The sunset does not remove the need for cybersecurity risk assessments. The FFIEC also did not name a mandatory successor. That leaves a practical question: which framework fits, and how do you move over without losing years of work?
This article compares the main options, lays out a five-step transition roadmap, and explains why a framework result alone is not a complete risk assessment.
Key Takeaways
- The FFIEC retired the CAT without endorsing any single replacement tool.
- NIST CSF 2.0, the CRI Profile, CISA CPGs, and CIS Controls serve different purposes and can be combined.
- Keep your CAT history, but move to risk-based, evidence-backed management.
- Board oversight, third-party risk, and named remediation owners matter more than a new score.
What the FFIEC CAT Sunset Means for U.S. Financial Institutions
What the CAT was
The CAT launched in June 2015 as a voluntary assessment tool to help institutions identify risks and determine cybersecurity preparedness. It was never a regulation. It had two parts: an Inherent Risk Profile and a Cybersecurity Maturity assessment.
Maturity was measured across five domains:
- Cyber Risk Management and Oversight
- Threat Intelligence and Collaboration
- Cybersecurity Controls
- External Dependency Management
- Cyber Incident Management and Resilience
Institutions scored each domain from Baseline through Evolving, Intermediate, Advanced, and Innovative.
What changed and what did not
The FFIEC sunset statement says the agencies decided not to update the CAT, because newer government and industry resources exist. It lists NIST CSF 2.0, the CISA Cybersecurity Performance Goals, the Cyber Risk Institute (CRI) Profile, and CIS Controls. The FFIEC does not endorse any particular tool.
An old CAT score is therefore no longer a current or complete picture of your cyber risk.
Your obligations stay the same:
- A written, risk-based security program appropriate to your size, complexity, and activities
- Board approval and oversight
- Assessment of likelihood and potential damage
- Due diligence and contractual safeguards for service providers
The OCC, FDIC, and Federal Reserve each issued notices on the sunset. The Fed's SR 24-7 adds that tools should support effective controls commensurate with risk, and examiners may address areas a tool does not cover.
A note on the NCUA ACET
The NCUA's Automated Cybersecurity Evaluation Toolbox (ACET) is a separate, independently managed tool. The NCUA describes it as completely voluntary, and its 2026 report confirms it incorporates CSF 2.0 content. Credit unions should check the NCUA's current ACET page rather than assume the CAT retirement changes it.
Which Framework Should Replace the FFIEC CAT?
No single answer fits every institution. Weigh these factors:
- Institution size and operational complexity
- Critical services and third-party exposure
- Existing control frameworks
- Examination expectations
- Staff and budget
- Reporting needs, especially to the board
NIST Cybersecurity Framework 2.0
NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Profiles describe your current and target outcomes. Tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how rigorous your risk governance is.
It suits institutions that want an enterprise-wide structure tied to business objectives. The limit: it does not prescribe how outcomes are achieved or which controls to select.
Cyber Risk Institute Profile
The CRI Profile is built for financial services. Version 2.2 is current and includes 40 mappings to other resources. It helps connect cybersecurity outcomes to sector-specific control objectives.
The FFIEC lists it as an option without endorsing it, so confirm the current version and mappings before you commit. Do not assume CAT scores convert automatically to the CRI Profile; confirm whether a current crosswalk exists before you map results.
CISA CPGs and CIS Controls
The CISA CPGs 2.0 are a voluntary priority baseline. CISA calls them a floor, not a ceiling, and not a maturity model. They align to CSF 2.0.
CIS Controls v8.1 are more technical. Implementation Groups (IG1, IG2, IG3) prioritize safeguards by risk and resources, and an official mapping to CSF 2.0 exists.
Both complement a broader framework. Neither replaces governance, risk assessment, or oversight.
How to choose and combine
A common pairing: CSF 2.0 or the CRI Profile for structure, CPGs for baseline priorities, and CIS Controls for technical safeguards. Document:
- Why the selected framework fits
- Which requirements it covers
- Where supplemental resources fill gaps
- How results become owners, remediation plans, evidence, and board reports
DeepSeas supports NIST, ISO 27001, SOC 2, CMMC, and PCI DSS in one coordinated effort, which helps when institutions layer more than one framework.
How to Transition from the FFIEC CAT
1. Establish governance, scope, and accountability
Name an executive sponsor, an assessment owner, and the board or risk committee audience. List participating business units, critical systems, regulatory obligations, and review cadence. Decide up front what the transition must deliver beyond a new score.
2. Preserve CAT history and build a crosswalk
Keep prior assessments, assumptions, evidence, and remediation records. Map CAT domains and past findings to your chosen framework. The 2017 CAT mapped to the original NIST framework, but that predates CSF 2.0. Treat any mapping as a guide, not an exact equivalence.
3. Run a current, risk-based gap assessment
Compare policies, processes, technical controls, vendor dependencies, incident capabilities, and evidence against the new framework's outcomes. Include assets, threats, likelihood, impact, existing controls, and residual risk.
