Secure your environment
- Restrict internet access and protect critical systems
- Reduce attack surface and vulnerabilities
- Physically secure the environment
Interbank messaging · Core service
SWIFT CSCF assessment for institutions that move value.
Independent assessment that confirms your architecture type, tests every applicable control and gives counterparties an attestation they can rely on.
- Customer Security Program
- Independent assessment
- KYC-SA attestation
- Who it serves
- Banks, payment institutions, market infrastructures, corporates and service bureaux
- Framework
- The CSCF version in force for your attestation year
- Our role
- Independent external assessor, with readiness and remediation support
- Deadline
- Attest at least annually by 31 December, and on any change
The business challenge
Your counterparties can read your attestation.
Attackers have used compromised local SWIFT environments to send fraudulent messages that looked entirely legitimate. The CSCF is the baseline every user must meet and declare.
Attestations are shared with counterparties through KYC-SA, and SWIFT can report non-attestation to supervisors. The framework moves every year, so last year’s assessment is not enough.
- Control objectives
- 3
- Principles beneath them
- 7
- Architecture types to choose between
- 5
- Attestation deadline, every year
- 31Dec
What a sound assessment delivers
01
The right architecture type
A reasoned conclusion on the decision that sets which controls apply.
02
A defensible attestation
Evidence-backed conclusions, ready for KYC-SA before the deadline.
03
A secure zone that holds
Segregation and operator access tested in practice, beyond the diagram.
04
A head start on next year
Controls changing status flagged early, with a plan.
The annual cycle
One version. One attestation year.
SWIFT publishes each CSCF version ahead of the year it governs.
- Mid-yearNext version published
New controls and advisory-to-mandatory promotions.
- OngoingPlan and implement
Gap-assess and remediate before the cycle opens.
- Attestation windowIndependent assessment
Every applicable control tested and documented.
- By 31 DecemberAttest in KYC-SA
Submit, approve and share. Re-attest on any change.
SWIFT’s published documentation sets the exact dates and version for each attestation year.
Architecture types
Your architecture type decides your scope.
Select a type. Misclassifying it is one of the most consequential errors you can make, in either direction.
Architecture A1
You own both interfaces
The full SWIFT stack runs in your environment, so every in-scope control applies to you.
Architecture A2
A provider hosts communication
You still protect the messaging interface, its secure zone and operator access, and you verify the provider’s attestation.
Architecture A3
You connect through a SWIFT connector
A smaller footprint, but the connector and the systems that reach it still need protection.
Architecture A4
You run a customer connector
Middleware or file transfer exchanging messages with a provider. Recent versions broadened this type, so confirm it carefully.
Architecture B
No SWIFT-specific footprint
Fewer controls apply, but user PCs, credentials and back-office links still matter.
The framework
Three objectives. Seven principles. Every control tested.
Controls are mandatory or advisory, and each applies only to particular architecture types.
Know and limit access
- Prevent compromise of credentials
- Manage identities and segregate privileges
Detect and respond
- Detect anomalous activity
- Plan for incident response and information sharing
Environment protection
Segregate the secure zone from general IT and the internet.
What assessors look forFirewall rules and diagrams that match each other.
Back-office data flows
Protect integrity and authenticity between back office and SWIFT.
What assessors look forMutual authentication on every flow.
Transaction business controls
Restrict activity to expected counterparties and patterns.
What assessors look forLimits, reconciliation and four-eyes approval that operate.
Multi-factor authentication
MFA for interactive access to SWIFT components.
What assessors look forEvery path, including emergency routes.
Logging and monitoring
Record events and detect anomalies in the local environment.
What assessors look forLog sources, alert rules and the response process.
Outsourced critical activity
Providers meet the controls they would face in-house.
What assessors look forProvider attestations and your oversight.
Control numbers and names as published in recent CSCF versions. Applicability and status depend on your architecture type and attestation year.
Independent assessment
Who may assess you, and why it matters.
