SWIFT PKI certificates are critical for securing communications and require a formal request process to SWIFT for issuance or renewal. Let’s evaluate each option:

• Option A: Using both online and offline methods

This is correct. SWIFT provides multiple channels for submitting PKI certificate requests to accommodate different customer needs and security requirements. The online method involves submitting requests through the SWIFT Alliance Web Platform or SWIFT’s customer portal, where users can generate and upload certificate signing requests (CSRs). The offline method involves physical submission, such as sending a signed request via secure mail or courier, often used for initial setups or high-security environments. SWIFT documentation confirms both methods are supported, aligning with CSCF Control "1.3 Cryptographic Failover" for secure certificate management.

• Option B: Using an online method

This is incorrect as a standalone answer. While the online method is available and widely used, it is not the only method. Excluding the offline option does not reflect SWIFT’s flexible process.

• Option C: Using an offline method

This is incorrect as a standalone answer. The offline method is an option, but it is not the only method. SWIFT supports both approaches depending on the customer’s infrastructure and security policies.

• Option D: None of the above

This is incorrect. Both online and offline methods are valid, making this option invalid.

Summary of Correct Answer:

PKI certificate requests can be submitted to SWIFT using both online and offline methods (A), providing flexibility and security.

References to SWIFT Customer Security Programme Documents:

• SWIFT Customer Security Controls Framework (CSCF) v2024: Control 1.3 supports secure certificate request processes.

• SWIFT PKI Management Guide: Details online and offline submission methods for certificate requests.

• SWIFT Alliance Documentation: Confirms dual submission channels for PKI certificates.

This question examines whether an internal audit department can submit and approve a Swift user’s attestation on the KYC-SA Swift portal.

Step 1: Understand Attestation Process

The Independent Assessment Framework and CSCF v2024 require attestations to be submitted by an independent party or authorized user representative, not the internal audit department, to ensure objectivity.

Step 2: Evaluate Each Option

A. Yes, providing this is agreed by the head of IT operations and the CISO Internal audit cannot submit or approve attestations, regardless of internal agreements, per the Independent Assessment Framework . Conclusion : Incorrect.

B. No, this is never an option The CSCF v2024 and Swift CSP Compliance Guidelines prohibit internal audit from submitting or approving attestations, as they lack independence from the audited entity. Conclusion : Correct.

C. Yes, an internal auditor can submit the attestation for approval provided they have the appropriate credentials for swift.com. The CISO remains in charge of the approval of the attestation Incorrect. Internal auditors cannot submit or approve, even with credentials, due to independence requirements. Conclusion : Incorrect.

D. Yes, with approval from the Chief auditor Incorrect. Chief auditor approval does not override the independence requirement. Conclusion : Incorrect.

Step 3: Conclusion and Verification

The correct answer is B , as the CSCF v2024 and Independent Assessment Framework prohibit internal audit from submitting or approving attestations.

References

Swift Customer Security Controls Framework (CSCF) v2024 , Section: Independent Assessment.

Swift Independent Assessment Framework , Section: Attestation Submission.

Swift CSP Compliance Guidelines , Section: Independence Requirements.

SwiftNet Link (SNL) is the mandatory network interface software that enables connectivity to the SWIFTNet network, providing transport, security, and service management functionalities. The Swift Alliance Gateway (SAG) is a communication interface that consolidates message flows and relies on SNL to connect to SWIFTNet. According to SWIFT documentation, SAG is built on top of SNL, making SNL a prerequisite for SAG operation. This dependency is consistent across on-premises and cloud-based deployments (e.g., Alliance Connect Virtual), where SNL ensures secure communication over the SWIFT Secure IP Network (SIPN). The CSCF Control "1.1 SWIFT Environment Protection" underscores the need for secure connectivity components like SNL. There are no documented scenarios where SAG can operate without SNL, confirming the statement is true.

References to SWIFT Customer Security Programme Documents:

• SWIFT Customer Security Controls Framework (CSCF) v2024: Control 1.1 mandates secure connectivity components like SNL.

• SWIFT Alliance Gateway Documentation: SAG requires SNL for SWIFTNet connectivity.

• SWIFTNet Link Documentation: SNL is the mandatory interface for all SWIFTNet communications.

========