The FFIEC Cybersecurity Assessment Tool was retired on August 31, 2025. For eight years it gave banks and credit unions a shared vocabulary for inherent risk and control maturity, and a spreadsheet to prove it. Its retirement did not reduce what examiners expect. It removed the form. This guide covers what replaced it, how to carry your maturity history forward, and what an FFIEC-aligned examination tests in 2026.
What the CAT was, and why it went away
The CAT paired an inherent risk profile with five maturity domains, from cyber risk management and oversight to cyber incident management and resilience. Institutions self-assessed, examiners compared, and the results anchored years of exam conversations.
The FFIEC sunset it because the frameworks underneath it moved on. NIST CSF 2.0, published in February 2024, added a Govern function and restructured the outcomes the CAT had mapped to. The CIS Controls and the NIST profiles for the financial sector matured. Maintaining a tool that pointed at superseded references stopped making sense.
What did not go away: the expectation that an institution can describe its inherent risk, state its control maturity, show the evidence, and explain the gap plan to its board. The examiner still asks those questions. You now answer them in the language of the frameworks the FFIEC points to instead of the CAT's.
What replaces it
There is no single mandated successor. The FFIEC directed institutions to recognized frameworks, and in practice three things fill the gap.
| Replacement | Who uses it | What it gives you |
|---|---|---|
| NIST CSF 2.0 with a sector profile | Banks and credit unions of every size | The common language examiners now expect: Govern, Identify, Protect, Detect, Respond, Recover, with tiers for maturity |
| CIS Critical Security Controls v8.1 | Institutions that want prescriptive safeguards | Implementation Groups 1 to 3 give a concrete control set that maps cleanly onto CSF outcomes |
| NCUA ACET for credit unions | Federally insured credit unions | ACET was built on the CAT and is being aligned to CSF 2.0; it remains the self-assessment NCUA examiners reference |
| Cyber Risk Institute Profile | Larger banks | A financial-sector overlay on CSF that many examiners recognize |
For most community institutions the practical answer is CSF 2.0 as the narrative, CIS v8.1 as the control checklist underneath it, and ACET or the equivalent state or federal expectation for the self-assessment.
Carrying your maturity history forward
Institutions with years of CAT results have a real asset: a documented trajectory. The risk is losing it in the transition. Three steps preserve it.
- Map the CAT domains to CSF 2.0 functions. The five CAT domains map cleanly: oversight to Govern and Identify, threat intelligence and controls to Protect and Detect, external dependency management to Govern's supply chain outcomes, incident management and resilience to Respond and Recover. Our free transition guide includes the crosswalk.
- Restate the maturity claim in tiers. CAT maturity levels from Baseline to Innovative become CSF tiers from Partial to Adaptive. Do not claim a higher tier than the CAT level supported.
- Keep the inherent risk profile. CSF 2.0 does not replace it. Examiners still want to know your risk drivers: delivery channels, technologies, organizational characteristics, external threats. Keep the profile current and cite it in the CSF narrative.
The output is a one-document story: here is our inherent risk, here is our maturity by function, here is the evidence, here is what we are fixing and when.
What an FFIEC-aligned exam tests
The FFIEC IT Examination Handbook, especially the Information Security and Business Continuity booklets, still drives the procedures. Examiners at NCUA, the FDIC, the OCC and the Federal Reserve test the same core areas.
Governance. Board oversight of the information security program, an accountable owner, a risk appetite statement, reporting to the board at least annually, and evidence the board acted on what it heard.
Risk assessment. A current assessment that reflects the institution's real environment, including cloud services, remote access, fintech partners and the core provider.
Third-party risk. The 2023 Interagency Guidance on Third-Party Relationships raised the bar for banks. NCUA's Part 748 and its incident reporting rule apply the same logic to credit unions. Examiners expect a tiered vendor inventory, due diligence proportionate to risk, contract clauses for security and notification, and ongoing monitoring with evidence.
Control operation. Identity and authentication, including MFA on remote access and privileged accounts. Patch and vulnerability management. Logging and monitoring with a review process. Backups that have been restored, not just scheduled. Network segmentation between member-facing systems, the core and the office network. Email authentication at enforcement.
Incident response and resilience. A plan with roles and an escalation tree, tested within the year. Notification procedures aligned to the regulator's rule: 36 hours for banks under the computer-security incident notification rule, 72 hours for federally insured credit unions under NCUA 748.1(c). Business continuity and disaster recovery aligned to the FFIEC BCM booklet, with test results.
Audit and findings. Independent testing proportionate to size, and prior findings remediated to closure with evidence.
The most common findings
Across the exam cycles we have supported, the findings cluster in five places.
- A maturity claim the evidence does not support. The CAT said Evolving; the patch reports say Baseline.
- Third-party files that stop at the signed contract, with SOC report exceptions untracked.
- Incident response plans that were never exercised, or exercised without the people who would make the decisions.
- Backups that were never restored, or restored only to the same platform that would be encrypted.
- Board reporting that describes activity rather than risk.
How we run the transition and the readiness work
- CAT-to-CSF 2.0 transition. Crosswalk your history, restate maturity in tiers, keep the inherent risk profile, and produce the narrative document examiners now expect.
- Assessment and gap plan. A control maturity assessment against CSF 2.0 and CIS v8.1, validated against the deployed environment, with every gap owned, prioritized and dated.
- Evidence build. Artifacts organized by CSF function the way examiners request them.
- Board reporting cadence. A quarterly report that states risk, not activity, in language directors and examiners both accept.
- Exam support. Pre-exam readiness review, findings remediation, and response drafting when the report arrives.
Delivered fixed-scope or continuously through a vCISO engagement.
Frequently asked questions
Do we have to stop using the CAT? No regulator prohibits it, but it points at retired references and examiners will expect CSF 2.0 language. Keep your CAT history as evidence of trajectory and restate the current position in CSF terms.
Is NIST CSF 2.0 mandatory for banks and credit unions? No framework is mandated by name. The FFIEC directs institutions to recognized standards, and CSF 2.0 is the one examiners most commonly reference. What is mandatory is a demonstrable program that meets the Interagency Guidelines Establishing Information Security Standards and, for credit unions, Part 748.
What is the difference between the FFIEC CAT and NCUA ACET? ACET was NCUA's implementation of the CAT for credit unions. With the CAT retired, NCUA is aligning ACET to CSF 2.0. Credit unions should expect the ACET structure to persist with updated references.
How long does a CAT-to-CSF transition take? For a community institution with organized CAT history, four to six weeks to produce the crosswalk, the restated maturity narrative and the gap plan. Longer if the underlying evidence has to be rebuilt.
Where does CIS v8.1 fit? CSF 2.0 states outcomes; CIS states safeguards. Using CIS Implementation Group 1 or 2 as the control checklist under a CSF narrative gives examiners both the language they expect and the specifics they test. Our free Gap Analyzer maps your current tooling to CIS v8.1 and to CSF and FFIEC groupings.