ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
If your institution is on the SWIFT network, security is not a matter of internal policy. SWIFT CSP attestation is an annual obligation: every member must attest against the Customer Security Controls Framework, and since the independent assessment requirement came in, that attestation has to be backed by evidence somebody else has checked. This guide covers the five steps and the decisions that make them harder than they look.
For financial institutions this sits alongside operational resilience obligations — see our DORA requirements guide if you are in EU scope.
The Customer Security Programme exists because the network is only as strong as its weakest connected member. The Customer Security Controls Framework splits into mandatory controls, which every institution must implement, and advisory controls, which are strongly encouraged and periodically promoted to mandatory.
Crucially, the controls that apply depend on your architecture type. How much of the SWIFT infrastructure you host yourself determines your scope, and getting that classification wrong invalidates everything downstream.
| Step | What it involves |
|---|---|
| 1. Determine architecture type | Establish which components you own and host, and therefore which controls apply |
| 2. Define the secure zone | Segment SWIFT infrastructure from the general corporate network |
| 3. Implement controls | Access control, operator sessions, cryptography, logging, patching, malware protection |
| 4. Independent assessment | Internal audit or an external assessor tests and evidences each applicable control |
| 5. Attest | Submit through the KYC Security Attestation application and publish to counterparties |
The secure zone. Segmenting SWIFT infrastructure away from the general network is the single largest piece of work for most institutions, and the one auditors probe hardest. A diagram that does not match reality is worse than no diagram.
Operator session controls. Multi-factor authentication, session management and privileged access to the messaging interface attract disproportionate attention, because compromised operator credentials are how the well-known network attacks actually happened.
Evidence, not assertions. The independent assessment is the step institutions underestimate. Saying a control operates is not the same as producing the log extract, the configuration screenshot and the reviewed access list that show it operated all year.
Most of the effort is producing and maintaining the evidence set. Our SWIFT CSP Compliance Toolkit provides 31 templates covering the cycle — the KYC-SA self-attestation workbook and independent assessment evidence pack, the control implementation summary, secure zone architecture diagram template, the policy set for access control and operator sessions, network segmentation, cryptography and key management, logging and monitoring, plus the procedures for operator onboarding, MFA enforcement, patching and incident detection with ISAC reporting.
Yes for institutions connected to the network. Attestation is required annually, and non-attestation is reported to counterparties and supervisors, so the commercial consequences arrive quickly.
Not necessarily. The independent assessment can be performed by a suitably independent internal function, such as internal audit, provided it is genuinely independent of the team operating the controls. Many institutions use an external assessor anyway for credibility with counterparties.
It determines scope. The more SWIFT-related infrastructure you host and operate yourself, the more of the framework applies to you; institutions using a service bureau or shared connectivity carry a reduced set.
August 12, 2026
August 12, 2026
