How to Reduce the Compliance and Risk Burden of SWIFT Security Attestation

Book a call with us

Book a demo

GUIDE

Communicate security compliance clearly and efficiently Leverage enterprise architecture models to deliver greater value Identify security control gaps and weaknesses through modeling Adopt a systematic automated approach to achieve proactive compliance Establish a formula for success for Swift compliance that can be used across multiple regulatory requirements

Reduce the Compliance and Risk Burden of Swift Security Attestation with Enterprise Architecture

Are you easily spending upwards of $240k or more than 1,000 man-hours to complete the Swift Security Attestation? Every practitioner working annually on ensuring compliance with the Swift Customer Security Controls Framework (CSCF) knows the headache it entails. The framework is mandatory and evolves to combat new and rising threats, and to implement new developments in cybersecurity. However, complying with the controls in the framework is a time-consuming and laborious process. Compliance tasks may be divided across several teams in your organization. Chances are they all use different tools to capture the required information, such as Confluence, Microsoft Excel spreadsheets, Visio, PowerPoint or Word docs, making it challenging to generate a complete result that could easily be repurposed, and which limits their ability to truly understand and effectively manage risk.

*www.swift.com

How Bizzdesign’s Swift CSP Compliance solution works

Benefits of Bizzdesign’s Swift CSP Compliance solution

Why you need to consider Bizzdesign’s Swift CSP Compliance solution

Visualize Swift control implementation in ArchiMate Leave no blind spots. Meet a control requirement by viewing the relationships between different systems. Our solution uses ArchiMate notation for modeling and also follows a strict modeling convention, specifying which relations and components are used and connected using specific relationship types. This allows you to programmatically scan the architecture model and conclude if the controls are correctly modeled to fulfill Swift requirements.

FAQ

Do I need to be an Enterprise Architect designer to use Bizzdesign’s Swift models? No, you don’t need to have experience of our Bizzdesign Horizzon platform. As part of the Swift CSP Compliance solution, we provide a guided design experience, including pre-packaged templates for modeling and example content that details design patterns.

Recommended for you:

Secure by Design

WHITEPAPER

Complete SWIFT CSP Attestation faster and at a substantially reduced cost

BROCHURE

Make Swift Security Attestation Painless

BLOG

Conclusion: Make your team relevant

An agile EAM practice works towards specific goals by defining a common set of capabilities and value streams in line with the organization’s strategic direction. They offer EA services to the organization that they deliver consistently to streamline onboarding and optimize skills. They make their activities measurable and ensure continuous improvement of their services. When you build an agile EAM practice using the building blocks described in this guide, your team will become relevant to the organization. Your team will be producing and measuring value against what matters: revenue and costs.

Recommended watching: Harnessing the data you have and putting it to work

Watch this video to see how to integrate data from Jira, ServiceNow and Aptio in Bizzdesign Horizzon and how to formulate outputs from combined data quickly.

To get complete coverage of your entire Swift framework with consistent sets of views from multiple stakeholder viewpoints, you need to reduce the magnitude of the task by following a structured models-based approach. You’ll be able to reduce the time it takes to review and validate your compliance with the Swift framework and issue independent assurance reports under recognized standards (e.g. SOC 2 and ISAE).

Quick links

•

What is the SWIFT framework Swift links 11,000 banks and institutions in more than 200 countries. To keep its entire ecosystem secure, Swift mandates strict cybersecurity guidelines on institutions that connect to its network. Every financial institution connecting to the Swift payment system must implement the Swift Customer Security Controls Framework (CSCF). The goal is to protect the confidentially, integrity and availability of data for financial payment services. The CSCF consists of mandatory and advisory security controls that continuously evolve to combat new cybersecurity threats and developments. Every year the CSP is updated, and consequently the CSCF, based on the latest cyber threat landscape, may include new or modified controls. Institutions must submit a mandatory Security Attestation by the end of each year stating that their IT (Information Technology) infrastructure complies with the latest control framework.

Users also need to include a  Swift-mandated external assessment as part of the Security Attestation. The external assessment is not a full audit and can be completed by the payments, security and compliance teams. The Security Attestation and the independent assessment deadline is 31 December*.

The Swift CSCF 2023 (published in 2022) specifies 32 controls. Out of these, 24 are mandatory and 8 are advisory. Compliance with these controls must be attested by 31st December 2023.

Why it’s challenging to comply with Swift Compliance with the framework is often a time-consuming and expensive (but necessary) project for financial institutions. The nature of control implementation is a complex n-dimensional modeling problem involving control objectives, control requirements, data applications and infrastructure documents, events, functions, etc. The Security Attestation involves documenting how the control requirements are implemented and what evidence is available. To gather all the information and data required to complete the Security Attestation involves thousands of man-days to document. Compliance teams often capture information in ‘flat’ documents and complex spreadsheets without visualization and pictures. They often use Confluence wiki (if data is stored across Confluence sites, it can’t be updated all at once), Microsoft® Excel sheets, and Visio diagrams. This process is slow, expensive and error-prone, and organizations don’t have model traceability to the enterprise architecture. The answer: automated and reusable models A model-based approach enables automation and better use of security resources. Models can dynamically populate metrics based on queries that traverse the relationships between different connected components and provide on-demand dashboards and analytics. This provides objective, transparent insights based on formal modeling languages and component reuse, avoiding the overhead of manual, repetitive report creation and freeing up expensive, scarce resources for higher-value work. Bizzdesign’s Swift CSP Compliance solution provides an efficient, effective and structured approach to capture, document, communicate and manage compliance in your environment. The solution includes a pre-packaged set of reference architecture models, dashboards and scripts built into our enterprise architecture platform, Bizzdesign Horizzon while giving you the ability to leverage existing architecture models. Use the solution to create architecture views for each of the controls mandated in the CSCF. A picture is worth a thousand words, and our model views remove the need for narrative text. Using model views is a precise way to communicate information in a clear and visual form. Once you’ve modeled your local Swift infrastructure, you can conduct an automated analysis to validate compliance with the CSCF and visualize compliance status in management reports and dashboards.

