The objective of the SWIFT CSP/CSCF internal audit is to verify the organization’s level of compliance with the controls of the Customer Security Controls Framework (CSCF) defined by SWIFT, helping users maintain an adequate level of security in their environments and protecting transactional information between entities.
The SWIFT audit service involves carrying out the following activities according to the current version of the CSCF:
- Assess the implementation of the mandatory controls of the CSCF, as well as the recommended ("advisory") controls.
- Identify gaps, non-conformities, and opportunities for improvement in security controls.
- Improve the cyber resilience of the environment and reduce exposure to threats in the context of global financial messaging.
- Anticipate the implementation of controls that will become mandatory in future versions of the CSCF (for example, controls currently "advisory" that will become "mandatory" in coming years).
- Provide an audit report with findings and detected improvements so that the organization is prepared for its declaration/attestation to SWIFT.
The methodology followed by Internet Security Auditors covers the following phases and aspects:
Phase I: Planning and Scope Definition
- Initial meeting with stakeholders (IT, security, SWIFT operations, etc.) to define the scope (SWIFT architecture, systems within scope, connectors, providers, etc.) and the controls applicable to the SWIFT infrastructure.
- Preparation of the Audit Plan.
- Identification of required documentation.
Phase II: Audit Execution
- Review of documents supporting SWIFT processes (policies and standards, security operating procedures, inventories, diagrams, etc.).
- Interviews with area managers to validate implemented processes: SWIFT Operations, security, IT, providers, etc.
- Technical validation of implemented controls. Review of configurations in systems supporting SWIFT operations: access controls, network devices, monitoring, servers, applications, etc.
Phase III: Audit Report
Preparation of the Audit Report presenting process details and results obtained, specifying the list of evaluated controls, detailed audit findings, and opportunities for improvement.
Deliverables
- Audit Plan
- Internal Audit Report
