As a SWIFT CSP Certified Assessor, my external cybersecurity certification (example: CISA) has expired.

The SWIFT CSP Assessor certification program, governed by the "Independent Assessment Process for Assessors Guidelines" and related documents, requires assessors to maintain relevant professional qualifications. Let’s evaluate:

•Option A: No, a valid external cybersecurity certification is mandatory to keep the CSP Certified Assessor certification

This is correct. The SWIFT CSP Assessor certification requires assessors to hold a valid external cybersecurity certification (e.g., CISA, CISSP) as a prerequisite for initial certification and ongoing eligibility. The "Independent Assessment Process for Assessors Guidelines" specifies that expiration of this certification invalidates the CSP Assessor status until renewed, ensuring assessors maintain current expertise.

•Option B: Yes, if the SWIFT CSP Assessor certification is still valid

This is incorrect. The validity of the CSP Assessor certification is contingent on maintaining an active external cybersecurity certification. The "Independent Assessment Framework" and "Assessment template for Mandatory controls" emphasize this dual requirement to uphold assessment quality.

Summary of Correct Answer:

A valid external cybersecurity certification is mandatory; an expired certification disqualifies the assessor (A).

References to SWIFT Customer Security Programme Documents:

•Independent Assessment Process for Assessors Guidelines: Requires active external certification.

•Independent Assessment Framework: Links assessor eligibility to professional credentials.

•CSP_controls_matrix_and_high_test_plan_2025: Validates assessor qualifications.

========