FFIEC Cybersecurity Assessment Tool control library
Every control CMDash tracks for FFIEC Cybersecurity Assessment Tool, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.
Families
Cyber Risk Management and Oversight · 9
| D1.G.Ov | Governance - Oversight |
| D1.G.SP | Governance - Strategy and policies |
| D1.G.IT | Governance - IT asset management |
| D1.RM.RMP | Risk management - Risk management program |
| D1.RM.RA | Risk management - Risk assessment |
| D1.RM.Au | Risk management - Audit |
| D1.R.St | Resources - Staffing |
| D1.TC.Tr | Training and culture - Training |
| D1.TC.Cu | Training and culture - Culture |
Threat Intelligence and Collaboration · 3
Cybersecurity Controls · 9
External Dependency Management · 4
Cyber Incident Management and Resilience · 5
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for FFIEC Cybersecurity Assessment Tool CAT 2017 (retired 2025-08-31), published from a build-time export rather than read from any customer’s workspace. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.