SWIFT CSCF
Restrict Internet

SWIFT CSCF SWIFTCSCF-1: Restrict Internet Access and Protect Critical Systems (Objective 1)

Per SWIFT CSCF: SWIFT Environment Protection + Operating System Privileged Account Control + Virtualisation Platform Protection + Restriction of Internet Access + Customer Environment Protection (Architecture A/B). Implement controls per Architecture Type.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 115 controls across 79 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PIC/S Guide to Good Manufacturing Practice for Medicinal Products · 4 controls

  • PICSGMP-1 Chapter 1: Pharmaceutical Quality System (PQS) and Quality Risk Management
  • PICSGMP-2 Chapter 2: Personnel - Qualified Personnel, Key Responsibilities, Training
  • PICSGMP-5 Chapter 5: Production Operations and Material Management
  • PICSGMP-7 Chapter 7: Outsourced Activities and Supplier Management

ACSC Essential Eight · 3 controls

  • E8-ADMIN-ML1 Restrict Administrative Privileges (ML1)
  • E8-ADMIN-ML2 Restrict Administrative Privileges (ML2)
  • E8-ADMIN-ML3 Restrict Administrative Privileges (ML3)

FDA Quality Management System Regulation (QMSR) · 3 controls

  • QMSR-820.10 Requirements for a Quality Management System - ISO 13485:2016 Sections 4-8 incorporation (§820.10)
  • QMSR-ISO13485-Sec5 Management responsibility (ISO 13485:2016 Section 5 - incorporated via §820.10)
  • QMSR-ISO13485-Sec8 Measurement, analysis and improvement (ISO 13485:2016 Section 8)

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 3 controls

IATF 16949:2016 - Quality Management System for Automotive Production · 3 controls

  • IATF16949-Clause10-Improvement-Nonconformity-CorrectiveAction-Problem-ErrorProof IATF 16949 Clause 10 - Improvement + Nonconformity + Corrective Action + Problem Solving + Error Proofing + Continual Improvement
  • IATF16949-Clause4-Context-Scope-CustomerSpecific-ProductSafety IATF 16949 Clause 4 - Context of Organization + QMS Scope + Customer Specific Requirements + Product Safety
  • IATF16949-Clause9-Performance-Monitoring-InternalAudit-ManagementReview IATF 16949 Clause 9 - Performance Evaluation + Monitoring + Internal Audit + Manufacturing Process Audit + Management Review

ICH E6(R3) - Good Clinical Practice · 3 controls

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems · 3 controls

  • NISTSP34-1 Contingency Planning Policy, Programme, and Plan Coordination
  • NISTSP34-2 Business Impact Analysis (BIA): Critical Resources, Recovery Priorities
  • NISTSP34-5 Plan Testing, Training, and Exercises (TTE)

Nigeria Data Protection Act 2023 (NDPA) · 3 controls

  • NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission
  • NG-NDPA-2 Lawful Basis, Consent, and Data Protection Principles
  • NG-NDPA-5 Security of Processing, Breach Notification, and DPIA

O-RAN WG11 Security Specification · 3 controls

  • ORANWG11-2 O-RAN Interface Security: E2, A1, O1, O2, Open Fronthaul
  • ORANWG11-3 Cryptography, TLS, SSH, IPsec, and PKI Lifecycle Management
  • ORANWG11-6 Security Test Specifications, Certification, and Conformance

FCC Customer Proprietary Network Information (CPNI) and Data Breach Rules (47 CFR 64.2001-2011) · 2 controls

FedRAMP Rev 5 · 2 controls

  • FedRAMP-Boundary Authorization Boundary, SSP, SAR, POA&M documentation
  • FedRAMP-ConMon Continuous Monitoring (ConMon) and Significant Change Requests

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 2 controls

  • UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10)
  • UAE-PDPL-Art.11_12_13_14_15_16 Data subject rights (UAE PDPL Articles 11-16)

GAMP 5 - Good Automated Manufacturing Practice · 2 controls

  • GAMP5-Lifecycle-VModel-URS-FS-DS-IQOQPQ V-Model Lifecycle - URS + FS + DS + IQ + OQ + PQ + Traceability
  • GAMP5-Risk-CriticalThinking Risk-Based Approach, Critical Thinking and 5 Key Concepts

