Since 2017, the Customer Security Controls Framework (CSCF) has served as the foundation for SWIFT’s security requirements. It defines guidelines that help organizations better protect their SWIFT infrastructure against cyberattacks and detect security incidents early on.
Organizations that use the SWIFT network must demonstrate annually, as part of an independent SWIFT assessment, that they comply with these requirements and have implemented appropriate measures to protect their SWIFT infrastructure. The latest update to the framework, CSCFv2027, builds incrementally on the previous version. It retains 32 controls, consisting of 26 mandatory controls and six advisory controls. The update primarily introduces scope changes and clarifications concerning secrets management, artificial intelligence (AI), new connectivity technologies, transaction security, and penetration testing.
Together with our colleague Najim Quraishi, Managing Consultant at usd AG and auditor for international security standards, we provide you with an overview of the most important changes. Knowing about these changes now gives you an advantage, both during in the upcoming SWIFT assessment based on CSCFv2026 and during the subsequent transition phase until your next SWIFT assessment in 2027.
What Are the Key Changes in CSCFv2027?
Secrets and Keys Vaults Become in Scope
CSCFv2027 introduces the technology-neutral term Secrets and Keys Vault (SKV). It covers solutions used to store and manage credentials, API and SSH keys, certificates, and associated private keys.
An SKV and its underlying system must be treated as in-scope components and protected similarly to the applications that use them. Externally hosted or outsourced vaults are also subject to Control 2.8.
New Guidance on Artificial Intelligence (AI)
The Customer Security Programme FAQ now addresses AI agentic operators that generate or support business transactions. These agents should be appropriately secured and governed with human-in-the-loop (HITL) controls incorporated by design when they are involved in transaction management.
Control 2.2 also addresses AI-driven cyber threats. SWIFT recommends faster security updates, risk-based vulnerability prioritization, and compensating controls where timely patching is not possible.
New Alliance Connect VPN Technology
Between 2027 and 2029, SWIFT plans to progressively replace existing SRX and vSRX solutions with new Secure Services Router (SSR) VPN models.
The new Alliance Connect Virtual on Premises VPN is to be deployed on a dedicated virtual machine. The VPN instance and its underlying virtualization platform are explicitly included within the scope of several CSCF controls.
CSCFv2027 also introduces the Swift Digital Ledger and the Swift Payment Scheme. Requirements for the Digital Ledger are expected to be developed further, with possible integration into CSCFv2028. Interfaces and connectors supporting the Payment Scheme remain subject to the applicable CSCF requirements.
Additional Control Clarifications
Several existing controls have also been refined:
- Controls 1.1 and 1.5: Microsegmentation is recognized as a possible method of protecting critical systems.
- Control 1.4: Internet access requirements have been clarified for in-scope systems and jump servers.
- Control 2.4: The definitions of back-office first hops and bridging servers acting as guardians of secure data exchange have been clarified.
- Controls 2.8 and 5.1: PKI keys and certificates managed through O2M are explicitly included.
- Control 2.9: SWIFT emphasizes layered outbound transaction controls rather than relying only on transaction limits.
- Control 2.11A: Regular business reviews of RMA relationships are given greater emphasis.
- Control 4.1: Password protection follows a more risk-based approach to brute-force attacks.
- Control 6.4: The SWIFT HSM is explicitly confirmed as in scope for logging and monitoring.
- Control 7.3A: Penetration testing may be organized as a broader, risk-based program that achieves comprehensive coverage over time.
How Should Organizations Prepare?
Organizations should use the transition period leading up to the implementation of CSCFv2027 to align their existing implementation with the new requirements and identify necessary actions early on. This includes, in particular, reviewing relevant secrets and keys vaults, reassessing their existing architecture, and examining AI agents and AI-supported processes to ensure appropriate governance structures and human oversight.
In addition, SWIFT recommends updating inventories and network diagrams to reflect new Alliance Connect components and reviewing existing policies on transaction controls and penetration testing. Organizations that rely on external service providers or outsourcing partners should involve them early in the planning and implementation of the necessary measures.
We recommend that you conduct the CSCFv2027 gap analysis in parallel with the current SWIFT assessment. This will allow you to identify affected systems, responsibilities, and documentation requirements early on and incorporate the necessary changes into your security roadmap.
Do you have any questions or need support with your upcoming SWIFT assessment? Contact us.
