Question 1

Must all CSCF controls be subject to an assessment?

Options :

A : Yes

B : No, only the mandatory controls

C : No, only the attested controls (with as a minimum the mandatory ones]

D : No, the control selection is defined between the Swift User and their assessor

Answer: C

Question 2

What are the possible impacts for a SWIFT user to be non-compliant to CSP? (Select the two correct answers that apply)•Swift Customer Security Controls Policy•Swift Customer Security Controls Framework v2025•Independent Assessment Framework•Independent Assessment Process for Assessors Guidelines•Independent Assessment Framework - High-Level Test Plan Guidelines•Outsourcing Agents - Security Requirements Baseline v2025•CSP Architecture Type - Decision tree•CSP_controls_matrix_and_high_test_plan_2025•Assessment template for Mandatory controls•Assessment template for Advisory controls•CSCF Assessment Completion Letter•Swift_CSP_Assessment_Report_Template

Options :

A : To be reported to their supervisors (if applicable)

B : To be seen as non-compliant to their counterparts in KYC-SA

C : To be contacted by SWIFT to provide the CSP assessment report and detailed information about the reason of non-compliance

D : To be delisted from the BIC directory

Answer: B,C

Question 3

An application only uses (i) the SWIFT API for reporting and gpi basic tracker calls through (ii) a tailored account not allowing business transactions management. Is this application in scope of the CSCF? (Select the correct answer)•Swift Customer Security Controls Policy•Swift Customer Security Controls Framework v2025•Independent Assessment Framework•Independent Assessment Process for Assessors Guidelines•Independent Assessment Framework - High-Level Test Plan Guidelines•Outsourcing Agents - Security Requirements Baseline v2025•CSP Architecture Type - Decision tree•CSP_controls_matrix_and_high_test_plan_2025•Assessment template for Mandatory controls•Assessment template for Advisory controls•CSCF Assessment Completion Letter•Swift_CSP_Assessment_Report_Template

Options :

A : Yes, it is in scope and considered a customer connector because it reads business transaction data

B : No, it can be descoped because there is no business transaction management being performed

C : No, it is not in scope because the API connection method is not in scope of the CSP

D : Yes, it is in scope because the API connection method is less secure than SWIFT interfaces

Answer: B

Question 4

Can an assessor re-use an ISAE 3000 report dating back 2 years to support an independent assessment?

Options :

A : No, that is too old, the maximum is 18 months

B : Yes, there is no time limit for an iSAE 3000 report

C : No, the SAE 3000 report is no validsurrogateas a rule

D : Yes, provided there is no change to the Swift user-s infrastructure

Answer: C

Question 5

What is the purpose of the High-Level Test Plan (HLTP) provided by SWIFT? (Select the correct answer)•Swift Customer Security Controls Policy•Swift Customer Security Controls Framework v2025•Independent Assessment Framework•Independent Assessment Process for Assessors Guidelines•Independent Assessment Framework - High-Level Test Plan Guidelines•Outsourcing Agents - Security Requirements Baseline v2025•CSP Architecture Type - Decision tree•CSP_controls_matrix_and_high_test_plan_2025•Assessment template for Mandatory controls•Assessment template for Advisory controls•CSCF Assessment Completion Letter•Swift_CSP_Assessment_Report_Template

Options :

A : The HLTP provides a way of testing and the typical evidence for each control (based on implementation guidelines) and must be strictly followed

B : The HLTP provides a way of testing and the typical evidence for each control (based on implementation guidelines), testing should be ideally based on it

C : The HLTP provides the rules to define the sample for testing

D : The HLTP provides a detailed way of control testing

Answer: B

Confidently Practice Online with Free CSP-Assessor Exam Cram

Buying Options: