The SIG is the trust half of the Shared Assessments model and the Standardized Control Assessment (SCA, formerly the agreed upon procedures) is the verify half: an objective set of testing procedures, each control area carrying objectives, risk statements, controls, procedures and documentation attributes, used to validate that expected controls are present. Under the voluntary guidelines the outsourcer obtains senior management agreement and confirms no contract requires a different method; the assessee makes documentation and staff available; the parties agree the SCA version, the products and services, risk domains and procedures in scope, locations, period covered and whether the engagement is single or collaborative across several outsourcers, and record out-of-scope areas in the SCA control panel. An acceptable report is issued under a valid SCA licence by an assessment firm that is a Shared Assessments member, has signed the acknowledgement form and holds the badge, with a lead assessor holding the CTPRA certification (not required for internal assessments not shared externally); the report uses the SCA report template, expresses no opinion, states only whether controls in scope are implemented, and never contains remediation plans or management responses, which are separate documents; sharing conditions are agreed in advance and each outsourcer defines its own corrective actions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.