practices
Replacing the FFIEC CAT: What Banks Are Choosing — and Why CSF Alone Isn't Enough
The FFIEC sunset its Cybersecurity Assessment Tool in August 2025. Most banks are moving to NIST CSF, but CSF on its own is too shallow to drive a real control program. Here is how to layer it with CIS or CRI Profile to fill the depth gap.