ICAO Annex 17 - Aviation Security (AVSEC) · 2 controls

  • ICAO-ANX17-Chap1-Definitions-Scope-Chicago-Convention-AVSEC ICAO Annex 17 Chapter 1 - Definitions + Scope + Chicago Convention Article 37 + AVSEC Coverage
  • ICAO-ANX17-Chap3-QualityControl-Audits-Inspections-Tests-Certification-Training ICAO Annex 17 Chapter 3 - National Quality Control Programme + Audits + Inspections + Tests + Surveys + Certification + Aviation Security Training Programme (ASTP)

ICH Q10 - Pharmaceutical Quality System · 2 controls

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.4) · 2 controls

  • IMO-MSC-FAL-Identify-AssetInventory-ThreatsVulnerabilities-CyberRiskAssessment-RolesResponsibilities IMO MSC-FAL Identify Function - OT/IT Asset Inventory + Threats + Vulnerabilities + Cyber Risk Assessment + Roles and Responsibilities + Crew + CSO + DPA
  • IMO-MSC-FAL-Recover-BackupRestore-ContinuityOfNavigation-LessonsLearned-Drills IMO MSC-FAL Recover Function - Backup and Restore + Continuity of Navigation + Continuity of Cargo Operations + Continuity of Propulsion + Lessons Learned + Drills + Resilience

ITAR - International Traffic in Arms Regulations · 2 controls

  • ITAR-CompliancProgram-ICP-EmpoweredOfficial-Recordkeeping-5Years-Training-IT-Cloud-SupplyChain-Coord-EAR-OFAC-Wassenaar ITAR Compliance Program + Internal Compliance Program (ICP) + Empowered Official + 5-Year Recordkeeping + Training + IT/Cloud (GovCloud + Azure Gov + GCC High) + Supply Chain + Coord EAR + OFAC + Wassenaar + MTCR
  • ITAR-Scope-AECA-22USC2778-22CFR120-130-DDTC-USML-21Categories-DefenseArticle-Service-TechnicalData ITAR Scope + Arms Export Control Act (22 USC 2778) + 22 CFR Parts 120-130 + Directorate of Defense Trade Controls (DDTC) + United States Munitions List (USML) 21 Categories + Defense Article/Service/Technical Data Definitions

Israel Protection of Privacy Law (5741-1981) · 2 controls

  • IsraelPPL-Database-Registration-Definition-Document-Security-Level-Classification-Sec7-8-PPA-Registry Israel POPL Database Registration + Section 7 Database Definitions + Section 8 Registration Requirement + Database Definition Document + Security Level Classification + PPA Public Registry + Amendment 13 Threshold Changes
  • IsraelPPL-Scope-5741-1981-Knesset-Amendment13-March2024-BasicLaw-Dignity-Sec1-Right-Privacy Israel Protection of Privacy Law 5741-1981 Scope + Knesset + Amendment No. 13 March 2024 + Basic Law Human Dignity and Liberty + Section 1 Right to Privacy + Constitutional Status + Chapter 1 Infringement of Privacy

MTCS (Singapore) · 2 controls

  • MTCS-Governance-ISMS-Risk-HR-Lifecycle-Compliance-Cloud-Strategy-Roles-Responsibilities MTCS Governance + ISMS + Risk Management + HR Security + Cloud Service Lifecycle + Compliance + Roles
  • MTCS-Logging-Monitoring-Compliance-Audit-SLA-Configuration-SIEM-SOAR-Cloud-Monitoring-CSPM MTCS Logging + Monitoring + Compliance + Audit + SLA + Configuration + SIEM + SOAR + CSPM

NATO AQAP 2110 - Quality Assurance Requirements for Design, Development, and Production · 2 controls

  • AQAP2110-7 Production, Special Processes, Inspection, Testing, and Records
  • AQAP2110-8 Internal Audit, Management Review, Corrective Action, CofC, and Continual Improvement

NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding) · 2 controls

  • STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure
  • STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 2 controls

  • NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration
  • NISTSP82-7 OT Incident Response, Forensics, Recovery, and Continuity

