ARMB Action Memo - Procurement for SWIFT Assessment - Approved_6.10.2026.pdf

ALASKA RETIREMENT MANAGEMENT BOARD

SUBJECT:

DATE:

ARMB SWIFT Assessment Procurement

June 10-11, 2026

ACTION:

INFORMATION:

X

BACKGROUND:

SWIFT (Society for Worldwide Interbank Financial Telecommunication) provides the secure, global messaging infrastructure used for trading, enabling financial institutions to send and receive standardized instructions for securities trading and settlement. In 2021, SWIFT mandated annual independent assessments of all users to verify compliance with the SWIFT Customer Security Controls Framework (CSCF), a set of security controls protecting financial messaging systems, ensuring they are protected against cyberthreats, conducted by internal or external qualified independent assessors.

Since 2020, the annual assessment has been performed by Scott Jones (Head of Operations) and Grant Ficek (Investment Data Analyst), both of whom hold the credentials and experience required by SWIFT. If an annual independent assessment is not performed, or the assessment shows failure to meet the required security controls, we could be flagged as non-compliant in the system resulting in frozen transactions or the inability to use the SWIFT system.

STATUS:

The assessment period for calendar year 2026 begins on July 1. The upcoming departures of Mr. Jones and Mr.

Ficek will result in a significant loss of capacity, as well as the credentials and independence needed to perform the assessment internally. Due to this loss and the time-sensitive nature of the requirement, staff contacted two firms known to possess the necessary cybersecurity assessment credentials and prior experience with the State. KPMG was the only respondent and confirmed they have the capacity to complete the assessment within the required timeframe. KPMG quoted a fee of $45,000-$55,000 for the initial full-scope assessment, with lower fees in the subsequent year should the assessment meet SWIFT’s criteria for a delta assessment, which is a limited-scope review allowed only once between full, biennial assessments.

AUTHORITY:

AS 37.10.240(a) authorizes the Board to “adopt regulations required by AS 36.30.015(f) relating to procurement” and to govern the procurement of professional services including methods designed to address emergency and extraordinary circumstances.

Under 15 AAC 112.160, the Board is authorized to award contracts on a sole-source basis when it determines that such an award is in the best interest of the beneficiaries of the pension funds and when circumstances warrant it, including situations requiring specialized expertise to perform a particular professional service.

SOLE SOURCE JUSTIFICATION:

A sole source procurement for the SWIFT assessment is in the best interests of the beneficiaries because:

• The loss of the internal assessors creates an immediate deficiency in both capacity and required qualifications.

• The assessment must be completed before SWIFT’s December 31, 2026, deadline to avoid significant operational and financial risk.

• KPMG possesses the specialized expertise required under 15 AAC 112.160(d)(6), has existing knowledge of ARMB operations through prior audit engagements, and can meet the deadline.

• The quoted fee is reasonable for the scope and timeframe.

Consistent with 15 AAC 112.160(a), staff will issue a public notice of the Board’s intent to award a sole source contract to ensure that no other qualified entities are reasonably available to perform the assessment within the required parameters. Given current circumstances, including mandates established under Administrative Order No.

358, staff recommend proceeding with a sole source procurement for the 2026 SWIFT assessment, and two optional one-year extensions to provide flexibility as we evaluate staff capacity and progress in obtaining the necessary credentials for future assessments.

RECOMMENDATION:

The Alaska Retirement Management Board direct staff to pursue a sole source procurement with KPMG to perform the SWIFT Assessment for calendar year 2026, with up to two optional one-year extensions at staff's discretion, pursuant to 15 AAC 112.160. Pending successful contract negotiations, the total contract amount shall not exceed $150,000.

This action was unanimously approved by the Alaska Retirement Management Board via a roll call vote on June 10, 2026.