The FFIEC CAT is retired. Can you show examiners what replaced it?
The FFIEC retired its Cybersecurity Assessment Tool on August 31, 2025, pointing institutions to resources including NIST CSF 2.0, the CRI Profile, CISA's Cybersecurity Performance Goals and the CIS Controls. CyberRisk One helps community banks and credit unions choose a framework, crosswalk the program you already have to it, and rank the gaps with a risk methodology built for your institution. You leave with a documented framework mapping and a prioritized plan for leadership, the board and your examiners.
- Retired
- August 31, 2025
- Move to
- NIST CSF 2.0, CRI Profile or CIS Controls
- We deliver
- A documented framework crosswalk
- Gaps ranked by
- Your risk, not a maturity score
What changed
A ten-year habit, gone overnight.
For a decade the CAT gave institutions a ready-made way to measure cybersecurity maturity. Now each institution has to choose its own framework and show its work.
- No ready-made toolNIST CSF 2.0 is a framework, not an assessment. Someone has to build the assessment on top of it.
- Which framework?The FFIEC pointed to NIST CSF 2.0, CISA's Cybersecurity Performance Goals, the CRI Profile and the CIS Controls. The right choice depends on your size, complexity and existing program.
- Years of CAT workInherent risk profiles, declarative statements and maturity results that do not map one to one to the new frameworks.
- Obligations remainGLBA safeguards and the FFIEC IT Examination Handbook did not retire with the tool.
- Boards need a new storyDirectors used to CAT maturity levels need a new way to see progress.
The frameworks
Where institutions are moving.
The FFIEC chose not to update the CAT and pointed institutions to these resources. We help you pick the one that fits your size and complexity, then map to it.
NIST CSF 2.0
A widely used framework for organizing and communicating cybersecurity outcomes, with a new Govern function for oversight and accountability.
CRI Profile
The Cyber Risk Institute's profile built for financial institutions, mapped to NIST CSF and to regulatory expectations.
CISA CPGs
CISA's Cybersecurity Performance Goals: a practical baseline of high-impact controls.
CIS Controls
A prioritized set of technical safeguards, useful for smaller institutions and as an implementation layer.
FFIEC IT Handbook
Still the guide examiners work from, alongside whichever framework you choose.
GLBA
Safeguarding customer information remains the legal foundation under every framework.
How we help
Map it once. Rank it by risk.
A framework mapping is only useful when it leads to action. We score every gap with a risk methodology built for your institution, so the crosswalk connects framework requirements to business impact, control priorities and what to fund first, with a clear, documented line from risk to control. We currently support a large regional bank, and bring the same senior team to community banks and credit unions.
Credit unions
A mapping you can stand behind.
We crosswalk your existing program to NIST CSF 2.0 or the CRI Profile, so the work you did under the CAT carries forward and the gaps are clear.
Banks
The right framework for your size.
We help you choose between NIST CSF 2.0 and the CRI Profile, map your controls to it and prepare the story for your examiners.
Boards
A new way to show progress.
Results reported in business terms directors can oversee, replacing CAT maturity levels with risk your board can act on.
How it works
From CAT to a documented framework.
A focused engagement that starts from what you already have.
- 01
Set your risk methodology
One workshop with your leaders defines impact, likelihood and risk appetite in business terms. Ready in less than a week, and used to score everything that follows.
- 02
Choose the framework
We compare NIST CSF 2.0, the CRI Profile, CISA's Cybersecurity Performance Goals and the CIS Controls against your size, complexity and existing program.
- 03
Crosswalk what you have
Your policies, controls and past CAT results mapped to the new framework, requirement by requirement.
- Inherent risk profile carried forward
- Existing evidence reused
- 04
Assess the gaps
Interviews and evidence review to confirm what is in place, partial or missing.
- 05
Rank by risk
Every gap scored with your risk methodology, so the list becomes an order of work.
- 06
Document for examiners
A clear record of the framework you chose, why, and how your program maps to it.
- 07
Report to the board
A plain-language summary of where you stand and what comes next.
How we help
Services that support the move.
Runs on one risk language
Scored with your methodology.
Every finding is scored the same way as the rest of your program. Already have a methodology? We use it. If not, we build it with you first, in a single workshop.
How we build a risk methodology →Questions
What people ask us.
What replaced the FFIEC Cybersecurity Assessment Tool?
Nothing replaced it directly. The FFIEC retired the CAT on August 31, 2025 and pointed institutions to existing resources, including NIST CSF 2.0, CISA's Cybersecurity Performance Goals, the CRI Profile and the CIS Controls.
Do we still need to assess our cybersecurity program?
Retiring the CAT did not change the underlying obligations, such as the GLBA safeguards and the guidance in the FFIEC IT Examination Handbook. A documented framework mapping is a clear way to show how your program meets them and where the gaps are.
Should we use NIST CSF 2.0 or the CRI Profile?
NIST CSF 2.0 is the broadest and most widely adopted. The CRI Profile was built for financial institutions and includes regulatory mappings. We help you choose based on your size, complexity and what your examiners expect.
Can we reuse the work we did under the CAT?
Yes. We map your existing controls, policies and evidence across to the new framework, so you only build what is actually missing.
How long does it take?
It depends on your size and how much documentation you already have. Most of the work is mapping what exists, which goes quickly when your program is already organized.