Blog

Recently, we've had a surge in inquiries surrounding SWIFT, and so in this video, Schellman's Matt Crane will take a closer look at what a SWIFT Customer Security Independent Assessment entails. What is the SWIFT Customer Security Program (CSP)? The Society for Worldwide Interbank Financial Telecommunications, or SWIFT, serves as a member-owned cooperative that facilitates the exchange of financial messages between entities. Organizations utilizing SWIFT gain access to its network and associated software, thereby creating a cybersecurity risk to both the network and application ecosystem. In response to those growing cybersecurity concerns, SWIFT introduced the Customer Security Program (CSP) in May 2016. As an international standard that aims to mitigate cyber threats and safeguard the integrity, availability, and confidentiality of the global financial system, the CSP's framework of policies, standards, and guidelines are designed to bolster cyber defenses, detect and prevent fraud, and enable threat information sharing among users. Understanding Independent Assessment Central to the CSP is the requirement for SWIFT users and providers to undergo regular independent assessments to validate their compliance with the applicable cybersecurity framework. These assessments, mandated annually since 2021, ensure that organizations adhere to the Customer Security Controls Framework, which outlines mandatory and advisory security controls intended to enhance the security of financial messaging services. The Role of Assessors Assessments must be conducted by external independent assessors—like Schellman or others listed on the CSP Assessment Provider list on SWIFT.com—or internal independent assessors. These assessors deliver comprehensive reports that include executive summaries, controls assessments, and completion letters, outlining your organization's compliance status with the CSP. Moving Forward Now Instead of Later The SWIFT Customer Security Independent Assessment plays a pivotal role in safeguarding the integrity of financial transactions in today's interconnected world. If you're a SWIFT user, you must recognize the significance of annual assessments and prioritize compliance with the CSP—instead of waiting until the fourth quarter to initiate assessments, you can begin the process as early as the second quarter to ensure ample time for review and resolution of any identified issues. By adhering to the CSP and undergoing regular assessments, you can enhance your cyber defenses and contribute to a more secure global financial ecosystem. To learn more about SWIFT and the related assessments, contact us today and ensure your timely compliance and proactive risk management.

When seeking Payment Card Industry (PCI) compliance, the expiration of terminals can introduce complexities and uncertainties for merchants. In this video, Sully Perella, a practice leader at Schellman, sheds light on the significance of expired terminals and offers insights into navigating this compliance challenge.

To address some of the past confusion regarding the dating of PCI reports, the PCI Security Standards Council (SSC) has altered the report date methodology for PCI DSS v4.0 to provide more clarity and consistency to this process.

The PCI SSC recently released the MPoC standard or the Mobile Payments on Commercial off-the-shelf devices.

One of the most worrying things that can happen during an assessment is scope creep. The name even sounds scary. In this video, we're going to talk about:

If you are a software developer and you want to be assessed against the PCI-DSS, maybe the secure software lifecycle under the SSF is a better choice for you. Let's talk about why.

Critical security control failure. It's a whole lot of words. What does this mean? How does this apply to your organization? Well, we here at Schellman are well aware of these requirements. Stay tuned.