Briefing
The FFIEC Cybersecurity Assessment Tool, released in June 2015, was retired on August 31, 2025, following an announcement on August 29, 2024. The FFIEC pointed institutions to NIST CSF 2.0 and CISA's Cybersecurity Performance Goals. The Federal Reserve's SR 24-7 also names the Cyber Risk Institute Profile and CIS Critical Security Controls.
The FFIEC endorses no particular tool. Whatever you use must support an effective control environment and fit your risk. Examiners remain risk focused.
NIST released CSF 2.0 on February 26, 2024, with added emphasis on governance and supply chain risk.
What to do
- Select a primary framework and, if useful, a sector profile alongside it.
- Map current policies and controls to the framework once, starting from existing documents.
- Identify gaps and assign owners and dates.
- Set an evidence calendar: access reviews, patch reports, configuration exports and backup tests at fixed intervals.
- Change board reporting from maturity labels to current risk, actively exploited exposures, and provable controls.
How to verify
- No current policy or board deck should reference the CAT as the program standard.
- Each mapped control should link to at least one dated piece of evidence.
- Audit should be performed by a party independent of the IT operator.
Sources
- OCC Bulletin 2024-25, FFIEC Cybersecurity Assessment Tool sunset statement
- Federal Reserve SR 24-7, FFIEC CAT sunset statement
- NIST, NIST Releases Version 2.0 of Cybersecurity Framework, Feb 26, 2024
- CISA, Cybersecurity Performance Goals 2.0
- FFIEC IT Examination Handbook, Audit booklet: Outsourcing Internal IT Audit
Want help putting this in place? Contact Computer Plus.