Briefing
The FFIEC announced on August 29, 2024 that it would sunset the Cybersecurity Assessment Tool on August 31, 2025. The CAT had been released in June 2015. The FFIEC said the controls behind its maturity levels remained sound but chose not to update the tool, pointing institutions instead to NIST CSF 2.0 and CISA's Cybersecurity Performance Goals. The Federal Reserve's SR 24-7 also lists the Cyber Risk Institute Profile and the CIS Critical Security Controls.
The FFIEC does not endorse any single tool. Any self-assessment should support an effective control environment and match the institution's risk. Swapping one spreadsheet for another does not satisfy an examiner by itself.
For small institutions, the hard part is evidence. Branch networks, ATMs, core connections, phones and alarm circuits all appear somewhere in the control set, and proving each control works takes records, not yes or no answers.
What to do
- Pick a framework and map existing policies and controls to it once. Update the map when something changes.
- Use what you already wrote: the information security program, incident response plan, vendor management and business continuity plans.
- Collect evidence on a schedule: user access reviews, patch status, firewall configuration, backup tests and circuit failover tests.
- Report to the board in plain terms: current risk, exposures attackers are exploiting now (start with CISA's KEV catalog), and whether controls can be proven.
- Keep audit independent of the firm that runs your IT, as the FFIEC handbook expects.
How to verify
- Search your board materials and policies for references to the CAT and replace them.
- Ask for the evidence folder for one control and time how long it takes to produce.
- Test branch failover: pull the primary circuit at one branch and confirm phones, core access and alarms stay up.
Sources
- OCC Bulletin 2024-25, FFIEC Cybersecurity Assessment Tool sunset statement
- Federal Reserve SR 24-7, FFIEC CAT sunset statement
- NIST, NIST Releases Version 2.0 of Cybersecurity Framework, Feb 26, 2024
- CISA, Cybersecurity Performance Goals 2.0
- CISA, Known Exploited Vulnerabilities catalog
- FFIEC IT Examination Handbook, Audit booklet: Outsourcing Internal IT Audit
Questions about your phones, network or IT? Contact Texwan.