Every attestation must be supported by an independent assessment: internal, external or mixed.
| Route | What it requires | When it fits |
|---|---|---|
| Internal independent function | Independent of the first line, with relevant certifications | Mature, well-staffed audit functions |
| External assessor | Cybersecurity assessment experience; certified lead assessor | When independence, capacity or depth is needed |
| Mixed team | Independence rules applied to each member | Building internal capability with external depth |
Accreditation & scope
Our role as your independent assessor
What MarkTillson delivers
- Independent external assessment against the CSCF version for your attestation year
- CISA- and CISM-certified lead assessors who meet SWIFT’s requirements for an independent external assessor
- Architecture-type confirmation and scoping
- Readiness and remediation support, run as a separate workstream from the assessment
What remains yours, and SWIFT’s
- Your organization submits and approves the attestation in KYC-SA
- SWIFT does not certify assessors or issue certificates of compliance
Your engagement letter names the assessment team and their certifications.
Our methodology
From architecture to attestation.
- Phase 01
Discover
Confirm the architecture type, then map the zone, operators and flows.
- Phase 02
Assess
Test each control against SWIFT’s implementation guidance.
- Phase 03
Remediate
Prioritized fixes, with an eye on next year’s changes.
- Phase 04
Validate
Retest and finalize the report behind your attestation.
- Phase 05
Sustain
Change-triggered reviews and a gap view of each new version.
Capabilities & deliverables
What you receive.
Written for approvers, internal auditors and the engineers who run the zone.
Architecture-type conclusion
Type, deciding components and reasoning.
Control-by-control assessment
Conclusion, testing and evidence per control.
Independent assessment report
The record supporting your KYC-SA attestation.
Remediation and next-version plan
Actions for today’s gaps and next year’s changes.
Secure-zone architecture
Segmentation, jump servers and operator PCs reviewed before you build.
Penetration testing of the zone
From general IT towards the secure zone.
Payment controls
Limits, reconciliation and anomaly detection with operations.
ISO 20022 change
Whether messaging changes alter flows or architecture type.
Framework mapping
How SWIFT work supports other obligations.
Evidence from a SWIFT assessment can support DORA, ISO/IEC 27001 and PCI DSS within the SWIFT environment.
| Control area | ISO/IEC 27001:2022 | NIST CSF 2.0 | DORA | PCI DSS v4.0.1 |
|---|---|---|---|---|
| Secure-zone segregation | Directly addressed | Directly addressed | Partially addressed | Directly addressed |
| MFA & privileged access | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
| Back-office data-flow protection | Partially addressed | Partially addressed | Partially addressed | Partially addressed |
| Transaction business controls | Not addressed– | Partially addressed | Partially addressed | Not addressed– |
| Logging & anomaly detection | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
| Outsourced activity oversight | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
Directly addressed Partially addressed or different evidence expectations , Not a primary objective. CSCF evidence covers the SWIFT environment only. Other frameworks generally require the control across the organization.
Industry considerations
Different users. Different exposures.
High volumes and many operators make access and business controls the hardest to evidence.
- Operator population and privileged access
- Alignment with DORA and NIS2
- Banking & financial services
Lean teams connect through bureaux or connectors, so type confirmation and provider oversight dominate.
- Reliance on provider attestations
- FinTech & payments
Their assurance must be strong enough for every customer that relies on it.
- Multi-customer segregation
- Shared-infrastructure definitions
Smaller, less specialized environments need hardening and operator discipline.
- Treasury workstation hardening
- ERP payment-run integration
FAQs
Questions about the CSP.
Is an independent assessment mandatory?
Yes. Every attestation must be supported by an independent assessment: an internal function independent of the controls, an external assessor, or a combination.
Which CSCF version do we assess against?
The version for your attestation year. At times two versions matter: the one you attest against now and the one you are preparing for.
What qualifications should an external assessor have?
Cybersecurity assessment experience, with a lead assessor holding a certification such as CISSP, CISA, CISM, PCI QSA or ISO/IEC 27001 Lead Auditor. Our lead assessors hold CISA and CISM, and your engagement letter names them.
Can you help us remediate and then assess us?
Yes. Remediation support and the assessment are run by different people, so the assessment remains independent.
What if we cannot meet a mandatory control by the deadline?
You must still attest and declare the non-compliance, which counterparties can see. A credible remediation plan helps in those conversations.
Related services and insights
Plan your attestation
Attest with confidence, well before 31 December.
Tell us your architecture and attestation status. We will propose a timeline that leaves room to remediate.