SWIFT Customer Security Programme (CSP)

SWIFT CSP has evolved and will continue to do so since its inception. Customers will need to continue to implement security controls and elevate limits to ensure CSCF compliance. Previously, SWIFT customers were required to self-certify CSCF v2019 by December 31, 2019. This updated framework includes 19 required security controls and 10 advisory security controls.

In 2020, SWIFT made 2 existing advisory controls mandatory and introduced 2 new advisory controls resulting in 21 mandatory and 10 advisory controls in CSCF v2020.

By 2021, SWIFT converts 01 advisory control into mandatory, thereby increasing the number of mandatory controls to 22 controls and 9 advisory controls in CSCF v2021. As of mid-2021, organizations will need to support their attestation of CSCF v2021 with an internal audit or an independent audit conducted by a third party.

In July 2021, SWIFT published the CSCF v2022 with 23 mandatory and 9 advisory controls respectively, against which organisations will need to attest in the second half of 2022.

The CSCF Working Group centralised, prioritised and reviewed all feedback from the community prior to finalising the changes shown in the picture below

_{Source: https://www.swift.com/}

To comply with SWIFT CSP requirements, organizations need to adopt a systematic approach that requires coordination across the three lines of defence, leadership support, and a team of stakeholders. Diverse members have full knowledge of professional profession. Is your organization ready to respond to the compliance requirements from SWIFT CSP?