Is self-attestation without an independent assessment still accepted by SWIFT?

No. Since 2021, SWIFT has mandated that all KYC-SA submissions must be backed by a Community-Standard Independent Assessment performed either by an independent external security firm or an independent internal audit team holding recognized cybersecurity credentials.

What must be covered during Control 1.1 segmentation testing?

Segmentation testing must empirically prove that standard enterprise workstations and networks cannot bypass firewall rules to reach the SWIFT Secure Zone. Independent penetration testers validate ACLs, routing restrictions, and protocol boundaries at least annually.

Does CSCF apply to institutions connecting via a SWIFT Service Bureau or cloud provider?

Yes. Such institutions fall under Architecture Types A2, A3, or B. While core SWIFT server infrastructure is managed by the service bureau, local operator terminals, network connectivity, jump hosts, and authentication controls remain within the institution's mandatory assessment scope.

SWIFT CSP / CSCF v2025/v2026: KYC-SA Assessment and Penetration Testing Guide

An authoritative guide to the SWIFT Customer Security Controls Framework (CSCF v2025/v2026), detailing all 32 controls, mandatory annual independent assessment expectations, and Control 1.1 scope segmentation testing methodologies.

Executive Summary and Mandate Overview

Target Audience Financial institutions, commercial banks, and business entities connected to the global SWIFT financial messaging network

Mandatory Frequency Community-Standard Independent Assessment at least annually, attested via KYC-SA by December 31

Required Scope SWIFT Secure Zone, Architecture Types (A1 to B), Control 1.1 Segmentation, messaging interfaces, and connected systems

Non-Compliance Risk Non-compliance reporting to global counterparties via KYC-SA, increased transaction scrutiny, and potential messaging suspension

SWIFT CSP and CSCF v2025/v2026 Architecture

The SWIFT Customer Security Programme (CSP) establishes mandatory cybersecurity baselines to safeguard the global financial messaging ecosystem.

Structured around 3 overarching security principles: Secure your Environment, Know and Limit Access, and Detect and Respond.
Comprises 7 security objectives and 32 controls: In CSCF v2025, 25 mandatory controls (must do) and 7 advisory controls (should do).
Transition to CSCF v2026: Control 2.4 (Back Office Data Flow Security) transitions from Advisory 2.4A (should do) to Mandatory Control 2.4 (must do) for bridging servers (26 mandatory, 6 advisory), and customer client connectors are incorporated into mandatory control scope.
Enforceable across all SWIFT-connected financial institutions globally, including commercial banks and specialized financial institutions in Thailand.
Requires organizations to classify their deployment into Architecture Types (A1, A2, A3, A4, or B) to determine their applicable control baseline.

Mandatory Independent Assessment and KYC-SA Attestation

SWIFT mandates that every connected institution complete an annual independent assessment and submit their attestation via the KYC-SA portal.

Mandatory requirement (must do): Assessments must be conducted as a Community Standard Independent Assessment by qualified external assessors or an independent internal audit function.
Lead assessors must hold globally recognized professional credentials such as CISSP, CISA, CRISC, or offensive security certifications.
Attestation window (must do): Annual attestations must be renewed and published in the SWIFT KYC Security Analytics (KYC-SA) directory between July 1 and December 31 annually.
SWIFT reserves the right to report non-compliant institutions directly to international counterparties and national regulators including the Bank of Thailand.

Control 1.1 Scope Segmentation Testing and Back Office Security

Control 1.1 mandates strict physical or logical segregation of the SWIFT secure zone from general corporate enterprise networks.

Mandatory requirement (must do): Independent scope segmentation testing must be performed at least annually and upon network changes to validate that perimeter firewalls enforce strict isolation.
Assessments evaluate firewall rules, VLAN isolation, jump server / bastion host hardening, and multi-factor authentication enforcement.
Control 2.4 enhancement: Back-office bridging servers interfacing directly with SWIFT messaging systems must enforce strict data flow protection to prevent unauthorized message tampering.
Penetration testing evaluates host configuration hardening, session security timeouts, least-privilege administrative access, and anti-tampering.

Requirements and Testing Scope Matrix

Summary of the referenced clauses, the testing scope they cover, and the expected evaluation cycle.

Reference	Mandate Title	Scope Required	Testing Cycle
Control 1.1	SWIFT Environment Protection (Network Segmentation)	Strictly isolate the SWIFT Secure Zone from general enterprise networks and perform independent segmentation penetration testing	At least annually and following significant network changes
Control 2.3	System Hardening Baseline and Operating System Security	Disable unnecessary services, enforce baseline configurations, and restrict communication protocols into the Secure Zone	Continuous enforcement and annual independent review
Control 4.2	Multi-Factor Authentication (MFA)	Mandate MFA for all interactive access into SWIFT components, jump hosts, and remote operator connections	Enforced continuously across all sessions
KYC-SA Assessment Policy	Community-Standard Independent Assessment Mandate	Independent validation of compliance across all mandatory CSCF controls by qualified external or independent assessors	Annually submitted to SWIFT KYC-SA by December 31

Compliance Readiness Self-Assessment

Select items your organization has completed to evaluate your readiness score.

Identify the SWIFT Architecture Type (A1 through B) and document an accurate architectural blueprint of the SWIFT Secure Zone Strictly segment the SWIFT Secure Zone from general enterprise networks and perform independent segmentation penetration testing Enforce Multi-Factor Authentication (MFA) across all SWIFT access points, jump servers, and administrative terminals Apply least privilege access policies and rigorous operating system hardening baselines across all in-scope systems Engage an independent external assessor holding recognized credentials to execute the mandatory annual CSCF assessment Compile independent assessment evidence and submit the annual attestation via the SWIFT KYC-SA portal before December 31