FFIEC Cybersecurity Guidance Guide: Handbooks, Assessments and Expectations

US banks, savings associations and credit unions are examined against FFIEC cybersecurity expectations, but the Cybersecurity Assessment Tool many of them used to measure themselves was retired on 31 August 2025. Examiners still use the FFIEC IT Examination Handbook, and institutions still need a defensible way to show their controls match their risk. This guide explains what the FFIEC publishes, which booklets and statements matter for cybersecurity, what the 2021 authentication guidance asks of user, privileged and service account access, how to replace the CAT with NIST CSF 2.0 or another framework, and what evidence examiners expect. It is written for CISOs, IT risk managers, internal auditors and technology service providers to US financial institutions.

Key takeaways

• The CAT is gone, the expectations are not. The FFIEC sunset the Cybersecurity Assessment Tool on 31 August 2025 and pointed institutions to NIST CSF 2.0, the CISA Cybersecurity Performance Goals and industry resources such as the CRI Profile and CIS Controls.
• The IT Handbook is the examiner's reference. Booklets such as Information Security, Architecture, Infrastructure, and Operations, and Development, Acquisition, and Maintenance describe what examiners review; they do not create new legal requirements on their own.
• Authentication guidance covers machines too. The 2021 Authentication and Access guidance applies to customers, employees, third parties and service accounts, and expects risk-based MFA or controls of equivalent strength.
• No tool is endorsed. The FFIEC says it does not endorse any self-assessment tool and that such tools are not examination programs, so the choice of framework is yours, but you must be able to defend it.
• Evidence beats scores. Examiners take a risk-focused approach and may look at areas no tool covers, so a maturity score without supporting evidence will not carry an examination.

What it is and who it applies to

The Federal Financial Institutions Examination Council (FFIEC) is an interagency body whose members include the Federal Reserve, FDIC, OCC, NCUA, CFPB and a State Liaison Committee. It writes uniform examination principles and guidance; the member agencies issue and enforce them through their own supervisory letters, such as OCC bulletins, Federal Reserve SR letters and FDIC Financial Institution Letters.

• Who: institutions supervised by FFIEC member agencies: national banks and federal savings associations, state member and non-member banks, federally insured credit unions, and bank holding companies. The SR letter for the 2024 Development, Acquisition, and Maintenance booklet notes it applies to all Federal Reserve supervised entities, including those with $10 billion or less in assets.
• Technology service providers: core processors and other significant service providers are examined directly under the Supervision of Technology Service Providers booklet, and FDIC letters are distributed to service providers as well as banks.
• Legal basis: FFIEC guidance is not itself a regulation. The binding security obligations come from statute and rules such as the GLBA Interagency Guidelines Establishing Information Security Standards; the Handbook explains how examiners assess them. See the GLBA Safeguards Rule Guide.
• Overlap with state rules: New York chartered and licensed entities also face the prescriptive requirements in the NYDFS Part 500 Guide, and public companies the SEC Cybersecurity Disclosure Rules Guide.

Structure and key requirements

FFIEC cybersecurity expectations live in three kinds of document: the IT Examination Handbook booklets, standalone guidance statements, and supporting resources. The table lists the ones most relevant to a cybersecurity programme.

Both 2021 and 2024 booklet announcements state that the booklets do not impose new requirements on examined entities: they describe the practices examiners review. In practice, an Information Security examination tests whether the institution has a risk-based programme approved by the board, an accurate inventory, controls proportionate to its risk assessment, monitoring that detects and escalates events, and independent testing.

The CAT sunset in detail

• Announcement: FFIEC statement of August 2024, issued by the OCC as Bulletin 2024-25 on 29 August 2024.
• Reason: the FFIEC considered the CAT's fundamental controls sound but chose not to update it given newer government and industry resources.
• Named alternatives: NIST CSF 2.0; CISA Cross-Sector Cybersecurity Performance Goals (released 2023) and sector-specific CPGs for financial services that CISA said it would publish; and industry resources such as the CRI Profile and CIS Critical Security Controls.
• Credit unions: the NCUA continues to support voluntary use of its Automated Cybersecurity Examination Toolbox (ACET), which derives from the CAT.

Identity and NHI requirements

The 2021 Authentication and Access guidance is the most directly relevant FFIEC document for identity teams. It replaced the internet banking guidance of 2005 and 2011 and widened scope from customer login to everyone and everything that accesses institution systems. The FDIC's summary names service accounts explicitly alongside customers, employees and third parties.

• Risk assessment drives the control: the guidance treats the institution's risk assessment as critical for choosing access and authentication practices. Inventory user types, access paths and the transactions each can perform before choosing controls.
• MFA or equivalent strength: MFA, or controls of equivalent strength, for higher-risk users and transactions, including remote access, privileged access and high-value customer payments. Phishing-resistant authenticators are the strongest option. See the Phishing-Resistant MFA Guide.
• Layered security: the guidance supports layered security and highlights the weakness of single-factor authentication, particularly where push payment capabilities increase fraud exposure. See the Authorised Push Payment (APP) Fraud Guide.
• Service accounts and system-to-system access: these cannot use interactive MFA, so equivalent strength means vaulted credentials, short-lived tokens or certificates, network restrictions, least privilege and monitoring for interactive use. See the Service Account Security Guide.
• Privileged users: administrator and database accounts need stronger authentication, session controls and review. See the Privileged Access Management Guide.
• Third parties: vendor and service provider access should be authenticated and monitored to the same standard as staff, and terminated when contracts end. See the Third-Party Access Guide.

