The FFIEC Cybersecurity Assessment Tool was retired on 31 August 2025, yet many banks still carry its inherent risk profile, maturity ratings and domain language in board reports, policies and audit plans. Examiners did not stop asking how an institution knows its cyber risk is managed; they stopped supplying the worksheet. This guide is the migration playbook: what the agencies actually said, where the CAT is still embedded, how to choose between NIST CSF 2.0, the CRI Profile, the CISA Cybersecurity Performance Goals, CIS Controls and, for credit unions, the NCUA ACET, and how to move without losing the history examiners will ask about. It is for CISOs, risk and compliance leads, internal audit and boards at US banks and credit unions. The broader handbook and authentication guidance is covered in the FFIEC Cybersecurity Guidance Guide; this page does not repeat it.
Key takeaways
- The tool is gone, the duty is not. The CAT was a voluntary self-assessment. The underlying obligation, a board-overseen information security programme based on a risk assessment under the interagency GLBA guidelines, is unchanged.
- No single replacement is mandated. The FFIEC sunset statement and Federal Reserve SR 24-7 name NIST CSF 2.0, the CISA CPGs, the CRI Profile and the CIS Critical Security Controls, and both say the agencies do not endorse any particular tool.
- Tools are not exam programmes. The FFIEC states the tools "are not examination programs" and that examiners may address areas not covered by any tool, so choosing a framework does not narrow examination scope.
- Credit unions have a continuing option. The NCUA said it would keep supporting its Automated Cybersecurity Evaluation Toolbox (ACET), which is derived from the CAT, and planned to align it with CSF 2.0 and the CPGs.
- Keep the history. A documented crosswalk from your last CAT results to the new baseline is what lets the board, auditors and examiners see continuity rather than a reset.
What is changing and why
The CAT, released in June 2015, gave institutions a two-part method: an Inherent Risk Profile that rated exposure from technologies and connection types, delivery channels, online and mobile products, organisational characteristics and external threats; and a Cybersecurity Maturity assessment across five domains, with declarative statements at Baseline, Evolving, Intermediate, Advanced and Innovative levels. Its strength was that inherent risk and maturity were meant to line up: higher risk should mean higher maturity.
In its 29 August 2024 statement, published by the OCC as Bulletin 2024-25, the FFIEC said the CAT's fundamental controls were sound but that it had decided not to update the tool to reflect newer government resources. Since 2015, NIST published CSF 2.0 with a Govern function, CISA published cross-sector Performance Goals in 2023, and the sector built the CRI Profile, which CRI's FAQ says drew on the CAT among other sources. The agencies chose to point institutions at those resources rather than maintain a parallel one.
| CAT element | What replaces it | Practical note |
|---|---|---|
| Inherent Risk Profile | Your own documented risk assessment; CRI Profile impact tiering; a CSF 2.0 Current Profile informed by ID.RA-05 | Keep the five CAT risk categories as risk drivers in the new assessment so trends survive |
| Five maturity domains | CSF 2.0 functions and categories, or CRI Profile diagnostic statements | The FFIEC guidance guide holds a domain-to-function crosswalk; reuse it |
| Five maturity levels | CSF Tiers (Partial, Risk Informed, Repeatable, Adaptive) or a CRI maturity scale | Tiers describe governance rigour, not control coverage: do not map Baseline to Tier 1 mechanically |
| Declarative statements with Y/N answers | CRI diagnostic statements, CPG goals, CIS Safeguards | Evidence each answer; the CAT was often completed without it |
| Risk and maturity alignment chart | CSF Target Profile approved by the board, with a gap plan | The target is now explicit and owned by the board |
Official timeline and current status
| Date | Event | Source |
|---|---|---|
| June 2015 | CAT released as a voluntary tool | OCC Bulletin 2024-25 |
| 29 August 2024 | FFIEC announces the CAT will be sunset; NCUA says ACET remains available | OCC Bulletin 2024-25; FFIEC statement |
| 17 October 2024 | FFIEC bankers' webinar on new cybersecurity resources (as scheduled in the bulletin) | OCC Bulletin 2024-25 |
| 22 November 2024 | Federal Reserve SR 24-7 names CSF 2.0, CPGs, CRI Profile and CIS Controls, and confirms no endorsement | SR 24-7 |
| December 2024 to April 2025 | Federal Reserve "Ask the Fed" sessions on CISA, CIS and CRI resources | Richmond Fed, 3 June 2025 |
| 31 August 2025 | CAT sunset and removed from the FFIEC website | FFIEC statement; SR 24-7 |
As of 8 November 2026 the CAT is retired. CISA's Performance Goals page says CISA is updating the CPGs to CSF 2.0; the financial-sector CPGs that the 2024 bulletin described as forthcoming were not listed on that page when checked. NCUA's ACET remains a voluntary option. Status of these resources changes, so confirm the current versions on the publishers' pages before you lock in a baseline.
