Stay FFIEC examination-ready

What is the FFIEC?

The Federal Financial Institutions Examination Council (FFIEC) is the US interagency body that prescribes uniform principles, standards, and report forms for the federal examination of financial institutions. Its IT Examination Handbook is the reference examiners use to evaluate an institution's information security, business continuity, and IT risk management.

The CAT sunset

From 2015, many institutions used the FFIEC Cybersecurity Assessment Tool (CAT) to self-assess their cyber maturity. The FFIEC retired the CAT on August 31, 2025, having decided not to update it to reflect newer government resources. Institutions are expected to transition to standardized, actively maintained frameworks instead:

• NIST CSF 2.0 — by far the most common replacement.
• CRI Profile — the Cyber Risk Institute's financial-sector tailoring of NIST CSF, which maps to FFIEC handbooks, NY DFS Part 500, and other supervisory regimes.
• CIS Controls and the CISA Cybersecurity Performance Goals — additional options.

Importantly, the IT Examination Handbook and the examination program itself remain in force — only the voluntary CAT tool went away.

How episki helps

episki maps your program to NIST CSF 2.0 or the CRI Profile, carries your prior CAT work forward, and organizes controls and evidence to the FFIEC IT Examination Handbook domains. Because the same controls cross-map to GLBA, NY DFS Part 500, SOC 2, and ISO 27001, your institution runs one program for every regulator instead of many.