Your institution still needs a structured way to assess cybersecurity risk, review controls, and explain its posture to leadership and examiners. The FFIEC Cybersecurity Assessment Tool (CAT) filled that role for many banks and credit unions after its release in 2015.

The FFIEC retired the CAT on August 31, 2025. It did not name a required successor. Instead, supervised financial institutions may consider current government and industry resources, including the National Institute of Standards and Technology Cybersecurity Framework 2.0, the Cybersecurity and Infrastructure Security Agency Cybersecurity Performance Goals, and the Cyber Risk Institute Profile.

The tool changed, but the expectation did not. You still need to assess your institution’s cybersecurity preparedness and choose an approach that fits its risk profile, control environment, size, and complexity.

The FFIEC CAT: What It Provided

The FFIEC CAT helped financial institutions identify inherent cyber risk and assess control maturity. Its inherent-risk questions covered technologies and connection types, delivery channels, online and mobile products, organizational characteristics, and external threats.

The control-maturity section contained almost 500 statements across cyber risk management and oversight, threat intelligence and collaboration, cybersecurity controls, external dependency management, and cyber incident management and resilience. The result gave your institution a point-in-time view of risk and practices.

The CAT also had limits. Its fixed structure could be difficult to apply to different operating models, and some questions left room for inconsistent interpretation. As threats, controls, and government resources changed, the FFIEC decided not to update the tool.

Looking Beyond the CAT

The CRI Profile is an industry-developed framework for financial services. It is aligned with NIST Cybersecurity Framework 2.0 and organizes cybersecurity work around six functions: Govern, Identify, Protect, Detect, Respond, and Recover.

The Profile is designed to help financial institutions connect regulatory expectations with a risk-based control framework. It also includes mappings that can support a transition from the FFIEC CAT and other standards. The FFIEC does not endorse a particular replacement, so your institution remains responsible for evaluating whether the framework provides the coverage, reporting, and governance it needs.

NIST CSF 2.0 and the CISA Cybersecurity Performance Goals are other resources institutions may consider. A custom framework is also possible, but it requires enough structure and documentation to show how risks, controls, gaps, and decisions are assessed over time.

What to Look for in a New Framework

As you evaluate a successor to the FFIEC CAT, four considerations can help keep the decision grounded in the work your institution has to perform:

1. Flexibility and scope: A current framework should let you focus on controls that match your technology, services, third parties, and risk. Flexibility helps only when your institution defines how requirements will be interpreted and applied.
2. Clarity for decision-makers: Assessment results need to give senior management and the board a clear view of exposure, control performance, and unresolved gaps. A detailed framework has limited value if its findings cannot support a decision.
3. A common language: Alignment with a recognized framework can make discussions with examiners, auditors, vendors, and peer institutions more consistent. Your policies and evidence still need to show how the framework operates inside your institution.
4. A manageable assessment process: Mappings from the CAT to a new framework may reduce duplicate work and preserve useful information from earlier assessments. The transition should still include a gap review. A mapped response is not proof that a control remains current or effective.

Plan the Transition Around Your Institution

Start with the outcome your institution needs from the assessment. Identify who will use the results, how often the assessment will be updated, what evidence supports each response, and how findings will move into risk acceptance or remediation.

Then compare the available frameworks against your regulatory obligations, cybersecurity program, staffing, third-party dependencies, and reporting needs. Document why the chosen approach fits. That record matters when an examiner or auditor asks how your institution moved beyond the CAT.

The retirement of the FFIEC CAT creates work, but it also gives you a chance to replace a static exercise with a cybersecurity assessment that is easier to maintain and more useful to leadership. The framework should help your institution see risk clearly and decide what happens next.