SWIFT CSP 2024: The Role of Independent Assessments

For senior and top management in financial institutions, understanding these changes and the importance of independent assessments is crucial.

The Importance of Independent Assessments

Independent assessments play a pivotal role in the SWIFT compliance process. Unlike internal reviews, these assessments provide an unbiased evaluation of an institution’s security measures. They ensure that the implemented controls are not only in place but are also effective and aligned with SWIFT’s stringent standards. This objectivity is vital for maintaining the trust and reliability of the global financial community.

Independent assessments contribute to:

• Integrity: By providing a third-party perspective, they help identify potential vulnerabilities that internal teams might overlook.
• Consistency: They ensure that all institutions adhere to the same high standards, fostering a uniform security posture across the network.
• Security: Regular assessments help in early detection and mitigation of risks, thereby enhancing the overall security framework.

 New SWIFT CSP 2024 Requirements: Is Your Institution Prepared?

The 2024 update to the SWIFT CSP includes several significant changes aimed at addressing the evolving cyber threat landscape. Some of the key updates are:

Enhanced Third-Party Risk Management

New Mandatory Control: The 2024 update introduces a new mandatory control, specifically Control 2.8: Outsourced Critical Activity Protection, focused on third-party risk management to ensure an adequate level of security and compliance by third-party or service providers.

So what constitutes outsourced critical activities? SWIFT listed some examples such as security and change management of the CSP components and underlying virtualization infrastructure, RMA and business transactions management, monitoring of events generated by users, network management, and security administration.

System Hardening Enhancements

Control 2.3: Now includes USB port protection policies and improvements to application whitelisting. These enhancements are designed to reduce the attack surface and prevent unauthorized access to critical systems.

Transaction Business Controls

Control 2.9: Business controls can now be performed outside the safe zone, providing more flexibility while maintaining security standards. This change allows institutions to adapt their security measures to their specific operational needs without compromising on security.

Physical Security Updates

Control 3.1: Contains new recommendations for the disposal of devices and token security. Proper disposal of devices and secure management of tokens are essential to prevent unauthorized access and data breaches.

Forward looking

SWIFT is looking to promote Control 2.4A Backoffice Data Flow Security from an advisory control to a mandatory control. SWIFT intends to make this control mandatory in the coming years to ensure that data exchanged between back-office applications and the SWIFT interface are protected and secured.

To start preparing for this change, institutions should identify back-office (BO) first hops and specify how it is secured or how it will be secured in a phased approach which will be included in future releases of SWIFT (dates not yet determined):

• Phase 1: Protect Servers and flows
• Phase 2: Protect legacy flows from BO first hops

Our Value-Adding Strategy

At Forvis Mazars, we understand that compliance is not just about meeting requirements but about enhancing overall security in a cost-effective manner. Our strategy focuses on:

• Comprehensive Assessments: We offer thorough independent assessments that go beyond mere compliance checks. Our experts provide actionable insights to strengthen your security posture.
• Cost-Effective Solutions: We believe that top-notch security should not come at a prohibitive cost. Our services are designed to be affordable, ensuring that even smaller institutions can benefit from high-quality assessments.
• Ongoing Support: Compliance is an ongoing process. We provide continuous support to help you stay ahead of emerging threats and maintain compliance with evolving standards.

Get in touch with our team of cyber security experts to learn more about our services and how they can enhance your business' resilience to cyber threats.

Get in touch