SWIFT CSCF

Customer Security Controls Framework: component inventory, integrity hashes, supplier verification.


Short name	SWIFT
Region	International
Country or scope	International
Sector	Finance
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers SWIFT

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 19 controls from Safeguard's control catalog for SWIFT.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 26: 4 written for SWIFT and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`SWIFT-INV` SWIFT Environment Component Knowledge	Protecting and scoping the SWIFT secure zone requires knowing all software components deployed within it, i.e. a maintained component inventory (SWIFT CSCF Control 1.1, SWIFT Environment Protection: scope identification)	Scan
`SWIFT-2-2` Security Updates	Mandatory security updates must be applied promptly to SWIFT-related components, which requires current version data to establish update applicability (SWIFT CSCF Control 2.2, Security Updates)	Scan
`SWIFT-6-2` Software Integrity	The integrity of SWIFT-related software must be verified against known-good references, requiring integrity hashes for deployed components (SWIFT CSCF Control 6.2, Software Integrity)	Scan
`SWIFT-2-7` Vulnerability Scanning	Regular vulnerability scanning of the SWIFT environment requires components identifiable against vulnerability databases (SWIFT CSCF Control 2.7, Vulnerability Scanning)	Scan
`SWIFT-SUP` Supplier / Provider Verification	Reliance on vendors and outsourced providers for SWIFT infrastructure requires knowing the supplier of each software component so provider assurance can be obtained (SWIFT CSCF outsourcing/provider assurance provisions)	Scan
`SWIFT-ATTEST` Attestation Evidence	Annual attestation via the KYC Security Attestation process requires dated, identifiable evidence of the environment's software composition (SWIFT Customer Security Programme attestation requirement)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`1.1`	SWIFT Environment Protection: Secure Zone
`1.2`	Operating System Privileged Account Control
`1.3`	Virtualisation Platform Security
`1.4`	Restriction of Internet Access
`2.1`	Internal Data Flow Security
`2.2`	Security Updates
`2.3`	System Hardening
`2.5`	External Transmission Data Protection
`2.6`	Operator Session Confidentiality and Integrity
`2.9`	Transaction Business Controls
`2.11`	RMA Business Controls
`4.1`	Password Policy
`5.1`	Logical Access Controls
`5.2`	Token Management
`5.4`	Physical and Logical Password Storage
`6.1`	Malware Protection
`6.5`	Intrusion Detection
`7.1`	Cyber Incident Response Planning
`7.4`	Penetration Testing

Policy templates

Written for SWIFT:

SWIFT Local Operating Environment Security Policy
SWIFT Transaction Security and Anomaly Detection Policy
SWIFT Environment Software Integrity and Patch Management Policy
SWIFT Cybersecurity Incident Response Policy

And 22 from the standard set, adapted to SWIFT.