CSP-Assessor Exam Dumps : Customer Security Programme Assessor Certification(CSPAC)

CSCF Control "1.2 Physical Security" requires SWIFT users to protect the physical locations of SWIFT-related servers and infrastructure from unauthorized access. Let’s evaluate:

•The control mandates measures such as restricting physical access, using surveillance, and maintaining an access control list for individuals entering server locations.

•Regular review of physical access lists is explicitly included to ensure that only authorized personnel have access and to identify any anomalies or outdated permissions. This is part of the ongoing monitoring requirement under CSCF Control "1.2" and is detailed in the "Assessment template for Mandatory controls."

•The "Independent Assessment Framework" and "CSP_controls_matrix_and_high_test_plan_2025" emphasize this as a mandatory practice to maintain physical security integrity.

Summary of Correct Answer:

The Physical Security control includes a regular review of physical access lists (TRUE).

References to SWIFT Customer Security Programme Documents:

•Swift Customer Security Controls Framework v2025: Control 1.2 requires access list reviews.

•Assessment template for Mandatory controls: Includes this as a compliance criterion.

•CSP_controls_matrix_and_high_test_plan_2025: Tests for regular access list reviews.

CSCF Control "3.1 Database Integrity" focuses on ensuring the integrity of databases used by SWIFT-related components. Let’s evaluate each option:

•Option A: Nothing is further expected when the messaging interface or connector integrates/embeds an integrity check functionality at each SWIFT transaction record level

This is incorrect as a sole expectation. While embedding integrity checks (e.g., checksums or hashes) in a messaging interface or connector is a valid measure, the CSCF expects additional protections for the database itself, not just reliance on application-level checks. The "Swift Customer Security Controls Framework v2025" requires broader database security.

•Option B: When a database is used by a messaging interface or connector, the related hosted database and its supporting system is expected to be protected as a SWIFT-related component, the identified exceptions alerted and followed-up

This is correct. Control 3.1 mandates that databases supporting SWIFT components (e.g., storing transaction data for Alliance Access) be protected as in-scope components. This includes securing the database and its system (e.g., via access controls, encryption) and addressing integrity exceptions through alerts and follow-up, as detailed in the "Assessment template for Mandatory controls."

•Option C: Alerts generated from performed integrity checks are captured and analyzed for appropriate treatment

This is correct. The CSCF expects institutions to monitor database integrity (e.g., via logging) and analyze alerts to detect and respond to anomalies, aligning with Control "3.1" and "5.1 Operational Incident Response." The "CSP_controls_matrix_and_high_test_plan_2025" includes this as a compliance criterion.

Summary of Correct Answers:

The CSCF expects the database and its system to be protected with alerts and follow-up (B) and alerts to be captured and analyzed (C).

References to SWIFT Customer Security Programme Documents:

•Swift Customer Security Controls Framework v2025: Control 3.1 defines database integrity requirements.

•Assessment template for Mandatory controls: Includes protection and alert management.

•CSP_controls_matrix_and_high_test_plan_2025: Tests database integrity measures.

========

This question addresses the scope of penetration testing for Swift-related components under theSwift Customer Security Programme (CSP).

Step 1: Understand Penetration Testing Requirements

TheCSCF v2024, underControl 4.1: Penetration Testing, mandates penetration testing to identify vulnerabilities in Swift-related systems. The scope is defined by theSwift Testing Policy, not arbitrarily applied to all components.

Step 2: Analyze the Statement

The statement suggests that penetration testing "must be performed at application level against the Swift-related components, such as the interfaces, Swift and customer connectors." We need to verify if this is a mandatory scope.

Step 3: Evaluate Against Swift Guidelines

Control 4.1: Penetration Testingrequires testing of in-scope components, but theSwift Testing Policy(referenced in theCSCF v2024andSecurity Best Practices) specifies which components (e.g., messaging interfaces, connectors) must be tested based on risk and architecture.

The policy does not mandate testing all listed components (e.g., interfaces, connectors) at the application level unless they are identified as high-risk or in-scope per the user’s assessment. For example, customer connectors might be excluded if managed by a Service Bureau, per theSwift Outsourcing Guidelines.

The statement’s assertion of a broad mandate is incorrect; the scope is limited to components defined in theSwift Testing Policy, which provides a tailored approach.

Step 4: Conclusion and Verification

The answer isB, as penetration testing must follow theSwift Testing Policy, which defines the specific components to test, rather than mandating all Swift-related components like interfaces and connectors.

References

Swift Customer Security Controls Framework (CSCF) v2024, Control 4.1: Penetration Testing.

Swift Testing Policy, Section: Scope Definition.

Swift Security Best Practices, Section: Penetration Testing.