Skip to content

CDP and EcoVadis: The Scorecards That Filter You

Two emails land in the same week. A large retail customer asks you to complete an EcoVadis assessment. Another asks you to respond to a CDP climate request. You are a 15-person company with no sustainability manager. Both emails are deadlines.

These two platforms are how big buyers screen suppliers today, and small companies lose business by treating them as optional admin. Here's how they work and how to survive them.

CDP: the disclosure platform

CDP runs annual disclosure cycles for climate, water and forests. Companies answer structured questionnaires about governance, risks, emissions and targets, and receive a score from A down to D-.

The practical route for a small supplier: the CDP Supply Chain program. A large buyer sends you a link, you answer a shortened questionnaire aimed at smaller organisations, and the buyer sees your response and score. Responding through a customer's request is free to you — the requesting customer pays. If nobody has asked you yet but you want a public CDP disclosure, that's the paid route, with a four-figure admin fee.

The climate questionnaire is built around the same logic as IFRS S2 — governance, risk, emissions, targets — so if you've already built a greenhouse gas inventory, a risk paragraph and a target, you're most of the way through the form. CDP's scoring rewards completeness and data quality over performance; you can score well with modest emissions if your numbers are solid and your process is documented.

EcoVadis: the rating platform

EcoVadis works differently. Instead of a questionnaire season, you buy an assessment (for a small firm, a low four-figure annual subscription), upload evidence across four themes — environment, labour and human rights, ethics, and sustainable procurement — and receive a score from 0 to 100.

Medals start at Bronze from 45 points, Silver from 58, Gold from 72, and Platinum for the top 1%. The scorecard is valid for 12 months and can be shared with unlimited customers, which is why one EcoVadis assessment tends to replace dozens of customer questionnaires. Big buyers plug into the EcoVadis network and see your score without asking you anything.

What actually gets scored

Both platforms reward the same things, and the first year is where small firms can move fast:

  1. Policies that exist in writing. Code of conduct, environmental policy, ethics policy, a modern slavery statement. For most small companies these either exist or can be written in a week. A surprising share of first-year scores are lost simply because nothing is written down.
  2. Documented processes. How you screen suppliers, how you track energy, how you handle incidents.
  3. Evidence files. Certificates (ISO 14001, ISO 27001, GOTS, RSPO — whatever you hold), energy data, audit reports. Upload what you have; both platforms score evidence, not marketing copy.
  4. Numbers. Emissions, water, waste, targets. Same data as every other framework.

The pattern worth noticing: it's the same evidence set as CDP, IFRS, CSRD supplier requests, and everything else. Build it once, reuse it everywhere. We wrote about that in the CSRD trickle-down piece.

Timing and mistakes

CDP has a disclosure season — requests typically go out in spring with summer scoring deadlines. Missing the window means waiting a year. EcoVadis is anytime, but re-assessments happen yearly and scores decay if you ignore the platform for long enough. Buyers see when a scorecard is stale.

The classic small-firm mistakes: answering without evidence (both platforms check claims against documents), copying a big company's answers, and buying the subscription then never updating. A mediocre score you maintain beats a good score that lapses.

The pragmatic play for a small company

Do one focused week: write the missing policies, gather every certificate you hold, pull your energy and fuel numbers, and write down your supplier screening process. That single week feeds CDP, EcoVadis, IFRS-style questionnaires and most RFPs for the next twelve months.

Then keep the evidence live. Policies and certificates change, and re-uploading scattered files is how things get missed. Company-level pages per document — the Sustalium model at €10 per document — assembled into one Trust Hex link you paste into every questionnaire, means your EcoVadis evidence links never break and your CDP answers have a public trail behind them. Re-assessment season becomes mostly copying URLs. The scorecards are here to stay. Make them a by-product of good record keeping, not an annual fire drill.

How Sustalium Helps with Scorecards and Questionnaires

  • One evidence library — policies, certificates and data as live company-level pages that both platforms can link to.
  • One Trust Hex link — paste a single URL into every questionnaire instead of uploading the same files everywhere.
  • Evidence that never breaks — update a policy once and every scorecard and RFP sees the current version.

Upload Once. Link Everywhere.

Keep your policies, certificates and numbers as living pages that feed CDP, EcoVadis and every RFP. See the platform with your own data, free: no card required.

See the Trust Hex in Action →

Frequently Asked Questions

Does responding to a CDP request cost money?

No, when a CDP supply chain member requests you — the requesting customer pays. Self-disclosure outside a customer request carries a four-figure admin fee.

How long is an EcoVadis scorecard valid?

Twelve months, with annual re-assessment. Scores decay if you ignore the platform, and buyers can see when a scorecard is stale.

What do I actually upload?

Evidence, not marketing copy: written policies, certificates you hold, energy and emissions data, and your documented supplier screening process.

Last updated: September 12, 2026

Global Digital Trust & Compliance

Sustalium is the digital-first platform for managing complex business certificates and sustainability declarations across global supply chains.

Environment & ESG
  • Digital Product Passport (DPP)
  • Carbon & Water Footprint
  • Circularity & Reuse (ISO 14021)
  • De-Forestation Free
Product & Food Safety
  • FSMA 204 (FDA Traceability)
  • REACH & RoHS Compliance
  • PFAS-Free & VOC Declarations
  • Prop 65 & TSCA Title VI
Social & Ethical
  • ISO 26000 Responsibility
  • Modern Slavery Statements
  • UFLPA Forced Labor Traceability
  • Ethical Labor Declarations
Governance & Trade
  • Swiss Made & Origin Claims
  • GDPR & AI Ethics (EU AI Act)
  • CE Marking & UKCA Conformity
  • Bill S-211 (Canada) Reporting
Start Free

Have questions about a specific standard?
Contact our compliance team at compliance@sustalium.com