Global · SWIFT (Society for Worldwide Interbank Financial Telecommunication) · SWIFT CSCF

SWIFT Customer Security Controls Framework

The mandatory and advisory security controls that SWIFT users must implement and self-attest against each year.

What it is

The CSCF sets security expectations for every SWIFT user across three objectives: secure your environment, know and limit access, and detect and respond. Users self-attest each year against mandatory controls. Independent assessors check compliance on a risk-tiered schedule. Not meeting mandatory controls can be reported to regulators and trigger counterparty de-risking. SWIFT revises the framework yearly, and customers attest against the version active on their attestation date.

Who it applies to

All SWIFT-connected entities - banks, payment institutions, central securities depositories and qualifying intermediaries.

SWIFT Customer Security Controls Framework

Attestation runs on a fixed yearly cycle.

SWIFT is the global provider of secure financial messaging. It set up the Customer Security Programme (CSP) to help customers fight cyber attacks. Each customer still protects its own environment. The CSP adds better sharing of information across the community, better SWIFT tools for customers, and a set of controls that make endpoints stronger and fight cyber fraud.

The mandatory controls set a security baseline for the whole community. Every user must put them in place on its local SWIFT infrastructure. SWIFT chose to focus on these controls to set a realistic goal for near-term, tangible security gains and lower risk.

  • Attest every year

    Every SWIFT user must submit a Security Attestation each year, showing how well it meets the controls.

  • Full compliance by 31 December

    Users attest before the current controls version expires, and confirm full compliance with the mandatory controls no later than 31 December.

  • Re-attest between July and December

    After that, users must re-attest at least once a year, between July and December.

  • New joiners attest first

    A new user must attest before it goes live on the SWIFT network.

  • Independent assessment

    SWIFT requires an independent assessment for every customer's attestation. This came into force in 2021.

How Vectra helps with the SWIFT CSP.

Vectra has deep experience with Swift CSP assessments. We have run many Swift CSP engagements across many territories, in Australia and overseas.

Swift CSP Assessment

A detailed assessment of your SWIFT CSP controls, so you know where you stand before you attest.

Swift CSP Audit

We confirm your controls line up with the SWIFT CSP guidelines. You get a controls report under a recognised standard, such as ISAE3000.

Requirements

Restrict internet access

Segregate the SWIFT environment from the general IT estate and restrict internet access.

Reduce attack surface

Harden and patch systems hosting or supporting SWIFT, including operator PCs.

Physically secure the environment

Stop physical tampering with SWIFT-related assets.

Prevent compromise of credentials

MFA, password policy, least privilege and privileged-access controls.

Detect anomalies and respond

Monitor, log and alert on SWIFT-related activity. Keep a documented incident response plan.

Sources

Start with a conversation.

Speak to us about your cyber governance and compliance requirements.

Send us a message

What can we help with?

A sentence or two is plenty. We'll ask for detail when we reply.