The SWIFT CSCF Control 1.1 Evidence Gap That Delays Attestation by Six Weeks: Why Network Diagrams Must Show Logical Segmentation Rules, Not Just Physical Topology
Every year, Saudi banks and capital-market firms preparing for annual SWIFT Customer Security Controls Framework attestation submit network diagrams for mandatory control 1.1—and every year, a significant proportion of those diagrams are rejected by independent assessors. The reason is consistent: the diagrams show physical connectivity—cables, switches, routers—but do not document the logical segmentation rules that actually enforce the restriction of internet access from the secure zone.
The SWIFT CSCF control 1.1 network diagram is not a topology map. It is evidence that your architecture prevents unauthorised internet traffic from reaching SWIFT infrastructure. Independent assessors verify that the controls you describe in policy are visible in configuration, and the diagram is the index to that verification. When the diagram shows only physical devices, the assessor cannot trace the path of a packet, cannot confirm that firewall rules block internet-bound traffic from the secure zone, and cannot verify that VLANs enforce separation. The result is a request for additional evidence, a delay of four to six weeks while IT teams redraw diagrams and export configurations, and—in some cases—a qualified finding that must be remediated before attestation is granted.
This article explains why physical topology alone does not satisfy SWIFT CSCF control 1.1, lists the seven diagram layers that independent assessors verify, and describes how Saudi correspondent banks and securities firms can prepare evidence that passes attestation without findings.
What SWIFT CSCF Control 1.1 Requires
SWIFT CSCF mandatory control 1.1, defined by SWIFT and enforced through annual independent assessment, requires that organisations restrict internet access from the secure zone. The secure zone is the environment in which SWIFT infrastructure operates: messaging interfaces, connectors, middleware and any system with direct access to SWIFT credentials or message flows. The control does not prohibit internet access entirely; it prohibits direct, unrestricted internet access from devices and network segments that form the secure zone.
The Saudi Central Bank (SAMA) expects all licensed banks and capital-market firms that connect to SWIFT to comply with the SWIFT CSCF and to submit annual attestation reports. The attestation must be performed by an independent assessor—an organisation or individual not responsible for the design, operation or maintenance of the SWIFT environment. The assessor evaluates each mandatory and advisory control, collects evidence, and issues a report that the institution submits to SWIFT and, in many cases, to SAMA as part of broader cybersecurity compliance obligations under the SAMA Cyber Security Framework.
Control 1.1 is always among the first controls assessed, because it is foundational: if the secure zone is not logically separated from the internet, subsequent controls—such as hardening, patching and monitoring—cannot be verified in isolation. The primary evidence for control 1.1 is the network diagram. If that diagram is incomplete or ambiguous, the entire assessment timeline is disrupted.
Why Physical Topology Is Not Sufficient Evidence
A physical network diagram shows devices and cables: switches in racks, routers at the perimeter, firewalls between zones. It answers the question "what is connected to what?" but does not answer the question "what traffic is allowed where?" Independent assessors must verify that internet-bound traffic from the secure zone is blocked, not merely routed through a firewall. A line on a diagram connecting a secure-zone switch to a firewall does not prove that the firewall denies internet access; it proves only that a cable exists.
Assessors verify control 1.1 by tracing packet flows. They ask: if a user on a secure-zone workstation attempts to browse the internet, which firewall rule is evaluated? What is the action—permit or deny? If the diagram does not show firewall zones, access-control lists (ACLs), VLAN assignments and allowed protocols, the assessor cannot perform this trace without requesting additional documentation. In practice, this means exporting firewall configurations, VLAN tables and routing policies—evidence that should have been summarised in the diagram from the outset.
The delay is not trivial. IT teams in Saudi banks are often managing multiple compliance programmes simultaneously—SAMA CSF, PCI DSS, NCA ECC—and redrawing network diagrams to satisfy a specific assessor request can take two to four weeks, particularly when the original diagram was produced by a third-party integrator no longer under contract. The attestation deadline does not move, so the delay compresses the time available for remediation if other findings emerge.
The Seven Diagram Layers Independent Assessors Verify
A SWIFT CSCF control 1.1 network diagram that passes independent assessment without additional requests includes seven layers of information. Each layer answers a specific verification question.
1. Physical Connectivity
Devices, interfaces and cables. This is the foundation: which switch connects to which firewall, which router connects to the internet service provider, which server connects to the SWIFT connector. Physical connectivity alone is necessary but not sufficient.
2. VLAN Segmentation
VLAN assignments for each interface and each device. Assessors verify that secure-zone devices are assigned to VLANs that do not carry internet traffic, and that VLAN trunks between switches do not inadvertently bridge secure and non-secure zones. The diagram must show VLAN IDs and the boundaries where VLANs terminate.
3. Firewall Zones
Logical zones defined in the firewall configuration: secure zone, internal zone, DMZ, internet. Each interface on the firewall must be labelled with its zone. Assessors verify that the secure zone is a distinct, named zone and that no interface in that zone has a default route to the internet.
4. ACL Direction and Evaluation Order
Access-control lists applied to each firewall interface, with direction (inbound or outbound) and evaluation order. Assessors verify that deny rules for internet-bound traffic from the secure zone are evaluated before any permit rules, and that there is no implicit permit at the end of the list.
5. Allowed Protocols and Ports
For each permitted flow between zones, the diagram must show the protocol (TCP, UDP, ICMP), port numbers and direction. For example, if the secure zone is allowed to reach an internal DNS server, the diagram shows "UDP/53 outbound to 10.x.x.x". Assessors verify that no rule permits HTTP, HTTPS or other internet protocols outbound from the secure zone to the internet zone.
