Cybersecurity Assessment Tool

What it is

The FFIEC's own statement: "The Federal Financial Institutions Examination Council (FFIEC), on behalf of its members, is issuing this statement to communicate the agencies will sunset the Cybersecurity Assessment Tool (CAT) on August 31, 2025."

"The CAT was released in June 2015 as a voluntary assessment tool to help financial institutions identify their risks and determine their cybersecurity preparedness."

"The FFIEC will remove the CAT from the FFIEC website on August 31, 2025. After much consideration, the FFIEC has determined not to update the CAT to reflect new government resources, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 and the Cybersecurity and Infrastructure Security Agency's (CISA) Cybersecurity Performance Goals."

"While the FFIEC does not endorse any particular tool, these standardized tools can assist financial institutions in their self-assessment activities. The tools are not examination programs and the FFIEC members take a risk-focused approach to examinations."

The FFIEC's own statement never uses the word "successor": it lists four resources institutions may consider — NIST CSF 2.0, CISA's Cybersecurity Performance Goals, the CRI Profile and the CIS Critical Security Controls — without designating any one of them as its official replacement.

A footnote in the same statement clarifies that credit unions are unaffected by the CAT's sunset: "The National Credit Union Administration will continue to support and encourage credit unions to use the Automated Cybersecurity Examination Toolbox (NCUA ACET). Use of the NCUA ACET is voluntary and can be downloaded from the NCUA's website."

Who owns it

The CAT was owned and issued by the FFIEC, on behalf of its member agencies, per the FFIEC's own sunset statement.