Who and what is affected
- National banks and federal savings associations (OCC), state member banks (Federal Reserve), state non-member banks (FDIC): the FFIEC statement applies across members. SR 24-7 states it applies to all Fed-supervised institutions, including those with $10 billion or less in assets.
- Federally insured credit unions: ACET continues; the NCUA described its use as voluntary.
- Community banks on core processors: often relied most on the CAT because it gave a ready-made structure. They now need a framework sized to a lean team.
- Bank service providers and fintech partners: due diligence questionnaires that asked for "CAT maturity" need new wording. Expect banks to ask for CRI Profile or CSF evidence instead.
- Internal audit and boards: audit universes, annual plans and board dashboards built on CAT domains need redesign.
Finding affected systems and identities
For a framework migration, the "systems" are the documents, tools and processes that still assume the CAT. Search for them before choosing a replacement, because they define the scope of the change.
- Policy and programme documents: the information security programme, risk assessment methodology and board charter. Search for "CAT", "inherent risk profile", "Baseline" and "Evolving".
- Board and committee reporting: dashboards that show maturity by CAT domain or a risk and maturity heat map.
- GRC platform content: CAT libraries, questionnaires and mappings that the vendor may have retired or frozen.
- Audit plans and prior findings: open findings referenced to CAT statements need re-referencing to the new framework, or they will appear closed by default.
- Third-party contracts and questionnaires: clauses that require a vendor to "maintain CAT Baseline" and inbound questionnaires from correspondent banks.
- Examination responses: management responses and corrective action plans that cite CAT maturity.
Where identity fits: the CAT's Cybersecurity Controls domain was where access management lived, and CSF 2.0 splits it into explicit outcomes: PR.AA-01 covers identities and credentials for "users, services, and hardware", PR.AA-03 authentication and PR.AA-05 least privilege. Use the migration to inventory service accounts, API keys used by core and digital banking integrations and third-party remote access, which the CAT never called out by name. See the Financial Services Identity Security Guide and the Service Account Security Guide.
Migration options
| Option | What it is | Fits best | Trade-offs |
|---|---|---|---|
| NIST CSF 2.0 | Outcome framework with six functions including Govern; Current and Target Profiles; four Tiers | Any size; institutions that want one language for board, auditors and vendors | Outcomes are high level: you must define how each is assessed and evidenced |
| CRI Profile | Financial-sector extension of CSF with diagnostic statements, impact tiering and regulatory mappings; free after registration, CC BY-NC-ND 4.0 | Banks that want assessable statements mapped to sector regulations; firms answering many regulators and counterparties | More statements to evidence than the CPGs; tier choice must be justified. See the NIST CSF Financial Sector CRI Profile Guide |
| CISA CPGs | A short list of high-impact practices aligned to CSF functions; being updated to CSF 2.0 | Small institutions as a starting baseline | Not a full programme; governance and third-party coverage are thin. See the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) Guide |
| CIS Controls v8.1 | 18 prioritised controls with Safeguards in three Implementation Groups | Technical control baseline under a CSF or CRI governance layer | Control catalogue rather than a risk framework; pair with a risk assessment. See the CIS Controls Guide |
| NCUA ACET | NCUA's CAT-derived toolbox for credit unions | Credit unions wanting continuity with CAT results | Familiar structure; confirm which version aligns to CSF 2.0 before relying on it for multi-year planning |
Decision guidance: the strongest pattern is a two-layer model. Use CSF 2.0 (or the CRI Profile, which is built on it) as the risk and governance framework the board approves, and a control catalogue (CIS Controls or the CPGs) for technical depth. A community bank with a small team and an outsourced core can start with CSF 2.0 plus the CPGs, scope assurance from the core processor's SOC reports, and grow. A larger or more interconnected institution, especially one asked for CRI Profile evidence by counterparties, gains most from the CRI Profile because its mappings answer several regulators and questionnaires at once. A credit union with years of ACET history can stay on ACET while building a CSF view in parallel.
Migration workplan
- Decide and document: a short memo to the board or risk committee recording the chosen framework, why, and how it maps to GLBA programme requirements (for Fed members, 12 CFR 208 Appendix D-2, which the Richmond Fed cites as the risk assessment expectations examiner evaluations align with).
- Freeze the last CAT: archive the final CAT or ACET results, evidence and board minutes. That is your baseline.
- Crosswalk: map each CAT domain and the last maturity result to the new categories or diagnostic statements, and record where the new framework asks for more: governance (GV.RR-01, GV.OV-01), supply chain (GV.SC-01, GV.SC-07), and identity (PR.AA).