Streamlines the Swift CSP attestation process Integrates with enterprise architecture modeling to enable automation of yearly attestation updates Provides a higher degree f confidence in that the attestation is 100% accurate Identifies cyber security weaknesses in enterprise architecture Improves communications by using diagrams instead of words

Monitor Swift compliance through dashboards Objective-status dashboards indicate Swift compliance and audit readiness. Utilize dashboards to see compliance status in real-time. Dashboards are updated based on modeling data. As soon as any change in the architecture is modeled, the dashboards are updated, giving up-to-date compliance information.

Always keep your Swift attestation updated with architectural models Utilizing architecture diagrams allows you to map the IT environment clearly and minimizes the time to generate Security Attestation. After the initial mapping is complete, subsequent modifications only need to be updated once. All relevant architecture diagrams can be fetched for review using the ‘Inspect’ feature of Bizzdesign Horizzon.

Improved overall cybersecurity posture Architecture diagrams constructed for Swift compliance document the current state of the enterprise. An accurate picture of your environment highlights your weaknesses before attackers discover them. Architecture diagrams highlight implemented controls covering all architecture layers – business, application and technology. Critically analyzing these architecture diagrams improves the overall cybersecurity posture of the organization.

Do I need to be an existing Bizzdesign Horizzon customer? No, you don’t need to be an existing Bizzdesign Horizzon customer. You can purchase Swift CSP Compliance as a standalone solution.

How much work is required to update the models for subsequent years? Automation enables the models to identify year-on-year deltas in the enterprise architecture, meaning subsequent years’ attestation is streamlined. Ensuring the status is correctly updated depends on the Swift control requirement. If it follows an existing pattern, then minimal effort is needed to update automation. If Swift requires a new pattern, it will require updating logic that validates compliance status.

Can the models be re-used? Yes. The models capture the IT landscape relating to the financial institutes Swift infrastructure. It can be used as documentation for other regulatory compliance needs or further linking with the broader architecture. They could also be reused for attestation for subsequent years.

Is the real-time feed backed by relations between infrastructure components? You can provide traceability with Bizzdesign Horizzon and by using ArchiMate modeling:

How to get started? Contact us today for a live demo if you’re interested in faster and cheaper completion of the Swift Security Attestation.

Why Bizzdesign?

Learn how to:

A quick recap: What is the Swift framework?

Why is it challenging to comply with Swift?

How to complete Self-attestation: quick and easy

Benefits of automated and reusable models

Why you need to consider the Swift CSP Compliance solution

FAQs

How to get started?

Compliance dashboards can provide the same information as the metrics they would be viewing. These can be augmented with additional modeling information offered by the Bizzdesign Swift CSP solution.

Use of color and label views in Bizzdesign Horizzon provide a dynamic view of each requirement Swift mandates. These requirements can be seen if fulfilled or not on Bizzdesign Horizzon sites. Further drilldown can be performed on the requirements to see how they are realized.

Models created for Swift can be re-used for documentation and plugging in with the financial institute's overall Enterprise/ Solution Architecture. Thus the modeling exercise once carried out, could be reused for documentation and analysis with all the benefits of having complete enterprise architecture models.

•

• • • • •

To gather all the information and data required to complete the Security Attestation involves thousands of man-days to document. Compliance teams often capture information in ‘flat’ documents and complex spreadsheets without visualization and pictures. They often use Confluence wiki (if data is stored across Confluence sites, it can’t be updated all at once), Microsoft® Excel sheets, and Visio diagrams. This process is slow, expensive and error-prone, and organizations don’t have model traceability to the enterprise architecture.

The answer: automated and reusable models A model-based approach enables automation and better use of security resources. Models can dynamically populate metrics based on queries that traverse the relationships between different connected components and provide on-demand dashboards and analytics. This provides objective, transparent insights based on formal modeling languages and component reuse, avoiding the overhead of manual, repetitive report creation and freeing up expensive, scarce resources for higher-value work. Bizzdesign’s Swift CSP Compliance solution provides an efficient, effective and structured approach to capture, document, communicate and manage compliance in your

environment. The solution includes a pre-packaged set of reference architecture models, dashboards and scripts built into our enterprise architecture platform, Bizzdesign Horizzon while giving you the ability to leverage existing architecture models. Use the solution to create architecture views for each of the controls mandated in the CSCF. A picture is worth a thousand words, and our model views remove the need for narrative text. Using model views is a precise way to communicate information in a clear and visual form. Once you’ve modeled your local Swift infrastructure, you can conduct an automated analysis to validate compliance with the CSCF and visualize compliance status in management reports and dashboards.

Streamlines the Swift CSP attestation process Integrates with enterprise architecture modeling to enable automation of yearly attestation updates Provides a higher degree of confidence in that the attestation is 100% accurate Identifies cyber security weaknesses in enterprise architecture Improves communications by using diagrams instead of words