Step 1 of 6
Identity
No manual input is captured here: this step is completed from the preceding sections or by the platform.
No manual inputs in this step.
1 / 6
SWIFT Customer Security Programme
Phase 2 · Technical controlsSWIFT CSCF Control Assessment
Per-control self-assessment, independent assessment, policy evaluation, and exception/remediation tracking for 32 CSCF controls.
Basis: Assessment
Record status
- not assessedstart
- self assessed
- non compliant
- compliant
- exception accepted
- independently assessed
- provisional emergencyend
At a glance
- Before you start
- Open it: SWIFT CSP › Assess
/swift-csp/assess - Role: vieweranalystofficermanagerauditorsupervisorfinanceadmin
- Open it: SWIFT CSP › Assess
- Regulatory basis
SWIFT Customer Security Controls Framework (CSCF v2025/v2026)
- What happens next
- Accept reviewed evidence analystofficerauditorsupervisoradmin
- Mark non-compliant analystofficerauditorsupervisoradmin
- Mark compliant managerauditoradmin
- Accept exception / risk admin
- Evaluate accepted evidence analystofficerauditorsupervisoradmin
- Independent assessment managerauditoradmin
- Declare provisional emergency admin
- Re-assess after remediation managerauditoradmin
Step-by-step procedure
6 steps, completed in order. Each step is validated against the schema before the next unlocks.
Step 2 of 6
Implementation
Complete the Implementation fields. Each value is validated against the schema before the next step unlocks.
required“optional” — may be left empty
Implementation Status (required)
implementationStatusEnter implementation status.
Implementation Summary (required)
implementationSummaryEnter implementation summary.
Implementation Owneroptional
implementationOwnerEnter implementation owner.
Last Implemented / Reviewedoptional
lastImplementedDateEnter last implemented / reviewed.
2 / 6
Step 3 of 6
Evidence
No manual input is captured here: this step is completed from the preceding sections or by the platform.
No manual inputs in this step.
3 / 6
Step 4 of 6
Assessment
Complete the Assessment fields. Each value is validated against the schema before the next step unlocks.
“optional” — may be left empty
Assessment Outcomeoptional
assessmentOutcomeEnter assessment outcome.
Assessor Typeoptional
assessorTypeEnter assessor type.
Assessor Nameoptional
assessorNameEnter assessor name.
Assessment Dateoptional
assessmentDateEnter assessment date.
Assessor Findingoptional
assessorFindingEnter assessor finding.
Reason for Re-assessmentoptional
reassessmentReasonSubstantive justification for reopening this control for evidence review.
Emergency Ticket Referenceoptional
emergencyTicketRefIncident or change ticket tracking this provisional emergency declaration.
Emergency Justificationoptional
emergencyJustificationOperational rationale and blast radius justification for provisional emergency override.
Emergency Declared Byoptional
emergencyDeclaredByEnter emergency declared by.
Emergency SLA Expirationoptional
emergencyExpiresAtEnter emergency sla expiration.
4 / 6
Step 5 of 6
Exception / Risk
Complete the Exception / Risk fields. Each value is validated against the schema before the next step unlocks.
“optional” — may be left empty
Exception / risk-acceptance claimed?optional
exceptionClaimedEnter exception / risk-acceptance claimed?.
Exception Basisoptional
exceptionBasisSelect exception basis.
Exception Rationaleoptional
exceptionRationaleAt least 50 characters. Explain why the control cannot be met and what residual risk that leaves — an assessor has to be able to weigh this.
Compensating Controloptional
compensatingControlRequired when the exception basis is a compensating control. Describe the control that covers the gap.
Board Resolution ID (Risk Acceptance)optional
boardResolutionIdRequired when the basis is board risk acceptance. Enter the resolution that records the decision.
CFO / Board Sign-off Dateoptional
cfoSignOffDateRequired when the basis is board risk acceptance. The date the CFO or board signed off.
Exception Expires Atoptional
exceptionExpiresAtEnter exception expires at.
5 / 6
Step 6 of 6
Remediation
Complete the Remediation fields. Each value is validated against the schema before the next step unlocks.
“optional” — may be left empty
Remediation required?optional
remediationRequiredEnter remediation required?.
Remediation Deadlineoptional
remediationDeadlineRequired for a non-compliant outcome — the date the gap will be closed by.
Remediation Owneroptional
remediationOwnerRequired for a non-compliant outcome — the person accountable for closing the gap.
Linked Remediation Plan IDoptional
remediationPlanIdEnter linked remediation plan id.
6 / 6Procedure complete
Next in SWIFT Customer Security Programme
Continue with the next guide in this framework's table of contents.
Phase 2 · Technical controls
Independent Assessment & Assessor Mandate
Mandatory external or internal independent assessor audit, segregation of duties enforcement, and certification.
Read guide Phase 2 · Technical controlsSWIFT Control Gap Remediation Plan
Tracking of non-compliant control findings, remediation milestones, SLA breach escalation, and board risk acceptance.
Read guide Phase 2 · Technical controlsSWIFT Counterparty Attestation Exchange
Bilateral consent, active data exchange, and regulatory transparency with counterparty institutions.
Read guide