Examiner-ready. Board-ready.
Banks, credit unions and financial firms answer to examiners, boards and customers who all expect proof. We assess your cybersecurity risk and your compliance in business terms, so your board sees a clear picture and your examiners see a real program. We currently support a large regional bank.
- Standards
- GLBA, FFIEC, NYDFS, PCI DSS
- Framework
- NIST CSF 2.0
- Experience
- Dozens of banking clients
- You leave with
- A ranked plan, not a binder
What financial institutions are up against
Why financial security is different.
Every finding has an examiner, a board and a customer behind it.
- Exam pressureExaminers expecting a documented, risk-based program.
- After the CATThe FFIEC Cybersecurity Assessment Tool was retired in 2025, and many institutions need a new way to measure maturity.
- Fraud and account takeoverBusiness email compromise, wire fraud and stolen credentials.
- Third-party riskCore processors, fintech partners and cloud services holding customer data.
- Board oversightDirectors who must understand and approve cybersecurity risk.
What is changing
The FFIEC CAT is retired. Banks and credit unions now need a framework crosswalk to NIST CSF 2.0 or the CRI Profile. See how we map your program and rank the gaps.
NYDFS now requires MFA everywhere and a formal asset inventory. Sections 500.12 and 500.13 took effect November 1, 2025. See how our data governance process builds the inventory.
Standards we assess against
The standards you answer to.
We assess against the rules that apply to your institution, map them to each other, and score every gap the same way.
GLBA
Safeguarding customer information, with a written security program and risk assessment.
FFIEC guidance
The IT Examination Handbook and related guidance your examiners work from.
NIST CSF 2.0
The framework many institutions are adopting in place of the retired FFIEC CAT.
NYDFS Part 500
New York's cybersecurity regulation for financial services companies.
PCI DSS
Protecting card data for issuers, processors and merchants.
SEC Regulation S-P
Safeguarding customer information and notifying customers of incidents, for broker-dealers and investment advisers.
How we work in financial services
Speak the examiner's language. And the board's.
Examiners want a documented, risk-based program. Boards want to know what it means for the institution. We build both on your risk methodology, so the same findings satisfy the exam and drive the budget.
Exam-ready
Documented the way examiners expect.
Risk assessments, policies and evidence organized around the guidance your examiners use.
Mapped
One program, several rulebooks.
GLBA, FFIEC guidance and NIST CSF mapped together, so one control can satisfy all of them.
Board-ready
Clear for directors.
Cybersecurity risk reported in business terms your board can oversee and approve.
How we help
Services financial services teams use most.
Runs on one risk language
Scored with your methodology.
Every finding is scored the same way as the rest of your program. Already have a methodology? We use it. If not, we build it with you first, in a single workshop.
How we build a risk methodology →Questions
What people ask us.
What replaces the FFIEC Cybersecurity Assessment Tool?
The FFIEC retired the CAT in 2025 and pointed institutions to frameworks such as NIST CSF 2.0. We help you move your assessment to NIST CSF 2.0 and keep it tied to your own risk methodology.
Do you work with credit unions as well as banks?
Yes. The approach is the same: a documented, risk-based program your examiners can follow and your board can oversee.
Can you help us prepare for an exam?
Yes. We review your program against the guidance your examiners use, close the gaps and organize the evidence before they arrive.
Can you present to our board?
Yes. We take our findings to your board with you, in business terms directors can act on.
How do we get started?
Tell us which standards you answer to and what you already have. We scope the work around that, starting with a short call.