This CSCF v2026 attestation pack is the policy and evidence set a SWIFT user needs for the Customer Security Controls Framework v2026, which applies to attestations submitted from July 2026. 32 editable Word documents, downloadable the moment you check out. On this page:
- What is in the toolkit
- What changed in CSCF v2026, and why control 2.4A matters
- Who needs CSCF v2026 attestation
- How the documents map to the framework
- Frequently asked questions
- Related toolkits
What is in the CSCF v2026 attestation pack
The documents follow the CSCF control structure, so an independent assessor can work through them in the order the framework is written. What is covered:
- Architecture and scoping – the architecture type determination, the secure zone definition and the boundary description an assessor tests first
- Control 1 and 2 – environment protection, operating system privileged account control, back office data flow security, and the internal and external transmission data protection controls
- Control 3 and 4 – physical security, password policy and multi-factor authentication
- Control 5 – logical access control, token management, physical and logical password storage, and staff screening
- Control 6 – malware protection, software integrity, database integrity, logging and monitoring, and intrusion detection
- Control 7 – cyber incident response planning, security training and awareness, and penetration testing and scenario risk assessment
- Attestation support – the independent assessment evidence pack, the assessor engagement material and the KYC-SA submission preparation documents
What changed in CSCF v2026, and why control 2.4A matters
SWIFT published CSCF v2026 in October 2025 and it governs attestations from July 2026. The headline change is that control 2.4A, Back Office Data Flow Security, has become mandatory. It was advisory before, which means a great many users have no documented position on it at all.
The second change is one of scope rather than control text. Indirectly connected endpoints reached through a shared service provider resource now count as customer connectors, which pulls architecture into scope that users had previously argued was outside it. If your last CSCF v2026 attestation rested on a narrow connector definition, that definition is worth re-testing before your assessor does it for you.
Attestation under the CSCF is annual and independently assessed, so the documentation has to be current rather than reconstructed at submission time. The official programme material is on the SWIFT Customer Security Programme page.
Who needs CSCF v2026 attestation
Banks, payment institutions, brokers and corporates that connect to SWIFT and must attest annually. Service bureaux and shared infrastructure providers whose customers now fall inside the widened connector definition. And the security or payments lead who has inherited the attestation and needs a defensible document set rather than a spreadsheet of assertions.
How the CSCF v2026 attestation maps to the framework
Each control has a written policy rather than a tick in a workbook, because an independent assessor tests the documented position against what the environment actually does. The secure zone documentation is the anchor: get the architecture type and boundary wrong and every downstream control is assessed against the wrong scope. The pack keeps that determination as a standalone, reviewable document.
Frequently asked questions
When does CSCF v2026 apply?
To attestations from July 2026. It was published in October 2025, which gives users the lead time to close the new mandatory control.
What is control 2.4A and why is it suddenly urgent?
Back Office Data Flow Security. It moved from advisory to mandatory in v2026, so users who never documented it now have a gap that an independent assessor will record.
Has the scope changed?
Yes. Indirectly connected endpoints reached via a shared service provider resource now count as customer connectors, which widens architecture scope for some users.
Does this replace the independent assessment?
No. The CSCF requires independent assessment. This pack gives the assessor a complete, current document set to test against, which is what shortens the engagement.
How many documents are included?
32 editable Word documents, plus a usage guide, an FAQ and a licence file.
Related toolkits
Financial institutions attesting under the CSCF usually carry other obligations too. See the PCI-DSS Toolkit for card data, the DORA Toolkit for EU operational resilience, the ISO 27001 Toolkit for the underlying ISMS and the SAMA Toolkit for Saudi-regulated institutions. Institutions that acquire card transactions also need the PCI PIN security toolkit.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
Your CSCF v2026 attestation downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is watermarked or locked, so you can rebrand the documents, bring them under your own document control and revise them for as long as you need them.
One-time purchase. No subscription and no annual renewal. Because the source files are yours, revising a procedure after an audit finding or a change of scope is an internal edit rather than another purchase.
Reviews
There are no reviews yet.