Building an Evidence Framework for SEBI CSCRF: What Counts, What Doesn't

Evidence Is the Difference Between a Claim and a Fact

In SEBI CSCRF, evidence is the artefact — document, screenshot, report, policy, log export — that demonstrates a control is not just documented but actually operating at the maturity level claimed.

The Four Evidence Quality Dimensions

Recency — Evidence must be current. A policy approved three years ago and not reviewed since is not evidence that the control operates today. Policy documents should be reviewed within 12 months; operational outputs within the cadence specified in the control description.