NIST's Profile guidance follows a simple flow:
- Scope the assessment
- Gather information
- Create a profile
- Analyze gaps
- Implement improvements
4. Build and prioritize a remediation plan
Turn findings into owned actions with:
- Target dates and dependencies
- Validation steps
- A documented risk-acceptance or exception process
The FFIEC handbook says to document the acceptance of an unmitigated vulnerability, its risk level, and the accountable person. Rank work by business impact and residual risk, not by how many checklist items you can close.
5. Operationalize the process
Stand up recurring work across the program:
- Assessments and control testing
- Evidence collection and vendor reviews
- Incident-response exercises and management reporting
Add vulnerability and penetration testing where appropriate.
Track progress with key risk indicators. NIST defines a KRI as "a metric used to measure risk." The FFIEC handbook lists metric categories such as policy implementation, program conformance, and adequacy of security services, but sets no universal thresholds. Choose measures that fit your institution.
The handbook also expects at least annual board reporting on risk assessment, control decisions, third parties, testing, and incidents.
Why a Replacement Framework Is Not a Complete Risk Assessment
These terms get blurred:
| Concept | What it does |
|---|---|
| Framework | Organizes desired outcomes; does not prescribe how to achieve them |
| Maturity assessment | Rates controls and practices against levels (the CAT's role) |
| Gap analysis | Compares current and target profiles to prioritize actions |
| Risk assessment | Evaluates threats, vulnerabilities, likelihood, and impact |
The CAT mostly benchmarked maturity and found gaps. A full risk assessment, as described in NIST SP 800-30, connects assets, threats, vulnerabilities, controls, likelihood, impact, and residual risk.
From framework result to decision
For each gap, work through this sequence:
- Identify the affected asset or business service.
- Define a plausible threat scenario.
- Assess current safeguards.
- Assign an owner.
- Track the remaining exposure.
What must surround the framework
Adopting CSF 2.0 does not create these capabilities on its own:
- Third-party risk management
- Threat intelligence and continuous monitoring
- Incident response and recovery planning
- Evidence management
- Board communication
Third-party risk deserves attention. Interagency guidance from the OCC, FDIC, and Federal Reserve says outsourcing does not diminish a bank's responsibility.
An NCUA briefing recorded 742 third-party-related incident reports grouped into just 13 events between September 2023 and August 2024. Those counts show how concentrated vendor incidents can be. They are credit-union reporting figures, not an industry-wide breach rate.
How DeepSeas Can Help with the FFIEC CAT Sunset
DeepSeas runs practitioner-led governance, risk, and compliance engagements. Its specialists include ISO Lead Auditor-certified personnel. That is a professional credential, not a regulatory endorsement. Support covers:
- Framework selection and CAT-to-framework mapping
- Risk assessments with stakeholder interviews, asset inventory, and risk workshops
- Gap assessments, documentation, and remediation planning
- Audit-readiness packaging, including automated control mapping and evidence
The DeepSeas risk assessment weighs likelihood and impact and offers treatment options: avoid, mitigate, transfer, or accept.
When an assessment exposes gaps, the work can extend into other DeepSeas services:
- Strategic advisory
- Offensive security and threat intelligence
- Managed detection and response
- CyberFusion SOC with round-the-clock coverage
GRC integrates with MDR and ticketing, so monitoring feeds audit-ready reporting.
A practical next step: pull your existing CAT materials, shortlist a target framework, and talk with DeepSeas about a tailored assessment or transition roadmap. The goal is fewer surprises, shorter audit cycles, and security that scales. No provider can promise a specific compliance result.
Frequently Asked Questions
What are the FFIEC guidelines?
The FFIEC is an interagency body, not a regulator. It sets uniform examination principles and publishes the IT Examination Handbook, which member agencies (Federal Reserve, FDIC, NCUA, OCC, CFPB) apply. Check current agency sources for your obligations.
Why is cybersecurity risk assessment important?
It shows which exposures are material, guides control and funding priorities, supports board governance, and documents ongoing risk management for examiners.
What is cybersecurity assessment?
NIST defines a security assessment as an evaluation of the security that a system, device, or process provides. A risk assessment, audit, penetration test, and maturity evaluation are distinct activities that work best together.
What is a NIST risk assessment?
NIST SP 800-30 describes four steps: prepare, conduct, communicate, and maintain. Using it for a risk assessment is different from adopting CSF 2.0 as your framework.
What are key risk indicators for cyber security?
A KRI is a metric used to measure risk. Common categories include identity and access, vulnerabilities, third-party exposure, incident activity, recovery readiness, and control performance. Set thresholds to match your risk appetite.
What is the cybersecurity risk formula?
No single formula is universally mandated. NIST treats risk as a function of likelihood and potential adverse impact, and SP 800-30 allows qualitative, quantitative, and semi-quantitative methods.
