SWIFT CSCF and a DORA Register of Information Built in ServiceNow for a Transaction Bank
A DORA register generated straight from ServiceNow vendor records and filed on time, plus an independent CSCF assessment with no open findings.
Client name withheld by agreement- Client
- Transaction banking subsidiary of a regional bank, with an Irish branch
- Region
- Jersey City, New Jersey and Dublin, Ireland
- Year
- 2025
- Duration
- 18 weeks
- Scope
- 1 SWIFT secure zone · 74 critical ICT services · 168 ICT providers in ServiceNow
- Practice
- Financial Services
The challenge
What was at stake.
The transaction banking subsidiary of a regional bank sends cash management and trade finance payments through a SWIFT secure zone in Jersey City, and serves its European corporate clients through a branch in Dublin. Its CSCF attestation depended on one control owner who had since left, and much of the evidence had lived in his inbox.
DORA applied from January 2025, and the Central Bank of Ireland expected the first register of information within weeks. Vendor data was spread across a procurement tool, contract PDFs and a ServiceNow instance used only for IT tickets, and none of it recorded which provider supported which critical function.
What we did
The approach, step by step.
- 01
Vendor records moved into ServiceNow
We configured ServiceNow Third-party Risk Management to hold all 168 ICT providers, linked each one to the business services in the CMDB, and made the DORA data points mandatory fields on every contract record.
- 02
Critical functions mapped to services
Treasury, payments operations and trade finance named 74 ICT services that support critical or important functions, each with an owner, an impact tolerance and the providers it depends on.
- 03
Register produced, not compiled
A scheduled export builds the register of information in the supervisor’s template directly from ServiceNow, so a contract change reaches the register the same day.
- 04
Secure zone controls evidenced
Operator jump hosts, MFA, session logging and software integrity checks were tested, and every CSCF control now has a ServiceNow control record with attached evidence and a named owner.
- 05
Incident classification in the ITSM flow
Major incident tickets now prompt for the DORA classification criteria, so the initial notification clock starts from the ticket rather than from someone remembering to check.
Outcomes
What changed, in numbers.
- 0
- open findings from the independent CSCF assessor
- 168
- ICT providers in one ServiceNow register
- 74
- critical ICT services with impact tolerances
- Same day
- register updates after a contract change
The register used to be a project. Now it is a report we run.
Services delivered
Related engagements
More work in Financial Services.
-
Philadelphia, Pennsylvania · 14 weeks
Financial Services · 2025PCI DSS Service Provider Assessment for a Property-Management Payment FacilitatorA first Level 1 service provider Report on Compliance, with every future-dated 4.0.1 requirement in place on the day enforcement began.
-
Hartford, Connecticut · 13 weeks
Offensive Security & Resilience · 2024Cyber Continuity and Enterprise Risk for a Mutual Property InsurerClaims kept moving through a simulated ransomware attack during a hurricane surge, and cyber risk now reports to the board against a stated appetite.
-
Allentown, Pennsylvania · 14 weeks
Offensive Security & Resilience · 2026 · OngoingVulnerability Response in ServiceNow for a Member-Owned Credit UnionEvery critical vulnerability now has an owner from the CMDB and a fix scheduled through change control, and the overdue backlog is down 88%.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.