6. Jump-Host and Administrative Access Paths
If administrators access secure-zone devices via jump hosts or bastion servers, the diagram must show the path: from which network the administrator connects, through which jump host, into which secure-zone VLAN, and what protocols are used. Assessors verify that the jump host itself does not have internet access, or—if it does—that session recording and multi-factor authentication are enforced.
7. Internet Breakout Points
Every point at which traffic leaves the organisation's network to reach the internet: ISP routers, cloud on-ramps, VPN gateways. The diagram must show which zones can reach these breakout points and which cannot. Assessors verify that no path exists from the secure zone to any breakout point, even through multiple hops.
A diagram that includes all seven layers allows the assessor to trace any hypothetical packet flow and verify that the configuration enforces the restriction required by control 1.1. A diagram that omits any layer requires the assessor to request additional evidence, which delays the assessment.
A Redacted Example from a Riyadh Correspondent Bank
A correspondent bank in Riyadh preparing for its annual SWIFT CSCF attestation submitted a network diagram that initially showed only physical connectivity and firewall zones. The independent assessor requested VLAN assignments, ACL details and internet breakout points. The bank's IT security manager redrew the diagram to include all seven layers, labelling each firewall interface with its zone and VLAN, annotating each permitted flow with protocol and port, and marking the two internet breakout points (primary ISP router and backup 4G failover) with red boundaries and explicit deny rules from the secure zone.
The revised diagram was accepted without further questions. The assessment proceeded on schedule, and the bank received its attestation report with no findings on control 1.1. The IT security manager later noted that the effort to produce the complete diagram—approximately twelve hours of work—was far less than the six-week delay the bank had experienced in the previous year's attestation cycle, when similar evidence gaps had required multiple rounds of clarification.
The lesson is that the diagram is not a formality. It is the primary evidence artifact for a mandatory control, and it must be prepared with the same rigour as a firewall configuration file or an access-control policy.
Preparing the Diagram: Practical Steps for Treasury and IT Security Teams
Heads of treasury operations and IT security managers at Saudi banks and capital-market firms can prepare SWIFT CSCF control 1.1 network diagrams that satisfy independent assessors by following a structured approach:
Start with the firewall configuration. Export the current ruleset and zone definitions from the firewall that separates the secure zone from other networks. Identify every rule that references the secure zone, and note the action (permit or deny), direction and destination.
Map VLANs to zones. Document which VLANs are assigned to the secure zone, which to the internal network, which to the DMZ. Verify that no VLAN carries both secure-zone traffic and internet traffic.
Identify internet breakout points. List every router, gateway or cloud on-ramp through which traffic can reach the public internet. Verify that no routing table in the secure zone contains a default route to any of these points.
Annotate permitted flows. For each firewall rule that permits traffic from the secure zone, add a label to the diagram showing the protocol, port, source and destination. If the flow is to an internal service (DNS, NTP, patch server), state that explicitly.
Show jump-host paths. If administrators use jump hosts to access secure-zone devices, draw the path from the administrator's workstation network, through the jump host, into the secure zone. Label each hop with the protocol and authentication method.
Mark deny rules. Use a distinct colour or symbol to indicate firewall rules that deny internet-bound traffic from the secure zone. This makes it immediately clear to the assessor that the restriction is enforced.
Review with the assessor's checklist. Before submitting the diagram, review it against the seven layers listed above. If any layer is missing or ambiguous, add the detail.
This process typically requires collaboration between the treasury operations team (which owns the SWIFT environment), the network engineering team (which manages firewalls and VLANs) and the IT security team (which coordinates the attestation). In practice, the diagram is often prepared by the network team and reviewed by the security team, with the treasury team providing context on which systems are in scope.
How Independent Assessment Supports Attestation
An independent assessment that supports annual SWIFT attestation evaluates each mandatory and advisory control, collects evidence and documents findings. The assessment begins with architecture type confirmation—whether the environment is classified as SWIFT CSP (Customer Security Programme) architecture A, B or C—and proceeds through each control with evidence collection. For control 1.1, the assessor reviews the network diagram, firewall configurations, VLAN tables and routing policies, and verifies that internet access from the secure zone is restricted as required.
The assessment is performed over three to five weeks and produces an independent assessment report, a control-by-control evidence file and a gap remediation plan. If gaps are identified, remediation support is provided to help the institution close findings before the final attestation report is issued. The deliverables are designed to satisfy both SWIFT's attestation requirements and SAMA's expectations under the SAMA Cyber Security Framework, which references SWIFT CSCF for institutions that operate SWIFT infrastructure.
Closing
SWIFT CSCF control 1.1 is a mandatory control, and the network diagram is its primary evidence. Diagrams that show only physical topology delay attestation and create unnecessary risk. Diagrams that include all seven layers—physical connectivity, VLAN segmentation, firewall zones, ACL direction, allowed protocols, jump-host paths and internet breakout points—allow independent assessors to verify compliance without additional requests.
For Saudi banks and capital-market firms preparing for annual SWIFT attestation, investing the time to prepare a complete, accurate network diagram is not optional. It is the foundation of a successful assessment and a prerequisite for on-time attestation.
CISO Consulting delivers SWIFT CSCF Assessment & Attestation as an independent assessment that supports annual SWIFT attestation. The service includes architecture type confirmation, mandatory and advisory control assessment, evidence documentation, remediation support and attestation preparation, delivered over three to five weeks. Deliverables include an independent assessment report, a control-by-control evidence file and a gap remediation plan, aligned to both SWIFT CSCF and the SAMA Cyber Security Framework.
