SWIFT CSP Independent Assessment

The Oregon State Treasury is soliciting proposals from qualified and SWIFT-certified independent assessors to perform a SWIFT Customer Security Programme (CSP) Independent Assessment, with proposals due September 11, 2026 at 12:00 PM Pacific Time. SWIFT CSP Certified Assessor status in the official SWIFT CSP Certified Assessors Directory is a mandatory qualification requirement at proposal submission and throughout the contract term.

The scope comprises a comprehensive assessment of the Treasury's compliance with mandatory controls defined in the SWIFT Customer Security Controls Framework (CSCF), including governance, logical access, network and perimeter security, incident response, and vendor oversight, with appropriate reliance on third-party attestations from BlackRock Aladdin for controls within that platform's operational responsibility. Deliverables are a formal assessment report and a SWIFT-required signed Completion Letter.

Additional minimum qualifications include current SWIFT CSP Assessor Certifications for the proposed lead assessor, completion of at least two SWIFT CSP Independent Assessments within the last 24 months, demonstrated experience assessing organizations utilizing third-party shared service platforms such as BlackRock Aladdin, and organizational independence in accordance with SWIFT's Independent Assessment Framework.

The contract will be awarded as a single entity with an initial term through December 31, 2028, with the option to renew in two-year increments. Contract value is not-to-exceed and subject to negotiation; no specific estimate is stated. The Treasury requires Professional Liability coverage of $1,000,000 per occurrence and $2,000,000 aggregate, and Commercial General Liability of $1,000,000 per occurrence and $2,000,000 aggregate.

Evaluation is based on a 250-point scale: assessor qualifications (50 points), experience with SWIFT CSP assessments (50 points), assessment methodology and approach (40 points), project plan and timeline (30 points), experience with Architecture B assessments (20 points), references and past performance (10 points), and price proposal (50 points). Price proposals are scored competitively with the lowest bid receiving 50 points, the second lowest 40 points, the third lowest 30 points, and the fourth lowest 20 points; remaining proposals receive no points.

Questions are due August 21, 2026 at 12:00 PM Pacific Time, with answers provided by August 28, 2026. Presentations or interviews are tentatively scheduled for the weeks of September 21 and/or September 28, 2026. Notice of Intent to Award is anticipated around October 5, 2026. Proposals must not exceed 20 pages (excluding cover page and exhibits). A seven-calendar-day protest period applies both before the request close date and after the Notice of Intent to Award is issued.