{"id":70984,"date":"2026-10-23T09:20:37","date_gmt":"2026-10-23T07:20:37","guid":{"rendered":"https:\/\/www.usd.de\/?p=70984"},"modified":"2026-10-23T09:20:38","modified_gmt":"2026-10-23T07:20:38","slug":"swift-cscfv2027-the-most-important-changes","status":"publish","type":"post","link":"https:\/\/www.usd.de\/en\/swift-cscfv2027-the-most-important-changes\/","title":{"rendered":"SWIFT CSCFv2027: What Changes Can Organizations Expect?"},"content":{"rendered":"\n

Since 2017, the Customer Security Controls Framework (CSCF<\/a>) has served as the foundation for SWIFT\u2019s security requirements. It defines guidelines that help organizations better protect their SWIFT infrastructure against cyberattacks and detect security incidents early on.<\/p>\n\n\n\n

Organizations that use the SWIFT network must demonstrate annually, as part of an independent SWIFT assessment<\/a>, that they comply with these requirements and have implemented appropriate measures to protect their SWIFT infrastructure. The latest update to the framework, CSCFv2027<\/a>, builds incrementally on the previous version. It retains 32 controls, consisting of 26 mandatory controls and six advisory controls. The update primarily introduces scope changes and clarifications concerning secrets management, artificial intelligence (AI), new connectivity technologies, transaction security, and penetration testing. <\/p>\n\n\n\n

\n
\n

Together with our colleague Najim Quraishi<\/strong>, Managing Consultant at usd AG and auditor for international security standards, we provide you with an overview of the most important changes. Knowing about these changes now gives you an advantage, both during in the upcoming SWIFT assessment based on CSCFv2026 and during the subsequent transition phase until your next SWIFT assessment in 2027.<\/p>\n<\/div>\n\n\n\n

\n
\"Portrait<\/figure>\n<\/div>\n<\/div>\n\n\n\n
<\/div>\n\n\n\n

What Are the Key Changes in CSCFv2027?<\/h2>\n\n\n\n
<\/div>\n\n\n\n

Secrets and Keys Vaults Become in Scope<\/h3>\n\n\n\n

CSCFv2027 introduces the technology-neutral term Secrets and Keys Vault (SKV)<\/strong>. It covers solutions used to store and manage credentials, API and SSH keys, certificates, and associated private keys.<\/p>\n\n\n\n

An SKV and its underlying system must be treated as in-scope components and protected similarly to the applications that use them. Externally hosted or outsourced vaults are also subject to Control 2.8.<\/p>\n\n\n\n

<\/div>\n\n\n\n

New Guidance on Artificial Intelligence (AI)<\/h3>\n\n\n\n

The Customer Security Programme FAQ now addresses AI agentic operators that generate or support business transactions. These agents should be appropriately secured and governed with human-in-the-loop (HITL)<\/strong> controls incorporated by design when they are involved in transaction management.<\/p>\n\n\n\n

Control 2.2 also addresses AI-driven cyber threats. SWIFT recommends faster security updates, risk-based vulnerability prioritization, and compensating controls where timely patching is not possible.<\/p>\n\n\n\n

<\/div>\n\n\n\n

New Alliance Connect VPN Technology<\/h3>\n\n\n\n

Between 2027 and 2029, SWIFT plans to progressively replace existing SRX and vSRX solutions with new Secure Services Router (SSR) VPN models.<\/p>\n\n\n\n

The new Alliance Connect Virtual on Premises VPN<\/strong> is to be deployed on a dedicated virtual machine. The VPN instance and its underlying virtualization platform are explicitly included within the scope of several CSCF controls.<\/p>\n\n\n\n

CSCFv2027 also introduces the Swift Digital Ledger<\/strong> and the Swift Payment Scheme<\/strong>. Requirements for the Digital Ledger are expected to be developed further, with possible integration into CSCFv2028. Interfaces and connectors supporting the Payment Scheme remain subject to the applicable CSCF requirements.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Additional Control Clarifications<\/h2>\n\n\n\n

Several existing controls have also been refined:<\/p>\n\n\n\n