Does your organization use the SWIFT network with some or all of your IT services outsourced to a third party? Are you one of those third-party organizations engaged by a SWIFT user for the hosting, installation, operation, and/or maintenance of components involved in your customer's SWIFT implementation?

Hi, I'm Matt Crane. I'm a leader in the Payment Security Practice, and today we're going to tackle what exactly cardholder data is because the PCI Council has introduced a new term in PCI DSS v4.0. But first, let's talk about PCI DSS v3.2.1, because--similar to the dinosaurs on my shirt in this video--some of the terminology in v3.2.1 is now extinct, as this version was officially retired on March 31, 2024.

Haga clic aquí para ver este video en español

With the December 31st attestation submission date for annual SWIFT Independent Assessments looming closer, it's crucial to ensure readiness and a big part of that is choosing your assessor.

We've received a lot of questions recently about the new access control requirements and PCI DSS version 4. Today, we're going to review those and hopefully we can answer your questions.

Recently, we've had a surge in inquiries surrounding SWIFT, and so in this video, Schellman's Matt Crane will take a closer look at what a SWIFT Customer Security Independent Assessment entails. What is the SWIFT Customer Security Program (CSP)? The Society for Worldwide Interbank Financial Telecommunications, or SWIFT, serves as a member-owned cooperative that facilitates the exchange of financial messages between entities. Organizations utilizing SWIFT gain access to its network and associated software, thereby creating a cybersecurity risk to both the network and application ecosystem. In response to those growing cybersecurity concerns, SWIFT introduced the Customer Security Program (CSP) in May 2016. As an international standard that aims to mitigate cyber threats and safeguard the integrity, availability, and confidentiality of the global financial system, the CSP's framework of policies, standards, and guidelines are designed to bolster cyber defenses, detect and prevent fraud, and enable threat information sharing among users. Understanding Independent Assessment Central to the CSP is the requirement for SWIFT users and providers to undergo regular independent assessments to validate their compliance with the applicable cybersecurity framework. These assessments, mandated annually since 2021, ensure that organizations adhere to the Customer Security Controls Framework, which outlines mandatory and advisory security controls intended to enhance the security of financial messaging services. The Role of Assessors Assessments must be conducted by external independent assessors—like Schellman or others listed on the CSP Assessment Provider list on SWIFT.com—or internal independent assessors. These assessors deliver comprehensive reports that include executive summaries, controls assessments, and completion letters, outlining your organization's compliance status with the CSP. Moving Forward Now Instead of Later The SWIFT Customer Security Independent Assessment plays a pivotal role in safeguarding the integrity of financial transactions in today's interconnected world. If you're a SWIFT user, you must recognize the significance of annual assessments and prioritize compliance with the CSP—instead of waiting until the fourth quarter to initiate assessments, you can begin the process as early as the second quarter to ensure ample time for review and resolution of any identified issues. By adhering to the CSP and undergoing regular assessments, you can enhance your cyber defenses and contribute to a more secure global financial ecosystem. To learn more about SWIFT and the related assessments, contact us today and ensure your timely compliance and proactive risk management.

In the realm of data security and compliance, one term that frequently arises is "scope." It's a pivotal concept, particularly within the context of the Payment Card Industry Data Security Standard (PCI DSS). In this video, Senior Manager Sully Perella discusses what's in scope for PCI DSS compliance and how your organization may have compliance implications even if you don't directly handle cardholder data.

In today's rapidly evolving landscape, managing climate-related risks has become an essential aspect of corporate responsibility. As organizations strive to demonstrate their commitment to sustainability, one crucial component emerges: setting credible greenhouse gas emissions reduction targets.

When seeking Payment Card Industry (PCI) compliance, the expiration of terminals can introduce complexities and uncertainties for merchants. In this video, Sully Perella, a practice leader at Schellman, sheds light on the significance of expired terminals and offers insights into navigating this compliance challenge.