This cat doesn’t have nine lives.

The FFIEC recently announced that its member agencies (FRB, FDIC, OCC, CFPB, NCUA, and State Liaison Committee) will sunset the Cybersecurity Assessment Tool (CAT) on August 31, 2025. The CAT was introduced in June 2015 to help institutions identify their risks and determine their cybersecurity preparedness. The Assessment provided a repeatable and measurable process for financial institutions to measure their cybersecurity preparedness over time.

In talking with some examiners, they have the expectation that banks will migrate to an alternative tool for monitoring cyber risk. In the FFIEC’s CAT Sunset Statement, it states that CISA is preparing to release Cybersecurity Performance Goals for the Financial Sector later this year. The statement adds that the FFIEC will discuss these government resources during a banker webinar later this fall. Be on the lookout for this webinar to get some guidance on where to go from here.

The sunset statement also mentioned non-government, industry developed resources, such as the Cyber Risk Institute’s (CRI) Cyber Profile and the Center for Internet Security (CIS) Critical Security Controls.

Some of the highlights from CRI’s website:

  • A cyber risk assessment made for and by the financial sector.
  • Based on the NIST Cybersecurity Framework.
  • Extended for the financial industry to address the focus of regulators on important governance and third-party issues.
  • Harmonizes 2,500+ regulatory expectations into 318 control objectives, called diagnostic statements.
  • Gives financial institutions one simple framework to rely on.
  • Provides regulators with a consistent and widely understood framework.
  • The Profile is based on common NIST functions (Identify, Protect, Detect, Respond, Recover) and adds two functions specific to the financial industry (Govern, Extend).

Some highlights from CIS’s website:

  • The CIS Critical Security Controls (CIS Controls) are a prescriptive, prioritized, and simplified set of best practices that you can use to strengthen your cybersecurity posture.
  • By implementing the CIS Controls, you create an on-ramp to comply with PCI DSS, HIPAA, GDPR, and other industry regulations.
  • Modern systems and software are dynamic in nature. By enacting the CIS Controls, you support your assets’ evolving needs in a meaningful way and align your security efforts with your business goals.

Both CRI and CIS allow you to download a spreadsheet tool. CRI states that it has a SaaS feature that companies can access from its website after becoming a member. CIS’s system seems simple enough to manage through the free spreadsheet.

The link to the FFIEC’s CAT sunset statement can be found here. Included in the statement are links to check out alternatives such as CIS and CRI.