Contact us

Insights & Resources

•

The Sunset of the FFIEC Cybersecurity Assessment Tool: What It Means for CIOs and CISOs in the Banking Industry

The Sunset of the FFIEC Cybersecurity Assessment Tool: What It Means for CIOs and CISOs in the Banking Industry, Frazier & Deeter

Filed under

The Federal Financial Institutions Examination Council (FFIEC) has announced the sunsetting of its Cybersecurity Assessment Tool (CAT) by the end of August 2025. This decision marks a significant shift in the regulatory landscape for depository banks and necessitates a strategic response to ensure continued compliance and robust cybersecurity.

The transition away from the CAT may seem disruptive and confusing, but it is an opportunity for financial institutions to re-evaluate their existing cybersecurity program and ultimately enhance their cybersecurity posture. Starting the review process now, conducting thorough gap assessments and engaging key stakeholders will ensure a smooth transition and continued regulatory compliance.

The Role of the CAT

The CAT has long served as a cornerstone for assessing and enhancing cybersecurity preparedness within financial institutions. The tool offered banks a structured framework to evaluate their cybersecurity maturity and identify areas for improvement; yet, due to advancing cyber threats and limitations of the tool itself, the FFIEC has decided to retire it. After August 2025, it will be completely removed from the FFIEC website and will no longer be in use.

Implications for Financial Institutions

While banks can continue using the CAT until its official sunset date, the discontinuation may lead to potential operational and compliance gaps if not addressed proactively.

It is important to recognize that transitioning to a new framework may not necessitate a complete overhaul of your cybersecurity program. Existing essential practices, such as incident response planning and multi-factor authentication for privileged access, will likely still meet the requirements of your chosen framework. However, a new cybersecurity framework introduces new requirements (such as supply chain risk management and business resiliency in the NIST CSF 2.0) that likely have not been evaluated during implementation and ongoing maintenance of the CAT.  

This transition presents an opportunity for institutions to re-align their cybersecurity strategies with broader risk management objectives. With the evolving threat landscape, it is imperative for banks to ensure their cybersecurity frameworks are up-to-date and capable of addressing new challenges.

Considerations for Selecting an Alternative Framework to the CAT

As banks prepare to transition from the CAT, selecting an appropriate alternative framework involves careful consideration of the bank’s size, technology, operational complexity and targeted cybersecurity maturity level. While neither the FFIEC nor any individual regulatory body has recommended a specific cybersecurity framework, several industry-recognized options are worth considering:

  • NIST Cybersecurity Framework 2.0 (CSF): Risk-based cybersecurity framework focused on six core functions: Govern, Identify, Protect, Detect, Respond and Recover. In addition, the Cyber Risk Institute has developed industry-specific profiles that can be used by banks to assist in consideration of applicable.
  • ISO/IEC 27001: An internationally recognized standard for information security management.
  • CIS Controls: Developed by the Center for Internet Security, offering a simplified approach suitable for smaller organizations.

Each organization must evaluate these frameworks based on their risk management and information security needs to determine the best fit.

Navigating Regulatory Expectations and Demonstrating Proactivity

Once you’ve chosen a framework, be prepared for regulators and examiners to ask questions that may extend beyond the specific details of your selected framework. This is part of their responsibility to ensure comprehensive cybersecurity coverage. Financial institutions may be asked to demonstrate a proactive approach by documenting discussions, evaluations and decisions in committee and board meetings. Although the FFIEC will no longer be supporting the CAT, examiners and regulators will still expect banks to formally measure and manage cybersecurity risks. As part of the transition, it is crucial to perform a comprehensive gap assessment to identify any discrepancies between the bank’s current cybersecurity program and the new framework’s requirements. Involving key stakeholders and leadership across the bank, such as operations, customer service, risk management, compliance, IT security and internal audit, will ensure alignment and a holistic approach.

Ready to Reassess Your Institution’s Cybersecurity Strategy?

As departments of banking emphasize the importance of these discussions in committee and board meetings, institutions should demonstrate their proactive approach to cybersecurity readiness. FD can help you evaluate your current security posture, select the right framework and implement a strategy that aligns with evolving regulatory expectations. By staying informed and taking action now, you can navigate this transition effectively and maintain a strong cybersecurity framework. Contact us to ensure your institution is ready for what’s next.

Contributors

Chris Zotti, Advisory Director

Explore related insights

Explore Insights & Resources