Implementation steps

With the CAT retired, most institutions need to pick a replacement baseline and rebuild their self-assessment around it. A practical sequence:

1. Choose the baseline: NIST CSF 2.0 is the most widely accepted choice and adds the Govern function that the CAT lacked. The CRI Profile extends CSF with financial sector diagnostic statements. Smaller institutions may start from the CISA CPGs or CIS Controls Implementation Group 1 and grow. See the NIST CSF 2.0 Guide.
2. Crosswalk the old CAT results: map previous CAT domain and maturity results to the new framework so the board sees continuity, and record where the new framework asks for more (governance, supply chain, identity).
3. Refresh the risk assessment: update asset, data and access inventories, including service accounts, APIs and third-party connections, and record inherent risk drivers such as products, delivery channels and technology footprint.
4. Set target profiles: define a target tier or profile per function based on risk appetite, with board approval, then record the gaps.
5. Remediate in priority order: identity and access (MFA, privileged access, service account hygiene), asset and vulnerability management, logging and detection, then resilience and recovery testing.
6. Test and validate: use internal audit or an external party to test a sample of controls each year, and run tabletop exercises for ransomware and third-party outages.
7. Report and iterate: report progress against the target profile to the board at least annually and before each examination.

Crosswalk from the CAT domains

The CAT assessed an inherent risk profile and then maturity across five domains, on a scale from Baseline through Evolving, Intermediate and Advanced to Innovative. Mapping each domain to its nearest CSF 2.0 functions keeps historical results usable.

Rollback and testing: run the old and new assessments side by side for one cycle, so that if the new baseline produces gaps the board cannot yet interpret, the prior CAT results remain the reference point until the crosswalk is accepted.

Small versus large institutions: a community bank relying on a core processor can focus on governance, vendor oversight, identity and incident response, and borrow assurance from the processor's reports. A large or complex institution is expected to show an enterprise programme with a full CSF or CRI Profile assessment, threat-informed testing and metrics for each line of defence.

Evidence and assessment

Examiners use the Handbook work programmes, and the CAT sunset statement reminds institutions that examiners may address areas that a self-assessment tool does not cover. Evidence that typically satisfies an Information Security review:

• Governance: board-approved information security programme, risk appetite, annual report to the board, and minutes showing challenge.
• Risk assessment: documented inherent risk, control assessment against the chosen framework, and a remediation plan with owners and dates.
• Identity: MFA coverage reports, privileged account inventory and recertification, service account inventory with owners and rotation evidence, and third-party access reviews.
• Operations: vulnerability scan and patch metrics, log source coverage, alert triage records and incident tickets.
• Assurance: internal audit reports, penetration test results and closure evidence, and service provider SOC reports reviewed with complementary user entity controls checked. See the SOC 2 Guide.

KPIs that work well in board reporting: percentage of remote, privileged and customer high-risk access protected by MFA; number of service accounts without a named owner; percentage of critical vulnerabilities remediated within policy; percentage of log sources from critical systems feeding monitoring; open audit and examination findings past due; and the number of critical vendors with a current security review.

Mapping to other frameworks

The CISA CPGs are aligned to the CSF functions, and CISA says it is updating them to CSF 2.0, which makes a CSF-based programme the simplest way to cover several of the FFIEC's named alternatives at once. See the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) Guide and the CIS Controls Guide.

Common pitfalls

• Still running the CAT spreadsheet: treating an unsupported, withdrawn tool as the programme baseline. It can inform a crosswalk but should not be the current self-assessment.
• Score without evidence: reporting a CSF tier or maturity level to the board with no test results behind it. Examiners test controls, not scores.
• MFA for staff, not for machines: enforcing MFA on users while service accounts with domain or database rights keep static passwords. The guidance names service accounts, and stolen credentials without MFA unlocked many customer environments in the Snowflake breach.
• Remote access gaps: a single legacy remote access portal or vendor account without MFA, the entry point in the Change Healthcare breach.
• Relying on the core processor's report alone: accepting a SOC report without checking the complementary controls the institution itself must operate.
• Booklets read as checklists: copying Handbook work programme steps into policy without tying them to the institution's own risk assessment.

Practitioner checklist

• Record which framework replaced the CAT, why, and the board approval date.
• Crosswalk the last CAT assessment to the new framework and keep it on file for examiners.
• Update the risk assessment to include service accounts, APIs and third-party connections.
• Confirm MFA, or documented equivalent controls, for remote, privileged, third-party and high-risk customer access.
• Inventory service accounts with owners, privileges and rotation dates, and block interactive logon where possible.
• Map controls to the Information Security, AIO and DA&M booklets and keep the mapping current when booklets are revised.
• Review critical service provider SOC reports and test complementary user entity controls.
• Report target versus current profile and KPI trends to the board at least annually.

Standards and references

• OCC: Bulletin 2024-25, FFIEC Cybersecurity Assessment Tool Sunset Statement
• FFIEC: Cybersecurity Awareness resources
• FDIC: FIL-55-2021, Authentication and Access to Financial Institution Services and Systems
• FDIC: FIL-47-2021, Architecture, Infrastructure, and Operations booklet
• Federal Reserve: SR 24-6, Development, Acquisition, and Maintenance booklet
• NIST: Cybersecurity Framework 2.0
• CISA: Cross-Sector Cybersecurity Performance Goals
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: NIST CSF 2.0 Guide · GLBA Safeguards Rule Guide · NYDFS Part 500 Guide · Financial Services Identity Security Guide · SWIFT Customer Security Programme (CSP) Guide. This guide summarises FFIEC cybersecurity guidance and is not legal advice.