The SWIFT HSM Box must be hardened at the system level by the SWIFT user...

The Hardware Security Module (HSM) Box is a critical component for managing cryptographic keys in the SWIFT environment. Hardening at the system level involves securing the HSM’s operating system and configuration against vulnerabilities. Let’s evaluate:

•CSCF Control "2.3 System Hardening" mandates that all SWIFT-related systems, including the HSM Box, be hardened to reduce the attack surface. This is the responsibility of the SWIFT user owning the equipment, as outlined in the "Swift Customer Security Controls Framework v2025."

•The "Assessment template for Mandatory controls" requires users to demonstrate hardening of owned HSMs, including patching, disabling unused services, and enforcing access controls.

•If the HSM is owned by the user (e.g., in an on-premises A1 or A2 architecture), the user must perform hardening. This differs from cloud deployments (e.g., A4), where the provider may handle it, but the question specifies user-owned equipment.

Summary of Correct Answer:

The SWIFT user owning the HSM Box must harden it at the system level (TRUE).

References to SWIFT Customer Security Programme Documents:

•Swift Customer Security Controls Framework v2025: Control 2.3 requires system hardening.

•Assessment template for Mandatory controls: Specifies user responsibility for owned HSMs.

•CSP_controls_matrix_and_high_test_plan_2025: Includes HSM hardening in assessments.