Financial institutions answer the same cybersecurity questions for many regulators, auditors and customers, and without a common control set every assessment starts from scratch. The CRI Profile, maintained by the Cyber Risk Institute, is the financial sector's extension of the NIST Cybersecurity Framework: a set of diagnostic statements mapped to sector regulations, scaled by an impact tier, that institutions use for self-assessment, examinations and third-party due diligence. This guide explains how the Profile is structured, how tiering works, how to run an assessment, what it means for service accounts, API credentials and AI agents, and how it maps to NIST SP 800-53, DORA and MITRE ATT&CK. It is for CISOs, GRC teams and internal audit at banks, insurers, payments and market infrastructure firms, and for vendors that serve them. Facts are from the Cyber Risk Institute and FFIEC sites, checked on 27 October 2026.
Key takeaways
- It is the sector's CSF. CRI describes the Profile as based on the NIST CSF and aligned to CSF 2.0, extended for the financial industry to address regulators' focus on governance and third-party issues.
- 318 diagnostic statements replace thousands of expectations. CRI says the Profile harmonises more than 3,500 regulatory expectations into 318 diagnostic statements, which act as control objectives.
- Tiering cuts the work. Nine impact questions set an impact tier based on systemic impact rather than asset size, which decides which statements apply.
- v2.2 changed mappings, not statements. Released on 30 April 2026, v2.2 brought the mapping total to 40 without changing the core diagnostic statements, so existing assessments carry forward.
- Machine credentials are in scope. The access control and third-party statements apply to service accounts, API keys and agent identities as much as to staff; assessments that only evidence workforce MFA are incomplete.
What it is and who it applies to
The Cyber Risk Institute is a financial-sector industry body. Its Profile is free to download after registration and is licensed under Creative Commons Attribution-NonCommercial-NoDerivatives 4.0; CRI runs affiliate and innovator programmes for commercial use. The CRI FAQ says many US regulators publicly recognise the Profile as an acceptable framework, but its use is not mandatory, and NIST issued a letter of support for version 1.0.
The Profile matters more since the Federal Financial Institutions Examination Council retired its Cybersecurity Assessment Tool (CAT). The FFIEC cybersecurity resource page lists a CAT sunset statement dated August 2024 and links to the CRI Profile and the NIST Cybersecurity Framework among other resources that can help institutions understand supervisory expectations. The FFIEC does not endorse one replacement; institutions choose. See the FFIEC Cybersecurity Guidance Guide for the wider FFIEC material.
| User | How they use the Profile |
|---|---|
| Banks, credit unions, insurers, broker-dealers | Self-assessment, board reporting, mapping policies to regulations, examination evidence |
| Regulators, examiners and auditors | Consistent evidence and comparison across institutions |
| Third parties and vendors | Complete once and share with many financial institution customers |
| Acquirers | Streamlined due diligence on targets in M&A |
Structure and key requirements
The Profile has three layers that practitioners need to keep separate.
- Functions and categories: the CSF structure. CRI's FAQ explains that the original Profile added two functions to the five in CSF 1.1, Governance and Dependency Management; CSF 2.0 has since introduced its own Govern function, and the current Profile is aligned to CSF 2.0 while keeping its financial-sector extension for governance and third-party dependency issues.
- Diagnostic statements: 318 statements that elaborate CSF outcomes into assessable control objectives. These are what you answer and evidence.
- Mappings: 40 mappings in v2.2 to regulations, guidance and standards. CRI publishes a mapping catalogue, a mapping to NIST SP 800-53 Rev. 5 consistent with NIST's Online Informative References programme, a mapping to MITRE ATT&CK, DORA mappings with a gap analysis, and mappings to ISO 27000 and CPMI-IOSCO cyber resilience guidance.
Impact tiering
The CRI Profile Impact Questionnaire has nine questions and determines an impact tier, which decides which diagnostic statements apply. The FAQ says the tiering method builds on existing financial-sector criticality criteria and came out of a 2018 NIST workshop. CRI's overview refers to Impact Tier 1 and Impact Tier 4 at the ends of the scale and says the Profile reduces questions by 58% for Tier 4 firms and 36% for Tier 1 firms compared with another widely used assessment. Tiering is based on systemic impact, so a large but locally focused institution can sit in a lower tier than a smaller firm with critical market functions.
