SWIFT CSCF controls, hardened and continuously verified.

The SWIFT Customer Security Programme (CSP) obliges every organization connected to the SWIFT network to implement the Customer Security Controls Framework (CSCF) and attest to compliance annually via SWIFT's KYC Security Attestation application. The CSCF divides controls into mandatory controls, which every user must meet for their architecture type, and advisory controls, which are recommended and have migrated into the mandatory set over successive annual versions. Attestations must be supported by an independent assessment, and SWIFT can report non-compliance to counterparties and regulators. The framework's center of gravity is the secure zone: the segregated environment containing SWIFT-related infrastructure, which must be hardened, access-restricted, patched, and monitored. Controls covering system hardening, security updates, password policy, multi-factor authentication, logical access, malware protection, and logging are exactly the territory of CIS Benchmarks, which is where CISGuard turns an annual attestation scramble into a continuously verified state.

CSCF control 2.3 requires SWIFT-related systems to be hardened to an industry-standard baseline, and CIS Benchmarks are the canonical example of such a baseline. CISGuard applies them continuously: every secure zone server, operator PC, and supporting system is scanned on schedule against its CIS Benchmark, with per-control pass/fail results and drift detection between scans. That directly evidences hardening (2.3), and the same scans cover password policy (4.1), account and privilege state (5.1), patch posture (2.2), anti-malware configuration (6.1), and audit logging (6.4). When your independent assessor arrives, the Framework Coverage Report shows each mapped CSCF control area, its status, and the scan history behind it, replacing screenshots gathered system by system. Because SWIFT secure zones are segregated by design, CISGuard's on-premises and air-gapped deployment model fits naturally: scanning runs entirely inside the zone with no outbound data path. CISGuard does not submit attestations or perform assessments; it supplies the technical evidence both depend on.