You're undertaking a SWIFT independent assessment, but how should you prepare? What cybersecurity requirements will be assessed? In this video, we discuss the structure of the SWIFT customer security controls framework, how it applies to your SWIFT implementation, and what to look out for as you prepare to undertake your SWIFT independent assessment.
Hi. I'm John Anderson, a SWIFT practice leader here at Schellman. I've been conducting and managing SWIFT assessments since 2020, using the contemporaneous version of the SWIFT Customer Security Controls Framework (CSCF), which is at the core of the SWIFT customer security program and outlines a comprehensive set of controls designed to safeguard the SWIFT network, which is made up of critical infrastructure for the facilitation of global financial communications.
Designated as either mandatory or advisory—compliance with mandatory controls is required for entities that use the SWIFT network—CSCF controls are based upon industry best standards and map directly to PCI DSS v4.0, ISO 27002, and the NIST Cybersecurity Framework (CSF).
Organizations that have implemented SWIFT must choose from 5 different architecture types according to the SWIFT components that they own and manage. These architecture types range from the largest security control burden at the top end to the least security control burden at the bottom end of the spectrum.
To help determine which architecture type is the most appropriate for your chosen SWIFT implementation, you can reference guidance on SWIFT.com. Applicability of controls within the CSCF is based upon architecture type, so your determination must be made quite carefully.
A crucial component of the CSCF is the establishment of a secure zone.
Similar to segmentation scope reduction approaches for other cybersecurity frameworks, the implementation of a secure zone that contains the SWIFT infrastructure is a requirement for four of the five architecture types.
A secure zone significantly reduces the scope of the SWIFT assessment and ensures that the most important components of the SWIFT implementation are protected to the highest degree possible.
The SWIFT CSCF is also structured around three objectives:
Seven strategic security principles further guide the achievement of these objectives, as they cover aspects such as:
All that being said, it's important to understand that the CSCF is a dynamic document that is regularly updated to address emerging cyber threats and incorporate advancements in security best practices.
In doing this, SWIFT actively engages with its user community and cybersecurity experts to refine and strengthen the controls within the framework. Then, each year, SWIFT introduces a new version of the CSCF CSCF and will often promote a control from advisory to mandatory as a component of those changes introduced year to year.
Here at Schellman, we want to serve as your SWIFT independent assessor to facilitate your compliance activities and support your annual attestation. If you have questions, please reach out to us on our website, as we'd be happy to have a conversation about any concerns you may still have.