The FFIEC retired CAT—here’s why financial institutions are turning to CRI

When the Federal Financial Institutions Examination Council (FFIEC) released its Cybersecurity Assessment Tool (CAT) in 2015, it became the industry standard for evaluating cyber readiness.

‍

A decade later, the threat landscape has evolved—and rather than updating the CAT, the FFIEC retired it on August 31, 2025. With CAT no longer the industry's best practice, many financial institutions are asking: What’s next?

‍

At Vanta, we recommend that financial institutions migrate to the Cyber Risk Institute (CRI) Profile. Developed in collaboration with regulators and industry leaders, the CRI Profile is a globally recognized, non-regulatory, comprehensive framework that unites overlapping cybersecurity and risk management requirements and serves as a common baseline for supervisory exams, board reporting, and third-party risk assurance.

‍

Why migrate to the CRI Profile?

The CRI Profile was built by and for the financial services industry in partnership with regulators and leading banks. It’s designed to harmonize overlapping requirements from frameworks like NIST CSF 2.0, the EU’s DORA, Singapore’s MAS TRM Guidelines, Australia’s APRA, and the U.S.’s FFIEC, making it a natural replacement for CAT.

‍

In fact, regulators globally are increasingly using CRI as a baseline in exams, and regulators and supervisors will increasingly expect institutions to reference the CRI Profile instead.

By starting the migration today, institutions can avoid last-minute fire drills, reuse much of their CAT evidence, and position themselves for stronger, more resilient supervisory reviews.

‍

How the CRI Profile compares to CAT

The CRI Profile isn’t just the successor to FFIEC CAT—it’s a more comprehensive, regulator-backed framework that helps financial institutions prove readiness and resilience across jurisdictions. 

‍

For example, the FFIEC CAT was a voluntary tool designed to help financial institutions identify cyber risks and assess their preparedness. However, its static, checkbox structure has struggled to help institutions keep pace with today’s evolving threats and increasing regulatory expectations.

‍

The CRI Profile, on the other hand, is designed to be a more dynamic, streamlined framework with a broader security scope. For instance, the CRI Profile builds on NIST CSF 2.0 and adds depth in governance, third-party risk, and resilience, offering proportional scaling through four impact tiers:

‍

• Tier 1: Largest, most complex, and systemically important institutions
• Tier 2: Mid-sized financial institutions with significant regional or cross-border operations
• Tier 3: Smaller, often regional or specialized financial entities
• Tier 4: Community banks, fintechs, and service providers operating at lower systemic risk levels

‍

CRI also provides a dedicated Cloud Profile with tailored guidance for AWS, Azure, and GCP environments. 

‍

How to replace FFIEC CAT with CRI

Transitioning doesn’t mean starting from scratch. The Cyber Risk Institute provides tools to make migration straightforward. Follow these steps to upgrade from CAT to the CRI Profile.

‍

1. Download the CRI Profile and the CRI Profile Mappings Catalog from the Cyber Risk Institute website.
   
   
   1. Open the “FFIEC CAT” tab in the Mappings Catalog. Here you’ll find direct mappings from each CAT statement to the corresponding CRI diagnostic statement.
2. Determine your impact tier. CRI scales expectations across four tiers—from Tier 1 for global institutions to Tier 4 for community banks and service providers. The tiering questionnaire will tell you which level applies to you.
3. Scope your diagnostic statements. Based on your tier, you’ll see which CRI diagnostic statements are in scope for your organization.
4. Map your evidence. Use the Mappings Catalog to align the evidence you already collected for CAT with the relevant CRI diagnostic statements.
5. Run your CRI assessment. With evidence mapped, continue with the CRI diagnostic assessment to identify gaps, remediate them, and prepare for supervisory exams.

‍

Switch to CRI with Vanta 

The CRI Profile is quickly becoming the go-to security baseline for the financial sector. Vanta automates CRI alignment, which unifies frameworks like DORA, APRA, and MAS TRM. With 318 controls, four impact tiers, and AI-powered workflows, you can reduce manual work, avoid duplication, and stay resilient across global regulations and supervisory expectations.

‍

Learn more about how Vanta can help you prove trust to regulators and customers with CRI.

‍