SWIFT Security Incident Management

Tap to enlarge

Complete the Identity fields. Each value is validated against the schema before the next step unlocks.

• Internal Incident Reference (required)

  incidentRef

  Enter internal incident reference. An example value is "INC-2026-0042".

• Affected BIC (required)

  entityBic

  The BIC of the entity this record is about — 8 or 11 characters, e.g. DEUTDEFF or DEUTDEFF500.

• Detected Byoptional

  detectedBy

  Enter detected by.

• Detection Sourceoptional

  detectionSource

  Select source.

• Affected CSCF Objectiveoptional

  affectedObjectiveId

  Search objective.

• Detection Context Notesoptional

  detectionNotes

  Enter detection context notes.

Tap to enlarge

Complete the Signals fields. Each value is validated against the schema before the next step unlocks.

• Production Impactoptional

  productionImpact

  Select impact.

• Data Exposure Scopeoptional

  dataExposure

  Select exposure.

• SWIFT messaging disrupted?optional

  messagingDisrupted

  Enter swift messaging disrupted?.

• Fraudulent SWIFT message detected?optional

  fraudulentMessageDetected

  Enter fraudulent swift message detected?.

• Affected CSCF Control IDsoptional

  affectedControlIds

  Enter affected cscf control ids.

• Triaged Byoptional

  triagedBy

  Enter triaged by.

Tap to enlarge

Complete the Notification fields. Each value is validated against the schema before the next step unlocks.

• SWIFT notification required (24h for critical)?optional

  swiftNotificationRequired

  Enter swift notification required (24h for critical)?.

• SWIFT Notification Sent Atoptional

  swiftNotificationSentAt

  Enter swift notification sent at.

• SWIFT Notification Referenceoptional

  swiftNotificationRef

  Enter swift notification reference.

• Internal stakeholders notified?optional

  internalStakeholdersNotified

  Enter internal stakeholders notified?.

• Other Regulatory Bodies Notifiedoptional

  regulatoryBodiesNotified

  Enter other regulatory bodies notified.

Tap to enlarge

Complete the Containment fields. Each value is validated against the schema before the next step unlocks.

• Root Cause Hypothesisoptional

  rootCauseHypothesis

  Enter root cause hypothesis.

• Containment Actions Takenoptional

  containmentActions

  Enter containment actions taken.

• Containment Achieved Atoptional

  containmentAt

  Enter containment achieved at.

• Forensics evidence collected?optional

  forensicsCollected

  Enter forensics evidence collected?.

• Forensics Evidence Artifact IDs (evidence-vault)optional

  forensicsEvidenceIds

  Enter forensics evidence artifact ids (evidence-vault).

• Containment Leadoptional

  containmentLeadName

  Enter containment lead.

Tap to enlarge

Complete the Recovery fields. Each value is validated against the schema before the next step unlocks.

• Recovery Started Atoptional

  recoveryStartedAt

  Enter recovery started at.

• Recovery Completed Atoptional

  recoveryCompletedAt

  Enter recovery completed at.

• Final SWIFT incident report filed?optional

  finalSwiftReportFiled

  Enter final swift incident report filed?.

• Final Report SHA-256optional

  finalSwiftReportSha256

  Enter final report sha-256.

• Lessons-Learned Document IDoptional

  lessonsLearnedDocId

  Enter lessons-learned document id.

• Incident Closed Atoptional

  closedAt

  Enter incident closed at.

Tap to enlarge

Complete the Risk fields. Each value is validated against the schema before the next step unlocks.

• Risk likelihood (0-10) (required)

  riskLikelihood

  Enter risk likelihood (0-10).

• Risk impact (0-10) (required)

  riskImpact

  Enter risk impact (0-10).

Tap to enlarge

Complete the Deadlines fields. Each value is validated against the schema before the next step unlocks.

• Trigger date (starts the clock) (required)

  triggerAt

  Enter trigger date (starts the clock).

Tap to enlarge

No manual input is captured here: this step is completed from the preceding sections or by the platform.

No manual inputs in this step.