Cyber Security

Cyber attacks are becoming increasingly sophisticated in the financial community. The persistence of such threats underlines the importance of remaining vigilant and proactive over the long term. While customers are responsible for protecting their own environments and access to SWIFT, SWIFT’s Customer Security Programme (CSP) has been introduced to support customers in the fight against cyber fraud.

The CSP establishes a common set of security controls designed to help customers to secure their local environments and to foster a more secure financial ecosystem. The SWIFT Customer Security Controls Framework describes a set of mandatory and advisory security controls for SWIFT users. Mandatory security controls establish a security baseline for the entire community, and must be implemented by all users on their local SWIFT infrastructure. SWIFT has chosen to prioritise these mandatory controls to set a realistic goal for near-term, tangible security gain and risk reduction. Advisory controls are based on good practice that SWIFT recommends users to implement. Over time, mandatory controls may change due to the evolving threat landscape, and some advisory controls may become mandatory.

To ensure adoption of the controls, SWIFT has developed an attestation and compliance process that will require users to self-attest compliance against the mandatory and, optionally, the advisory security controls. Users will be asked to submit self-attestation status information into a dedicated security attestation folder of the KYC Registry. All users must self-attest compliance against the mandatory security controls outlined in a specific release at first by the end of the version year (as an example, by the end of 2019 at the latest for v2019). Users will be required to resubmit their attestation on an annual basis thereafter.

The objective of a security audit is to provide management with an assessment of an organization’s security policies and procedures and their operating effectiveness. Additionally, security audits identify internal control and regulatory deficiencies that could put the organization at risk.

Audit gives answers to hundreds of questions organization might ask every day, e.g. how to keep compliance with international and local regulations? How to develop a security policy for organization ‘s business? How to protect sensitive data of organization?

Security audit focuses on security standards, guidelines and procedures, as well as the implementation of these controls.

Audit helps enterprises with the challenges of managing threats, by providing an objective evaluation of the controls and making recommendations to improve them as well as assisting the senior management and the board of directors understand and respond to risks.