SWIFT users must attest annually to compliance with the Customer Security Controls Framework (CSCF), supported by an independent assessment.
We assess your SWIFT environment against the mandatory and advisory controls for your architecture type and document results to support your attestation.
Objectives
- Confirm architecture type and SWIFT secure zone scope
- Assess mandatory and advisory CSCF controls
- Test segregation, access control and operator security
- Support your annual attestation
Methodology
01
Planning
- Define scope, applicable requirements and critical systems
- Agree audit plan, sampling approach and timelines
02
Fieldwork
- Review of policies, procedures and governance
- Testing of technical and operational controls
- Interviews with process owners and evidence verification
03
Technical testing
- Vulnerability assessment and penetration testing where in scope
- Configuration review of servers, databases and network devices
04
Reporting
- Observations rated by risk with recommendations
- Management responses and follow-up review
Deliverables
Audit plan and scope
Audit report with risk-rated observations
VAPT report where in scope
Remediation plan and follow-up review