Prepare for a defensible SWIFT CSP independent assessment

What the assessment must establish

SWIFT describes independent assessment as the validation that the compliance declared in KYC-SA reflects the actual design and implementation of the applicable Customer Security Controls Framework controls. The assessment is recurring, so last year's evidence is a starting point, not a substitute for a current scope and current operating evidence.

Readiness scope

• confirm architecture type, BICs and the in-scope SWIFT footprint;
• map mandatory and advisory CSCF controls to systems and owners;
• review policies, configurations, logs, tests and recurring evidence;
• record compliant, partially compliant and non-compliant positions;
• build a remediation tracker with owner, due date and residual risk;
• prepare an assessor index and support the evidence walkthrough.

Readiness work and independent opinion stay separate

A team that designs or implements a control should not present itself as independently assessing that same work. We confirm the required independence and assessor route during scoping. CyAdviso can prepare the environment and evidence, support remediation and coordinate the review; the independent opinion is assigned to an eligible internal function or external assessor where separation is required.

Authoritative references

• SWIFT Customer Security Programme
• SWIFT — Perform an Independent Assessment

For the wider ICT-risk operating model, see the DORA ICT-risk ownership guide.