[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Compliance and Regulations](/category/compliance-and-regulations) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Guide to SWIFT CSCF (Customer Security Controls Framework)](/blog/swift-cscf) Publish date January 7, 2025 {x} minute read # Guide to SWIFT CSCF (Customer Security Controls Framework) [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Kyle Chin](/team/kyle-chin) Cybersecurity Writer Kyle's work has been featured in law publications, academic institutions, and government bodies. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) The SWIFT Customer Security Controls Framework (CSCF) is a key global cybersecurity framework that provides recommended and mandatory security controls for banking institutions that use the SWIFT banking system. The framework is designed to help financial institutions improve their cyber resilience and ensure that participants within the SWIFT network adhere to a stringent set of security compliance standards. [Find out how UpGuard helps the financial services industry meet compliance standards >](https://www.upguard.com/industries/financial-services) ## What is the SWIFT system? The SWIFT banking system, commonly known as SWIFT, was developed by the [Society for Worldwide Interbank Financial Telecommunication](https://www.swift.com/) as a global messaging network for banks and financial institutions to securely transmit information and instructions through a standardized system of codes. Established in 1973, SWIFT facilitates international transactions by providing a reliable, secure, and standardized way for financial institutions to communicate. SWIFT is a member-owned cooperative that serves over 11,000 financial institutions in more than 200 countries, making it the largest payment network in the world. The SWIFT network handles millions of financial transactions every day, ensuring that money moves smoothly and securely across borders. ## Overview of SWIFT CSCF Because the financial services industry is one of the most targeted sectors in the world, SWIFT launched the [SWIFT Customer Security Controls Framework (CSCF)](https://www.swift.com/myswift/customer-security-programme-csp/security-controls) in 2016 to help banking organizations around the world strengthen their cyber defenses. The framework is updated annually to account for changing threat landscapes and environments. The CSCF is an essential part of SWIFT’s [Customer Security Programme (CSP)](https://www.swift.com/myswift/customer-security-programme-csp), which was launched in 2017. SWIFT CSP aims to help SWIFT users build stronger cybersecurity programs, defend against [cyber threats](https://www.upguard.com/blog/cyber-threat), and establish baseline security controls for financial organizations. The CSCF provides a set of mandatory and advisory security controls that all users of the SWIFT network must implement. ### Key objectives of SWIFT CSCF As of 2024, SWIFT CSCF v2024 is centered around three main objectives, which are broken down into seven overall principles: #### 1. Secure your environment * Restrict Internet Access and Protect Critical Systems from General IT Environment * Reduce Attack Surface and Vulnerabilities * Physically Secure the Environment #### 2. Know and limit access * Prevent Compromise of Credentials * Manage Identities and Segregate Privileges #### 3. Detect and respond * Detect Anomalous Activity to Systems or Transaction Records * Plan for Incident Response and Information Sharing ## SWIFT CSCF Security Controls SWIFT CSCF v2024 outlines 32 security controls, which include 25 mandatory controls and 7 advisory controls that cover a wide range of security measures. These controls are designed to protect the confidentiality, integrity, and availability of financial transactions. These security controls include: **Note: **Controls listed with “A” are advisory controls. ### 1. Restrict Internet Access and Protect Critical Systems from General IT Environment * 1.1 SWIFT Environment Protection * 1.2 Operating System Privileged Account Control * 1.3 Virtualisation or Cloud Platform Protection * 1.4 Restriction of Internet Access * 1.5 Customer Environment Protection ### 2. Reduce Attack Surface and Vulnerabilities * 2.1 Internal Data Flow Security * 2.2 Security Updates * 2.3 System Hardening * 2.4A Back Office Data Flow Security * 2.5A External Transmission Data Protection * 2.6 Operator Session Confidentiality and Integrity * 2.7 Vulnerability Scanning * 2.8 Outsourced Critical Activity Protection * 2.9 Transaction Business Controls * 2.10 Application Hardening * 2.11A RMA Business Controls ### 3. Physically Secure the Environment * 3.1 Physical Security ### 4. Prevent Compromise of Credentials * 4.1 Password Policy * 4.2 Multi-Factor Authentication ### 5. Manage Identities and Separate Privileges * 5.1 Logical Access Control * 5.2 Token Management * 5.3A Staff Screening Process * 5.4 Password Repository Protection ### 6. Detect Anomalous Activity to Systems or Transaction Records * 6.1 Malware Protection * 6.2 Software Integrity * 6.3 Database Integrity * 6.4 Logging and Monitoring * 6.5A Intrusion Detection ### 7. Plan for Incident Response and Information Sharing * 7.1 Cyber Incident Response Planning * 7.2 Security Training and Awareness * 7.3A Penetration Testing * 7.4A Scenario-based Risk Assessment ## SWIFT security attestations To ensure compliance with the CSCF, SWIFT requires all users to submit an annual security attestation. This attestation involves a self-assessment against the mandatory controls outlined in the CSCF. The results are then shared with SWIFT and can be accessed by other SWIFT users, promoting transparency and accountability within the community. All SWIFT users must begin the re-attestation process between July and December of that year using the [KYC-Security Attestation application (KYC-SA)](https://kycregistry.swift.com/security-attestation/). The attestation process has several purposes: * **Verification**: It verifies that financial institutions have implemented the necessary controls to secure their SWIFT environment. * **Awareness**: It raises awareness within institutions about their [security posture](https://www.upguard.com/blog/security-posture) and areas that may require improvement. * **Benchmarking**: It allows institutions to benchmark their security controls against industry standards and peers. Additionally, all SWIFT members must conduct an internal or external risk assessment using the [Independent Assessment Framework (IAF)](https://www.swift.com/myswift/customer-security-programme-csp/independent-assessment) as part of the attestation process. The assessment ensures that each institution's attestations are accurate and compliant with the mandatory controls. Failure to conduct the independent assessment is considered non-compliant with SWIFT CSCF. Institutions can choose to use an external party to conduct their SWIFT CSP Assessment. Compliance solutions like [UpGuard](https://www.upguard.com/) can help financial organizations meet their compliance standards and adhere to mandatory frameworks like SWIFT CSCF. [Learn more about UpGuard’s compliance tools >](https://www.upguard.com/industries/financial-services) ## How to comply with SWIFT CSCF Complying with the SWIFT CSCF involves several key steps: 1. **Understand the controls**: Financial institutions must thoroughly understand the mandatory and advisory controls outlined in the CSCF. 2. **Conduct a gap analysis**: Assess the current security posture against the CSCF controls to identify any gaps or areas for improvement. 3. **Implement the controls**: Develop and execute a plan to implement the necessary controls, addressing any identified gaps. 4. **Continuous monitoring and review**: [Regularly monitor ](https://www.upguard.com/blog/continuous-security-monitoring)and review the implemented controls to ensure they remain effective and up-to-date against evolving threats. 5. **Annual attestation**: Complete the annual security attestation, documenting compliance with the mandatory controls and identifying any deviations. ### Penalties for non-compliance with SWIFT CSCF SWIFT members are considered non-compliant if they fall under the following categories: * Failure to submit a valid attestation or existing attestation is expired * Failure to comply with the mandatory controls * Connected through a non-compliant service provider * Failure to complete a SWIFT-mandated independent assessment Non-compliance with the SWIFT CSCF can result in several significant penalties and consequences, impacting a financial institution's operations and reputation: 1. **Increased risk of cyber attacks**: Institutions that do not comply with CSCF controls are more vulnerable to [cyber attacks](https://www.upguard.com/blog/cyber-attack), which can lead to financial losses, [data breaches](https://www.upguard.com/blog/data-breach), and operational disruptions. 2. **Reputational damage**: Failure to comply with SWIFT CSCF can affect an institution's reputation within the financial community. Other institutions may be reluctant to engage in transactions with a non-compliant entity. 3. **Restricted access to the SWIFT network**: SWIFT may impose restrictions or limitations on a non-compliant institution's access to the SWIFT network, hindering its ability to conduct international transactions and communicate securely with other financial entities. 4. **Financial penalties**: Non-compliance can result in financial penalties from regulatory bodies or SWIFT itself. These penalties can be substantial and impact the institution's financial health. 5. **Report to local authorities**: Regulatory bodies and SWIFT may report non-compliant institutions to local authorities for further investigation. This can lead to more frequent audits and reviews to determine if the institution is in violation of other regulatory laws. As a result, the institution may incur additional operational costs or monetary fines to deal with compliance issues. eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Compliance and Regulations #### [Cyber Resilience Act Preparedness: Who's Ready, and Who Can't Be Reached](/blog/cyber-resilience-act-preparedness-whos-ready-and-who-cant-be-reached) We surveyed 2,374 EU-registered devices and 226 listed software makers for a way to report a vulnerability. Market leaders are ready. Others, not so much. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) October 29, 2026 Compliance and Regulations #### [NIST compliance in 2026: A complete implementation guide](/blog/nist-compliance) NIST compliance ensures alignment with leading cybersecurity frameworks. Explore how the NIST standards can safeguard sensitive data and manage third-party [](/team/edward-kost) [Edward Kost](#) January 5, 2026 Compliance and Regulations #### [Introducing UpGuard’s DPDP Act Security Questionnaire](/blog/upguards-dpdp-security-questionnaire) Discover the latest addition to UpGuard's industry-leading Questionnaire Library and learn how to achieve comprehensive DPDP compliance. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) November 19, 2024 Compliance and Regulations #### [From NIS to NIS2: What Your Organization Needs to Know](/blog/nis-vs-nis2) Understanding the transition from NIS to NIS2 is crucial for protecting your organization. Explore the key changes and compliance steps in this blog. [](/team/leah-sadoian) [Leah Sadoian](#) July 4, 2025 Compliance and Regulations #### [How to Prepare for a Cyber Essentials Plus Audit](/blog/prepare-for-a-cyber-essentials-plus-audit) Learn more about the Cyber Essentials Plus independent assessment process, and steps your organization can take to prepare. [](/team/leah-sadoian) [Leah Sadoian](#) July 3, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)