Cyber attacks are becoming increasingly sophisticated in the financial community. The persistence of such threats underlines the importance of remaining vigilant and proactive over the long term. While customers are responsible for protecting their own environments and access to SWIFT, SWIFT’s Customer Security Programme (CSP) has been introduced to support customers in the fight against cyber fraud.

The CSP establishes a common set of security controls designed to help customers to secure their local environments and to foster a more secure financial ecosystem. The SWIFT Customer Security Controls Framework describes a set of mandatory and advisory security controls for SWIFT users. Mandatory security controls establish a security baseline for the entire community, and must be implemented by all users on their local SWIFT infrastructure. SWIFT has chosen to prioritise these mandatory controls to set a realistic goal for near-term, tangible security gain and risk reduction. Advisory controls are based on good practice that SWIFT recommends users to implement. Over time, mandatory controls may change due to the evolving threat landscape, and some advisory controls may become mandatory.

To ensure adoption of the controls, SWIFT has developed an attestation and compliance process that will require users to self-attest compliance against the mandatory and, optionally, the advisory security controls. Users will be asked to submit self-attestation status information into a dedicated security attestation folder of the KYC Registry. All users must self-attest compliance against the mandatory security controls outlined in a specific release at first by the end of the version year (as an example, by the end of 2019 at the latest for v2019). Users will be required to resubmit their attestation on an annual basis thereafter.