FFIEC Cybersecurity Assessment Tool
The structure of the FFIEC Cybersecurity Assessment Tool, kept for banks and credit unions that assessed against it. The FFIEC retired the tool on 2025-08-31, so this is a legacy structure, not current guidance.
What FFIEC Cybersecurity Assessment Tool is
The FFIEC Cybersecurity Assessment Tool (CAT) was a voluntary self-assessment published by the Federal Financial Institutions Examination Council in 2015 and updated in 2017. It paired an Inherent Risk Profile with a Cybersecurity Maturity assessment across five domains, rating practices from Baseline up to Innovative.
On 2024-08-29 the FFIEC announced that the tool would be retired, and it was removed from the FFIEC website on 2025-08-31. The FFIEC said the fundamental security controls in the tool were sound, but that newer government and industry resources were available, and named NIST CSF 2.0 and the CISA Cybersecurity Performance Goals. This is therefore a legacy structure and not current regulatory guidance.
CMDash seeds the five maturity domains and their contributing components, each described in CMDash's own words. It is useful if your program, board reporting or past examinations were built on the CAT and you want to keep that history and work from it while you move to a current framework.
Who it applies to
- Banks, credit unions and other financial institutions that used the CAT for their cybersecurity self-assessment and still hold assessments, board reports or examination history built on it.
- Technology service providers to those institutions, who are often asked how their controls line up with what the institution assessed.
- Institutions deciding how to carry a CAT-based program over to NIST CSF 2.0 and the FFIEC IT Examination Handbook.
How it is structured in CMDash
Each control is one contributing component of the Cybersecurity Maturity part of the CAT, grouped under its five domains, with an identifier in the FFIEC's domain.factor.component format (for example D3.PC.Am). The wording and the evidence lines are paraphrased, not copied from the FFIEC document.
| Cyber Risk Management and Oversight | 9 |
| Threat Intelligence and Collaboration | 3 |
| Cybersecurity Controls | 9 |
| External Dependency Management | 4 |
| Cyber Incident Management and Resilience | 5 |
These counts are the control rows CMDash actually seeds, checked against the seed files by a test on every build.
Scope: Component level only: the tool's declarative statements by maturity level and its Inherent Risk Profile are not included, and the wording is CMDash's own. The FFIEC named NIST CSF 2.0 and the CISA Cybersecurity Performance Goals as current resources.
The control text
Controls carry their identifier, title, and CMDash’s own evidence-requirement guidance. No verbatim source text is bundled for this framework. If you hold the official document, you can load its text through the framework CSV import.
What CMDash does for FFIEC Cybersecurity Assessment Tool
- Each component is a tracked row with an owner, a status, reviewer notes and dated evidence, grouped by the five CAT domains.
- Evidence lines list the records an examiner or internal audit would typically ask to see for that component.
- Gaps export to a POA&M CSV with owner, status and evidence requirements, as for every framework.
- The same program can also be tracked against NIST CSF 2.0, which the FFIEC named as a current resource, so the history here and the current framework sit side by side.
- Every control is a tracked row with an owner, a status (not started, in progress, implemented, not applicable, at risk, failing), reviewer notes, and its own evidence requirements — not a checkbox on a spreadsheet.
- Evidence is uploaded against a specific control, dated, and kept on that control, so an assessor can see what was true when.
- Gaps export to a POA&M CSV — every control that is not implemented and not marked out of scope, with owner, status and evidence requirements.
- Policies you author in CMDash link to the controls they govern, so each control row shows which living policies stand behind it.
- A time-boxed, read-only external assessor seat can be scoped to just this framework, with an expiry date you set and a record of every page they opened.
What it shares with your other frameworks
No crosswalk mappings ship for FFIEC Cybersecurity Assessment Tool. Evidence you collect against it does not automatically surface on your other frameworks, and that is worth knowing before you plan the work.
Where the evidence comes from
CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to FFIEC Cybersecurity Assessment Tool’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.
Where CMDash stops
Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.
- The tool is retired. This framework does not represent current FFIEC examination expectations, and nothing here replaces the FFIEC IT Examination Handbook.
- The declarative statements of the tool, which sat at five maturity levels under each component, are not included, and neither is the Inherent Risk Profile. A component here is not scored to a maturity level by CMDash.
- No crosswalk to NIST CSF 2.0 or any other framework is seeded, so evidence collected here does not automatically appear against your other frameworks.
- The wording is CMDash's paraphrase of the published structure, not the FFIEC text.
Common questions
Is the FFIEC CAT still required?
It was voluntary, and the FFIEC sunset it on 2025-08-31. The FFIEC named NIST CSF 2.0 and the CISA Cybersecurity Performance Goals as current resources; examinations continue to rely on the FFIEC IT Examination Handbook.
Why is a retired tool in CMDash?
Many institutions have years of assessments and board reports built on it. Keeping its structure lets you continue to track and show that history while you move to a current framework. It is labelled as retired wherever it appears.
Does this score my maturity level?
No. The statements that placed a component at Baseline through Innovative are not included, so CMDash tracks the component, its owner and its evidence, not a CAT maturity rating.
Also in Privacy & Sector Regulation
Paid plans cap how many frameworks you run at once, never which ones — FFIEC Cybersecurity Assessment Tool is available on every paid plan.
View pricingReady to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.