How to Prepare For Your SWIFT Independent Assessment

You're undertaking a SWIFT independent assessment, but how should you prepare? What cybersecurity requirements will be assessed? In this video, we discuss the structure of the SWIFT customer security controls framework, how it applies to your SWIFT implementation, and what to look out for as you prepare to undertake your SWIFT independent assessment.

Hi. I'm John Anderson, a SWIFT practice leader here at Schellman. I've been conducting and managing  SWIFT assessments since 2020, using the contemporaneous version of the SWIFT Customer Security Controls Framework (CSCF), which is at the core of the SWIFT customer security program and outlines a comprehensive set of controls designed to safeguard the SWIFT network, which is made up of critical infrastructure for the facilitation of global financial communications.

Understanding the SWIFT CSCF

Designated as either mandatory or advisory—compliance with mandatory controls is required for entities that use the SWIFT network—CSCF controls are based upon industry best standards and map directly to PCI DSS v4.0, ISO 27002, and the NIST Cybersecurity Framework (CSF).

SWIFT Architecture Types

Organizations that have implemented SWIFT must choose from 5 different architecture types according to the SWIFT components that they own and manage. These architecture types range from the largest security control burden at the top end to the least security control burden at the bottom end of the spectrum.

To help determine which architecture type is the most appropriate for your chosen SWIFT implementation, you can reference guidance on SWIFT.com. Applicability of controls within the CSCF is based upon architecture type, so your determination must be made quite carefully.

Secure Zones

A crucial component of the CSCF is the establishment of a secure zone.

Similar to segmentation scope reduction approaches for other cybersecurity frameworks, the implementation of a secure zone that contains the SWIFT infrastructure is a requirement for four of the five architecture types.

A secure zone significantly reduces the scope of the SWIFT assessment and ensures that the most important components of the SWIFT implementation are protected to the highest degree possible.

SWIFT CSCF Objectives

The SWIFT CSCF is also structured around three objectives:

• To secure the access and use of the SWIFT network: This objective focuses on controlling access to SWIFT infrastructure, implementing strong authentication protocols, and monitoring user activity.

• To protect the confidentiality and integrity of financial information: This objective includes requirements regarding data protection measures like encryption, access controls, and data loss prevention.

• To detect and respond to security incidents in an effective manner: This objective defines incident detection and response capabilities including vulnerability management, incident reporting, and business continuity planning. 

SWIFT CSCF Strategic Security Principles

Seven strategic security principles further guide the achievement of these objectives, as they cover aspects such as:

• Risk management;
• Information security governance;
• Identity management; and
• The secure development life cycle.

Stay Ahead of Updates

All that being said, it's important to understand that the CSCF is a dynamic document that is regularly updated to address emerging cyber threats and incorporate advancements in security best practices. 
In doing this, SWIFT actively engages with its user community and cybersecurity experts to refine and strengthen the controls within the framework. Then, each year, SWIFT introduces a new version of the CSCF CSCF and will often promote a control from advisory to mandatory as a component of those changes introduced year to year.

Here at Schellman, we want to serve as your SWIFT independent assessor to facilitate your compliance activities and support your annual attestation. If you have questions, please reach out to us on our website, as we'd be happy to have a conversation about any concerns you may still have.