Kilde › Guides › SWIFT CSP › The independent assessment: who may do…
Current to 26 August 2026 · updates land in the changelog.
Since the 2021 cycle, a SWIFT CSP attestation without an independent assessment is itself a compliance failure — one SWIFT reserves the right to report to supervisors. The requirement is structural: someone independent examines your control claims before a senior officer signs them.
Two routes, mixable: independent internal — second or third line (compliance, risk, internal audit), organisationally separate from the teams operating the controls — or external assessors. Either way the lead assessor needs relevant certifications. The first-line engineer who built the environment assessing their own work is exactly what the rule exists to prevent.
The line that should organise your preparation comes from the public assessor community: most controls fail on evidence, not on implementation. Assessors cannot accept “we do that”; they can accept a dated config export, a reviewed inventory, a rehearsal record. The pattern across all 26 mandatory controls: an artifact showing the mechanism, an artifact showing it's current, and a trail showing someone looks at it — per-control detail in the control-by-control guides.
Assessment cost tracks assessor hours, and hours track how findable your evidence is. The difference between a smooth engagement and an expensive one is usually a handover index: control by control, the claim, the artifacts, their dates, the known gaps with risk acceptances. Walking in with that beats walking in with a share drive — and the market runs at five-figure engagement prices, so saved days are real money.
The assessment must precede submission and approval inside the 1 July – 31 December window — and assessor calendars compress hard in Q4. Institutions with a 2.4 flow-inventory project still open in October are the ones paying rush rates in December.
The SWIFT CSP Evidence Pack: the v2026 delta map, the architecture & scoping worksheet, the control 2.4 evidence workbook, the full 26-control evidence checklist, the independent-assessment and attestation runbooks, the service-bureau file and the update tracker — independent, built from public assessor consensus. Most controls fail on evidence, not implementation; this pack is the evidence layer.
Get the pack — US$390 Free 4-page sample (PDF)Instant download · 14-day unconditional refund · single-organisation licence · full product page
Independent publication by Kilde — not affiliated with, endorsed by, or approved by S.W.I.F.T. SC. SWIFT is a registered trademark of S.W.I.F.T. SC. Controls are identified by number and short official title only; nothing on this page restates SWIFT's controls text, and all descriptions are our own orientation built from public assessor material — not legal advice, not security consulting, not an independent assessment. Download the CSCF v2026 yourself from SWIFT's Knowledge Centre (publication page cscf_dd/70.0 — free, no login) and verify everything against it. © 2026 Kilde.
Built by Kilde's founder, a practising attorney admitted to a US state bar (not an EU or Hong Kong admission). About · Verification log · Refunds · Terms · Privacy · esau@trykilde.com