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity · 2 controls

  • NRC7354-2 Critical Digital Asset (CDA) Identification, Scope, and Boundary
  • NRC7354-4 Security Controls Implementation per NRC RG 5.71 Appendix B/C

OWASP DevSecOps Maturity Model (DSOMM) · 2 controls

  • DSOMM-1 Culture, Organization, Education, and Governance
  • DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling

PCAOB AS 2201 - Audit of Internal Control Over Financial Reporting (ICFR) · 2 controls

  • ASTWO-7 Deficiency Evaluation, Material Weakness, and Communication
  • ASTWO-8 ICFR Opinion, Basis, Definition, Limitations, Combined vs Separate Reports

Pakistan Personal Data Protection Bill 2023 · 2 controls

  • PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO
  • PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training

FATF Recommendation 16 - Payment Transparency (Travel Rule) · 1 control

  • R.16-VATR.Unhosted Unhosted (self-hosted / non-custodial) wallet transfers - 2024 Targeted Update

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

  • FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2)

Florida Digital Bill of Rights (FDBR) · 1 control

  • FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704)

French Sapin II Law (Law No. 2016-1691) · 1 control

  • Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct

GLBA · 1 control

  • GLBA-Sec6801-PolicyDuty-SafeguardingStandard GLBA Section 6801 - Privacy Obligation Policy and Safeguarding Standard

GLI-33 - Gaming Laboratories International Event Wagering Systems · 1 control

  • GLI33-EventWagering-System-Architecture GLI-33 Event Wagering System Architecture, Wager Engine, Odds Engine and Risk Management

GLOBALG.A.P. Integrated Farm Assurance (IFA) Standard v6 · 1 control

  • GGAP-IFA-AllFarmBase-Mgmt-Workers-Env-Trace GLOBALG.A.P. IFA v6 All Farm Base (AF): Management, Workers, Environment, Traceability and Food Safety

German Supply Chain Due Diligence Act (LkSG) · 1 control

HKMA Cyber Resilience Assessment Framework (C-RAF) · 1 control

  • HKMA-CRAF-Domain1-2-Governance-Identification HKMA C-RAF Domain 1 (Governance) + Domain 2 (Identification) - Cyber Strategy, Risk Management, Asset Management, Threat Assessment

HKMA SPM · 1 control

  • HKMA-SPM-CG-IC-AC-Governance-Control-Audit HKMA SPM Corporate Governance (CG-1/2/3/5/6), Internal Control (IC-1/5), Auditing (AC-G)

IATA Operational Safety Audit (IOSA) Standards Manual · 1 control

  • IATA-IOSA-Section1-ORG-Organization-ManagementSystem-SMS IATA IOSA Section 1 - ORG Organization and Management System + Safety Management System (SMS) + Safety Policy + Hazard ID + Quality

ILO Declaration on Fundamental Principles and Rights at Work (Core Conventions) · 1 control

ISMAP (Japan) · 1 control

ITU Radio Regulations and Space Security Standards · 1 control

  • ITU-Scope-Constitution-Convention-Radio-Regulations-WRC-Quadrennial-Treaty-Art1-Definitions ITU Constitution + Convention + Radio Regulations Scope + Article 1 Definitions + Article 2 Nomenclature + WRC World Radiocommunication Conference Quadrennial Treaty Process + Member States + Sector Members

India Account Aggregator Framework (RBI) · 1 control

  • RBI-AA-Ecosystem-FIPs-FIUs-Interoperability-Onboarding-Sahamati-DPI-IndiaStack RBI AA Ecosystem - Financial Information Providers (FIPs) + Financial Information Users (FIUs) + Interoperability + Sahamati SRO Onboarding + DPI India Stack + Cross-Sector Regulators

Italy Personal Data Protection Code (Legislative Decree No. 196/2003, amended 2018) · 1 control

  • ItalyCodice-DataSubjectRights-Limitations-Deceased-Minors-14-Years-Italian-2undecies-2duodecies-2terdecies Italy Codice Data Subject Rights + Article 2-undecies Limitations + Article 2-duodecies Deceased Persons Rights + Article 2-terdecies Minors Rights (14 Years Consent Age) + GDPR Articles 15-22 + Italian Civil Procedure Remedies

