Every year, the board or chief executive of a bank or payment firm using SWIFT is asked to stand behind an attestation against the Customer Security Controls Framework (CSCF). The document is usually concise. What sits behind it is not. This article sets out three SWIFT CSCF attestation board questions that help directors understand what they are signing, without needing to read a technical control list.
The attestation is a statement by your institution. SWIFT sets the framework, and in the Kingdom the Saudi Central Bank (SAMA) expects regulated institutions to maintain sound cybersecurity governance under its Cyber Security Framework. A signature on the attestation therefore carries both a network obligation and a governance one. Directors who ask good questions are protecting the institution and themselves.
Why the signature deserves more than a summary
Management summaries tend to report a single outcome: compliant, or compliant with exceptions. That headline hides three things a director needs to know. First, what was included in the review. Second, how each control was tested and by whom. Third, whether the gaps that remain can be closed in the time promised.
The three questions below follow that order.
Question 1: What exactly is in scope, and who confirmed it?
The framework applies differently depending on how your institution connects to SWIFT. The architecture type, and the components that fall within it, determine which controls apply. If the architecture type is recorded wrongly, or a component is left out, the whole attestation can rest on a narrower picture than the real environment.
Ask management:
- Which architecture type have we declared, and who confirmed it?
- Which systems, users and connections are in scope? Which were excluded, and why?
- Has anything changed since last year, such as a new service provider, a migration, or a new payment channel?
How to read the answer: a good answer names the architecture type plainly and can list the in-scope components. A weak answer is "same as last year" without evidence that anyone checked. Scope drift is common, and it is the cheapest problem to fix early and the most awkward to discover later.
Question 2: Which controls were independently verified, and which were self-assessed?
This is the question most boards never ask. The framework contains mandatory controls and advisory controls. An attestation can be assembled entirely from the internal team's own view of its controls. That is not dishonest, but it is a different level of assurance from an independent review.
Ask management:
- For each mandatory control, was the result verified by someone independent of the team that operates it?
- Is there an evidence file that shows what was examined, such as configurations, logs and records, rather than a statement that a control exists?
- Were the advisory controls assessed at all, and if not, was that a decision or an oversight?
How to read the answer: look for a clear split. Ask for a one-page view showing every control marked as independently verified, internally assessed, or not assessed. If management cannot produce it, that tells you something. If the internal and independent views differ on any control, ask for the reason. Differences are normal. Unexplained differences are not.
Funding follows from this. If most of the assurance is self-assessed, the board can reasonably ask for an independent assessment before the next signature, and should budget for it ahead of the deadline rather than after.
Question 3: Are the remediation dates realistic, and who owns them?
Few institutions arrive at the attestation with every control fully met. What matters is whether the remaining gaps are understood, ranked and owned. A remediation plan with dates but no owners, no budget and no dependencies is a hope, not a plan.
Ask management:
- Which gaps are open, and which of them relate to mandatory controls?
- Who owns each one by name, and is the work funded?
- What does each fix depend on, such as a vendor, a change window or a procurement cycle?
- What interim safeguards are in place until the gap is closed?
How to read the answer: realistic timelines acknowledge dependencies. If every gap closes in the same quarter, or the dates match the attestation deadline suspiciously well, press for the working behind them. Ask to see progress at the next board or risk committee meeting, not only at the next attestation.
What to measure between attestations
An annual attestation is a snapshot. Boards that want steadier assurance can ask for a few simple measures reported at each meeting:
- The number of open gaps against mandatory controls, and how that number has moved.
- The proportion of controls with current, independently reviewed evidence.
- Remediation items past their agreed date, with owners and reasons.
- Changes to the SWIFT environment since the last report.
None of these needs technical language. Each tells a director whether the position is improving or quietly slipping.
Allow enough time to act on the answers
These questions are most useful weeks before the deadline, not days before. If the answers reveal thin evidence or a doubtful remediation plan, the board needs time to commission further work. Asking early also gives management room to answer honestly, which is the point of the exercise.
How CISO Consulting supports the attestation
Our SWIFT CSCF Assessment & Attestation service is an independent assessment of your SWIFT environment against the current Customer Security Controls Framework. We identify gaps and support remediation and your annual attestation.
The work follows four steps: scope, assess, remediate and attest. We begin by confirming the architecture type and the in-scope components. We then assess each control with evidence, support gap closure, and produce the final report for the attestation. The assessment phase takes 3–5 weeks.
The service covers both mandatory and advisory controls, and it is aligned to SWIFT CSCF and SAMA CSF. You receive three deliverables: an independent assessment report, a control-by-control evidence file and a gap remediation plan. Together they answer the three questions above in a form a board can read.
If your next attestation is approaching and you cannot yet answer those questions with confidence, speak to us about scheduling an independent assessment ahead of the deadline.
