The FFIEC Cybersecurity Assessment Tool was a voluntary self-assessment that was retired on 31 August 2025. Reporting says institutions can look to NIST CSF 2.0 and CISA's Cybersecurity Performance Goals instead. The FFIEC did not endorse a single replacement tool, so check with your examiner.
This is general information, not legal advice.
What was reported
Sources describing the retirement say the FFIEC decided not to update the CAT and pointed to newer government resources. Trade summaries say it came off the FFIEC website on 31 August 2025, with no further updates.
We could not retrieve the FFIEC statement itself, so confirm the details on ffiec.gov. Secondary sources also mention industry profiles and the CIS Critical Security Controls as options.
The alternatives named
| Option | What it is |
|---|---|
| NIST CSF 2.0 | A framework of outcomes that tells you what to achieve and leaves the how to you |
| CISA Cross-Sector CPGs | Voluntary practices for critical infrastructure, now at version 2.0, grouped by areas such as asset identification and incident response |
CISA describes the CPGs as a subset of practices meant to reduce risk, and as a starting point for small and medium organizations.
How to choose
- Ask your primary regulator or examiner whether they expect a particular approach.
- If you have no preference, start with the framework your customers and partners already speak.
- Map your existing controls to it once, and keep the mapping current.
- Record the date, the scope and the owner of each assessment.
A self-assessment is useful when someone acts on the gaps. Track gaps as work items with owners.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through to see one control mapped to several frameworks, which is the idea behind mapping once and reusing.
Where Safeguard fits
Safeguard's compliance and evidence automation can map controls and evidence to frameworks you track. A free scan is at gold.safeguard.sh/scan.
Quick check
Was the CAT mandatory?
Reports describe it as voluntary though widely used. Cyber risk assessment remains part of examiner expectations through other means.
Is there an official replacement?
Reports say the FFIEC did not endorse a single tool. Confirm with your regulator.
Sources
- BDO, what the CAT sunset means
- CISA Cross-Sector Cybersecurity Performance Goals
- NIST Cybersecurity Framework
Last reviewed: 19 October 2026.
