Messaging Security and Operational Resilience for a Custody Bank
A clean independent CSCF assessment and a DORA register the Luxembourg supervisor accepted on first submission.
Client name withheld by agreement- Client
- Custody and trust bank, $210B under custody
- Region
- Dallas, Texas and Luxembourg
- Year
- 2024
- Duration
- 20 weeks
- Scope
- 2 SWIFT secure zones · 96 critical ICT services · 210 ICT providers
- Practice
- Financial Services
The challenge
What was at stake.
A custody and trust bank with $210 billion under custody runs settlement instructions for pension funds and asset managers through two SWIFT secure zones, one in Dallas and one serving its Luxembourg entity. Its last CSCF cycle had passed on a self-assessment that the new independent assessor would not accept.
At the same time the Luxembourg supervisor set a date for the first DORA register of information. The bank had 210 ICT providers on contract and no single list of which ones supported which critical function.
What we did
The approach, step by step.
- 01
Critical functions defined first
We worked with operations, treasury and fund accounting to name 96 ICT services that support critical or important functions, each with an owner and a maximum tolerable outage.
- 02
Secure zones rebuilt to the framework
Jump servers, operator workstations and the messaging interface were separated from general IT, with hardware-backed MFA and session recording on every operator login.
- 03
Provider register from the contracts up
We read 210 provider agreements, extracted the DORA data points and loaded them into a register that procurement now updates as part of every renewal.
- 04
Assessor walkthrough rehearsed
Every CSCF control had evidence, a named owner and a rehearsed explanation before the independent assessor arrived on site.
- 05
Exit plans that would work
For the six providers the bank could least afford to lose, we wrote and tested exit and substitution plans with realistic timelines.
Outcomes
What changed, in numbers.
- 0
- CSCF findings from the independent assessor
- 96
- critical ICT services with defined tolerances
- 210
- ICT providers in one register of information
- 1st
- submission accepted by the supervisor
We stopped treating SWIFT and DORA as two audits and started running one resilience program. The assessor noticed.
Services delivered
Related engagements
More work in Financial Services.
-
Kansas City, Missouri · 16 weeks
Financial Services · 2024PCI DSS Scope Reduction for a Fleet Fuel-Card IssuerIn-scope systems cut from 780 to 214, and a Report on Compliance signed with no requirement marked Not in Place.
-
Plano, Texas · 11 weeks
Offensive Security & Resilience · 2024Cyber Crisis and Continuity Readiness for a Mortgage ServicerBorrower payments kept posting in a simulated loss of the servicing platform, with every decision owner named in advance.
-
San Antonio, Texas · 14 weeks
Offensive Security & Resilience · 2024Vulnerability Management Rebuild for an Independent Broker-DealerOverdue critical vulnerabilities taken from 1,140 to 37, with advisor laptops finally inside the program.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.