Free Practice Questions for Swift CSP-Assessor Exam

The "Outsourcing Agents - Security Requirements Baseline v2025" and "Swift Customer Security Controls Framework v2025" define provider categories and CSP impact. Let’s evaluate each option:

•Option A: The public cloud provider is considered a L2BA provider, and therefore not in scope of the CSP

This is incorrect. An L2BA (Lite2 Business Application) provider hosts the full SWIFT stack for users, but a public cloud provider offering a virtual machine is not an L2BA provider unless it provides the full service. The CSP still applies to the provider’s infrastructure.

•Option B: The public cloud provider is considered a SWIFT connectivity provider, and therefore not in scope of the CSP

This is incorrect. A SWIFT connectivity provider (e.g., Alliance Connect) is a specific role, but a public cloud provider (e.g., AWS) hosting a communication interface is an outsourcing agent, subject to CSP requirements.

•Option C: The public cloud provider is considered an outsourcing agent, and therefore in scope of the CSP

This is correct. The "Outsourcing Agents - Security Requirements Baseline v2025" classifies public cloud providers hosting SWIFT components (e.g., a virtual machine with Alliance Gateway) as outsourcing agents. The CSP impacts the provider by requiring them to secure the underlying infrastructure (e.g., Control 1.1), while the user secures the communication interface.

•Option D: This type of implementation is not allowed by the CSP

This is incorrect. The CSP permits cloud-based deployments, including user-installed components on public cloud VMs, as long as security controls are met.

Summary of Correct Answer:

The public cloud provider is an outsourcing agent, in scope of the CSP (C).

References to SWIFT Customer Security Programme Documents:

•Outsourcing Agents - Security Requirements Baseline v2025: Defines cloud providers as outsourcing agents.

•Swift Customer Security Controls Framework v2025: Applies controls to outsourced environments.

•CSP_controls_matrix_and_high_test_plan_2025: Includes cloud provider assessments.

========

The "Swift Customer Security Controls Policy" and "Independent Assessment Framework" outline the consequences of non-compliance with the CSP. Let’s evaluate each option:

•Option A: To be reported to their supervisors (if applicable)

This does not apply. Non-compliance is managed by SWIFT, not internal reporting to supervisors, unless specified by the user’s internal governance (not a CSP requirement).

•Option B: To be seen as non-compliant to their counterparts in KYC-SA

This applies. Non-compliance is reflected in the KYC-SA portal, where counterparties can view the user’s status, impacting trust and business relationships, as per the "Independent Assessment Framework."

•Option C: To be contacted by SWIFT to provide the CSP assessment report and detailed information about the reason of non-compliance

This applies. SWIFT engages with non-compliant users, requesting assessment reports and remediation plans, as outlined in the "Swift_CSP_Assessment_Report_Template" and "Independent Assessment Process for Assessors Guidelines."

•Option D: To be delisted from the BIC directory

This does not apply. Delisting is an extreme measure not automatically triggered by non-compliance; it requires persistent failure to remediate after engagement, which is not guaranteed.

Summary of Correct Answers:

Possible impacts include being seen as non-compliant in KYC-SA (B) and being contacted by SWIFT for reports (C).

References to SWIFT Customer Security Programme Documents:

•Independent Assessment Framework: Details non-compliance impacts.

•Swift_CSP_Assessment_Report_Template: Supports SWIFT follow-up.

•CSP_controls_matrix_and_high_test_plan_2025: Reflects KYC-SA visibility.

========

The "Independent Assessment Process for Assessors Guidelines" and "Independent Assessment Framework" outline conditions for relying on previous assessments. Let’s evaluate each option:

•Option A: The control compliance conclusion must have already been relied on the past two years

This does not apply. There is no requirement that reliance has been used for two prior years; reliance is assessed annually based on current conditions, per the "Independent Assessment Framework."

•Option B: The previous assessment was performed on the CSCF version of the previous year (at least)

This does not apply. The CSCF version must match the current assessment year (e.g., v2025 for a 2025 assessment), not the previous year, to ensure alignment with updated controls, as per the "Swift Customer Security Controls Framework v2025."

•Option C: The control definition has not changed

This applies. Reliance is permitted only if the control’s definition remains unchanged from the previous assessment, ensuring the prior conclusion remains relevant, as noted in the "CSP_controls_matrix_and_high_test_plan_2025."

•Option D: The control design and implementation are the same

This applies. The assessor must confirm that the control’s design and implementation have not changed since the last assessment, as required by the "Independent Assessment Process for Assessors Guidelines" to validate ongoing compliance.

Summary of Correct Answers:

Reliance is allowed if the control definition has not changed (C) and the control design and implementation are the same (D).

References to SWIFT Customer Security Programme Documents:

•Independent Assessment Process for Assessors Guidelines: Lists conditions for reliance.

•Independent Assessment Framework: Requires unchanged definitions and designs.

•CSP_controls_matrix_and_high_test_plan_2025: Supports reliance criteria.

========

CSCF Control "6.1 Security Awareness" mandates training for individuals with SWIFT-critical roles (e.g., LSO, RSO, operators) to ensure they understand security policies and procedures. Let’s evaluate each option:

•Option A: Yes, and a track record must show that both awareness and specific training are performed annually

This is correct. Control 6.1 requires annual security awareness training for all SWIFT-critical personnel, with additional specific training as needed to maintain knowledge. The "Swift Customer SecurityControls Framework v2025" and "Assessment template for Mandatory controls" mandate annual training and require a track record (e.g., logs or certificates) to demonstrate compliance.

•Option B: No, both awareness and specific trainings are planned when deemed required

This is incorrect. The CSCF mandates annual awareness training, not just ad-hoc planning, to ensure consistent security awareness.

•Option C: No, awareness training expected to be performed yearly; specific training to maintain the required knowledge only when needed

This is incorrect. While specific training can be as needed, awareness training is explicitly required annually, making this option partially inaccurate.

•Option D: No, a track record must show that both awareness and specific training are performed at least bi-yearly (every 2 years)

This is incorrect. The CSCF requires annual awareness training, not bi-yearly, as specified in the guidelines.

Summary of Correct Answer:

It is mandated to perform security awareness and specific trainings every year, with a track record (A).

References to SWIFT Customer Security Programme Documents:

•Swift Customer Security Controls Framework v2025: Control 6.1 mandates annual training.

•Assessment template for Mandatory controls: Requires annual training records.

•Independent Assessment Framework: Verifies training frequency.

========