- Re-perform the risk assessment: keep the CAT inherent risk drivers as inputs; for the CRI Profile, answer the impact questionnaire and record evidence for the tier.
- Assess with evidence: rate each outcome or statement and attach evidence. Have internal audit test a sample.
- Set the Target Profile: approved by the board, with owners and dates for each gap.
- Re-reference everything found in the inventory: policies, audit findings, dashboards, contracts and questionnaires.
Testing and rollback
- Parallel run: run the new assessment alongside the frozen CAT results for one cycle. Where they disagree materially, investigate: the new framework is often exposing gaps the CAT's yes/no format concealed, not creating them.
- Independent validation: internal audit or a third party re-performs a sample (for example 10 to 15 percent of outcomes, weighted to Protect and Govern) before the first board report.
- Examiner preview: share the framework choice, crosswalk and timeline with your examiner contact ahead of the next examination. Examiners do not approve tools, but surprises cost more than conversations.
- Rollback: framework choice is reversible. If the CRI Profile proves too heavy, step down to CSF 2.0 plus CPGs, keeping the crosswalk. What is not reversible is gaps in the record: never leave a year with no documented assessment.
Measure the migration with a few indicators: percentage of CSF categories or diagnostic statements assessed with evidence; number of open audit and exam findings re-referenced; number of documents still citing the CAT; percentage of Target Profile gaps with an owner and date; and board reporting delivered on the new framework on schedule.
| Requirement area | NIST CSF 2.0 | Evidence examiners commonly review |
|---|---|---|
| Board oversight and accountability | GV.RR-01, GV.OV-01, GV.RM-01 | Board-approved programme, annual report to the board, minutes showing challenge |
| Legal and regulatory requirements | GV.OC-03 | Mapping of GLBA, state and contractual obligations to the framework |
| Risk assessment | ID.RA-01, ID.RA-05 | Documented inherent risk drivers and control assessment |
| Third-party risk | GV.SC-01, GV.SC-07 | Vendor inventory, criticality, due diligence and SOC report review |
| Identity and access | PR.AA-01, PR.AA-03, PR.AA-05 | MFA coverage, privileged and service account inventories, access reviews |
| Monitoring, response and recovery | DE.CM-01, RS.MA-01, RC.RP-01 | Log coverage, incident records, tested recovery plans |
| Improvement | ID.IM-01 | Remediation tracking from assessments, audits and exercises |
Risks of doing nothing
- Stale assessment: continuing to fill in a retired tool that no longer receives updates leaves out governance, supply chain and identity outcomes that newer frameworks assess. SR 24-7 is explicit that examiners may cover areas a tool does not.
- Undefendable methodology: a programme document that references a withdrawn tool is an easy finding about risk assessment methodology.
- Lost continuity: institutions that simply stop the CAT and start something else in a later year lose the trend line boards and examiners use to judge progress.
- Third-party friction: counterparties and service providers now ask for CRI Profile or CSF evidence; answering with CAT maturity reads as dated.
- Hidden identity gaps: the CAT never named service accounts or API credentials; incidents like the Snowflake breach, where stolen credentials without MFA opened customer data stores, show why PR.AA outcomes deserve explicit assessment.
Practitioner checklist
- Record the framework decision, rationale and GLBA mapping in a board or committee paper.
- Archive the final CAT or ACET results and evidence as the baseline.
- Inventory every policy, dashboard, GRC library, audit finding and contract that cites the CAT.
- Build and approve a crosswalk from CAT domains and maturity to the new framework.
- Re-perform the risk assessment, keeping CAT inherent risk drivers as inputs, and document the CRI tier if used.
- Assess with evidence, have internal audit validate a sample, and set a board-approved Target Profile.
- Add explicit outcomes for service accounts, API credentials and third-party access.
- Brief your examiner contact on the framework choice and timeline before the next examination.
Standards and references
- OCC: Bulletin 2024-25, FFIEC Cybersecurity Assessment Tool Sunset Statement
- Federal Reserve: SR 24-7, Sunset of the FFIEC Cybersecurity Assessment Tool
- FFIEC: Cybersecurity Assessment Tool Sunset Statement (copy hosted by Minnesota Commerce)
- NIST: Cybersecurity Framework
- CISA: Cross-Sector Cybersecurity Performance Goals
- Cyber Risk Institute: CRI Profile FAQ
- Federal Reserve Bank of Richmond: Goodbye CAT
- America's Credit Unions: ACET access to continue despite sunset of FFIEC CAT
Related NHI Mgmt Group resources: FFIEC Cybersecurity Guidance Guide · NIST CSF Financial Sector CRI Profile Guide · NIST CSF 2.0 Guide · Banking Cybersecurity Programme Guide · GLBA Safeguards Rule Guide. This guide summarises supervisory statements on the FFIEC CAT sunset and is not legal advice.