retain those decisions. [1] [2]
What we will watch next
Third Party Current will watch for later primary-source evidence that changes the maintained company, capability, or standards record. The next useful evidence may include implementation documentation, release details, regulator findings, corrected methods, product packaging, customer-observable workflow, or a subsequent company statement. Until then, the dated source and its stated boundary remain attached to this analysis.