MITRE ATT&CK · 1 control

MITRE D3FEND · 1 control

Monetary Authority of Singapore Technology Risk Management Guidelines · 1 control

  • MAS-TRM-Governance-Chapters-2-3-Board-Senior-Management-Risk-Framework-Information-Asset-Management MAS TRM Governance + Chapters 2-3 + Board + Senior Management + Risk Framework + Information Asset Management

NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205) · 1 control

  • PQC-4 FIPS 205 SLH-DSA Implementation - Stateless Hash-Based Digital Signature

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) · 1 control

  • NISTSP115-1 Scope, Methodology, and Assessment Planning

NIST SP 800-123 · 1 control

NIST SP 800-137 · 1 control

  • NISTSP137-1 ISCM Strategy, Governance, and Volatility Assessment

NIST SP 800-144 · 1 control

  • NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation

NIST SP 800-145 · 1 control

  • NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition

NIST SP 800-146 · 1 control

  • NISTSP146-1 Cloud Adoption Strategy, Workload Suitability, and Decision Framework

NIST SP 800-207 · 1 control

NIST SP 800-30 · 1 control

  • NISTSP30-8 Risk Assessment Maintenance, Continuous Monitoring, and Integration with the RMF

NIST SP 800-37 · 1 control

  • NISTSP37-7 RMF Monitor Step: Continuous Monitoring and Ongoing Authorisation

NIST SP 800-39 · 1 control

  • NISTSP39-5 Risk Monitoring: Effectiveness, Changes, Compliance, and Reassessment Triggers

NIST SP 800-61 Rev. 3 · 1 control

  • NISTSP61-2 Computer Security Incident Response Team (CSIRT) Structure and Staffing

NIST SP 800-63-4 · 1 control

  • NISTSP63R4-1 Digital Identity Risk Management and IAL/AAL/FAL Assurance Level Selection

NIST SP 800-88 · 1 control

  • NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework

NIST SP 800-92 · 1 control

  • NISTSP92-1 Log Management Programme, Policy, Roles, and Operational Runbooks

Nebraska Data Privacy Act · 1 control

  • NDPA-1 Applicability, Scope, and Carve-Outs

Notifiable Data Breaches Scheme (Australia) · 1 control

  • AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold

OCC Heightened Standards (12 CFR Part 30, Appendix D) · 1 control

  • OCCHS-1 Scope, Applicability, and Definitions of Heightened Standards

OSFI B-13 · 1 control

  • OSFIB13-1 Governance, Risk Management, and Three Lines of Defense

OWASP ASVS · 1 control

  • OWASPASVS-1 Architecture, Design and Threat Modelling (V1)

OWASP MASVS · 1 control

OWASP SAMM · 1 control

  • OWASPSAMM-1 Governance: Strategy, Policy, Compliance, Education, Champions

OWASP Top 10:2025 · 1 control

Open Banking Security · 1 control

  • OPENBANK-2 Strong Customer Authentication (SCA), Consent Lifecycle, and Customer UX

OpenSSF Scorecard · 1 control

  • OSSFSC-1 Branch Protection, Code Review, and Repository Governance

PSD2 SCA · 1 control

  • PSDTWO-1 Strong Customer Authentication (SCA) Core Requirements

PTES · 1 control

  • PTESPHASE-1 Pre-Engagement Interactions and Scoping

Philippines Cybercrime Prevention Act (RA 10175) · 1 control

  • PHILCC-1 Computer Crime Offences (Illegal Access, Interference, Misuse of Devices)

Protective Security Policy Framework (PSPF) Release 2026 · 1 control

  • PSPF24-1 Security Culture, Governance, Risk Management

Regulation on the European Health Data Space (EHDS) · 1 control

  • EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29)

SA8000:2014 - Social Accountability Standard · 1 control

  • SAEIGHT-7 Management System, Worker Engagement, Continuous Improvement

SIG (Shared Assessments) · 1 control

  • SHAREASSESS-1 Information Governance and Risk

SLSA · 1 control

  • SUPCHAIN-1 Build Integrity - Source, Build, Provenance

South Korea PIPA · 1 control

  • PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 115 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SWIFT CSCF controls