| Element | What it is | Practitioner note |
|---|---|---|
| Impact Questionnaire | Nine questions | Record answers and evidence; examiners may question the tier |
| Impact tier | Scale from Tier 1 to Tier 4 per CRI's overview | Re-run after mergers, new critical services or market roles |
| Applicable statements | Subset of the 318 set by tier | Tier review gives a roadmap toward more advanced statements |
Identity and NHI requirements
CSF 2.0 already states identity outcomes for "users, services, and hardware" (PR.AA-01) and requires that "users, services, and hardware are authenticated" (PR.AA-03). Because the Profile's diagnostic statements elaborate those outcomes, evidence for them should cover machine identities explicitly. The CRI statement text sits in the downloaded Profile, so check wording there; the table maps the CSF outcomes to what a strong answer looks like for NHIs.
| CSF 2.0 outcome | Strong NHI evidence | Common weak answer |
|---|---|---|
| ID.AM-02 inventories of software, services and systems | Inventory of service accounts, API keys, certificates, bots and AI agents with owners | CMDB of servers only |
| PR.AA-01 identities and credentials managed | Issuance, rotation and revocation records for machine credentials | Joiner-mover-leaver for staff only |
| PR.AA-03 users, services and hardware authenticated | Workload identity federation, mTLS, short-lived tokens | Static API keys in configuration |
| PR.AA-05 least privilege and separation of duties | Quarterly entitlement review of privileged service accounts and OAuth grants | Reviews exclude non-interactive accounts |
| GV.SC-01 supply chain risk programme | Vendor integrations' tokens and scopes inventoried and reviewed | Questionnaire only, no technical review |
| DE.CM-09 runtime monitoring | Behaviour baselines for service accounts and agents | Alerts on human logons only |
For AI, CRI released free resources with v2.2: a guide to the Financial Services AI Risk Management Framework (FS AI RMF) control objectives most relevant to CISOs and CTOs, and a mapping from those control objectives to the Profile's diagnostic statements. Use them to place AI agents' identities and permissions inside the same assessment rather than a separate one. See the AI Agents in Financial Services Security Guide and the Financial Services Identity Security Guide.
Implementation steps
- Register and download: obtain the current Profile, the user guide and the mapping catalogue from CRI. Note the version (v2.2 at the time of writing).
- Determine the impact tier: answer the nine questions with the business, not only security; document reasoning.
- Assign statement owners: map each applicable diagnostic statement to an accountable owner and an evidence source. Identity statements need owners for both workforce and machine identity.
- Migrate from legacy assessments: if you used the FFIEC CAT, crosswalk your previous answers as a starting point, then validate; do not copy maturity ratings across, because the scales differ.
- Pilot: assess one business line or one function first, test evidence requests and the review workflow, and refine the method.
- Run the full assessment: answer statements with evidence, record gaps, and link each gap to a remediation plan with dates.
- Use the mappings: generate regulator-specific views (for example DORA for EU entities) from the same answers.
- Report: present tier, coverage and gaps to the board, using the Profile's alignment with CSF to explain priorities.
- Maintain: re-assess annually and on major change. When CRI publishes a new version, read the release notes; v2.2 changed only mappings, but a future version may change statements, in which case keep your prior assessment as the baseline until the delta is assessed.
Evidence and assessment
- Self-assessment: the most common use; supports internal tracking and board engagement.
- Independent validation: internal audit or an external firm tests a sample of statements; useful before an examination.
- Third-party assessment: vendors complete the Profile once and share it with multiple financial institution customers, which CRI promotes as a way to reduce duplicate questionnaires. See the Third-Party Risk Management Guide.
- Supervisory engagement: institutions can present Profile results to examiners; CRI says regulators can compare answers across institutions.
What good evidence looks like
Examiners and auditors test whether an answer is current, complete and operating. For each diagnostic statement, aim for one policy or standard that sets the requirement, one system-generated artefact that shows it is configured (a report from the identity provider, secrets manager or PAM tool rather than a screenshot), and one record that shows it operated during the period (review sign-offs, rotation logs, closed tickets). For identity statements, export the full population of accounts including non-interactive ones, then show the sample you tested and the exceptions you found. An assessment that records exceptions honestly, with dated remediation, is more credible than one that claims full compliance.
Metrics
- Percentage of applicable diagnostic statements answered with current evidence.
- Open gaps by function and age, trending down quarter on quarter.
- Share of identity-related statements whose evidence includes machine identities.
- Number of vendor assessments received in Profile format versus bespoke questionnaires.
- Time since last impact tier review.
Choosing the CRI Profile or an alternative
After the CAT sunset, US institutions broadly had three options. The right choice depends on size, regulatory footprint and whether you need sector comparability.
| Option | Strengths | Weaknesses | Best fit |
|---|---|---|---|
| CRI Profile | Sector-specific, regulator-recognised, 40 mappings, vendor reuse, tiering limits scope | Registration and licence terms; 318 statements need ownership effort | Most banks, insurers and FMIs; vendors to the sector |
| Organisation's own NIST CSF 2.0 Profile | Free, flexible, aligns with non-financial group companies | No sector mapping; examiners must interpret your choices | Diversified groups with a small regulated entity |
| CISA Cross-Sector Cybersecurity Performance Goals | Short, prioritised baseline | Not a full programme assessment; no financial regulatory mapping | Very small institutions as a starting baseline |
Small institutions: the impact tiering usually places community banks and small credit unions in a lower tier, which reduces the applicable statements; start there rather than with a bespoke framework. A small team can still assign every statement to an owner if outsourced providers supply their own Profile assessments. See the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) Guide.
Large and global institutions: the main benefit is the mappings. One assessment produces views for US supervisors, DORA and other regimes, so invest in a GRC tool that stores answers at statement level and generates mapped reports. Expect higher tiers and more statements, and staff the identity statements properly: privileged machine accounts and cloud workload identities are numerous in large estates and frequently the weakest evidence.
Vendors and fintechs: completing the Profile once and sharing it reduces bespoke questionnaires from bank customers. Be ready for customers to test the technical claims behind it, especially how your service authenticates to their environment and how you protect tokens they grant you.
Mapping to other frameworks
| Framework | CRI resource | Use |
|---|---|---|
| NIST CSF 2.0 | Profile is aligned to CSF 2.0 | Common language with non-financial peers. See the NIST CSF 2.0 Guide |
| NIST SP 800-53 Rev. 5 | Profile to 800-53r5 mapping (OLIR-consistent) | Control-level detail for implementation. See the NIST SP 800-53 Guide |
| MITRE ATT&CK | Profile to ATT&CK mapping | Connect threats to statements for prioritisation |
| EU DORA | DORA mappings, gap analysis and user guide | EU entities reuse answers. See the DORA Guide |
| ISO 27000 series | Mapping listed in CRI FAQ | Reuse ISO 27001 evidence |
| CPMI-IOSCO cyber resilience guidance | Mapping listed in CRI FAQ | Financial market infrastructures |
| FS AI RMF | Mapping and CISO/CTO guide released with v2.2 | AI controls inside the same assessment |
US institutions often also map to the GLBA Safeguards Rule or NYDFS Part 500; check whether your required source is in the v2.2 catalogue before building your own crosswalk. See the NYDFS Part 500 Guide and the Financial Services Cyber Regulation Map.
Common pitfalls
- Treating it as mandatory checklist compliance: regulators accept the Profile but do not require it; its value is in evidence quality, not in a completed spreadsheet.
- Under-tiering: answering the impact questions optimistically to reduce scope, then facing examiner challenge.
- Human-only identity evidence: MFA screenshots for staff while privileged service accounts have non-expiring passwords and no owner.
- Copying CAT ratings: CAT maturity levels and Profile responses are not equivalent; a mechanical crosswalk overstates coverage.
- Ignoring the licence: the CC BY-NC-ND 4.0 licence restricts derivative and commercial use; consultancies and tool vendors need CRI's programmes.
- Vendor answers without technical validation: accepting a vendor's Profile without checking how its integrations authenticate to your environment.
Practitioner checklist
- Download the current Profile version and record it in your assessment.
- Complete and document the nine-question impact tiering with business input.
- Assign an owner and evidence source to every applicable diagnostic statement.
- Include service accounts, API keys, certificates and AI agents in identity and asset evidence.
- Crosswalk legacy CAT work carefully and revalidate.
- Use CRI mappings to produce DORA, 800-53 or other views from one assessment.
- Ask key vendors for Profile-based assessments and validate their integration credentials.
- Review tier and assessment annually and after major change.
Standards and references
- Cyber Risk Institute: CRI Profile Overview
- Cyber Risk Institute: Profile FAQ
- Cyber Risk Institute: CRI Profile v2.2 and AI implementation resources
- Cyber Risk Institute: The Profile download
- FFIEC: Cybersecurity Awareness resources
- NIST: CSF 2.0 Profiles
Related NHI Mgmt Group resources: FFIEC Cybersecurity Guidance Guide · NIST CSF 2.0 Community Profiles Catalogue Guide · Financial Services Identity Security Guide · NHI Governance Maturity Model