NIST CSF 2.0 vs. the FFIEC CAT: What Banks Use Now

For most of a decade, a U.S. bank comparing cybersecurity frameworks was really comparing two things: the NIST Cybersecurity Framework and the FFIEC Cybersecurity Assessment Tool. That comparison has changed shape. The FFIEC retired the Cybersecurity Assessment Tool on August 31, 2025, and pointed institutions to NIST CSF 2.0 and other government and industry resources instead. The useful question now is not which of the two to follow, but how to carry a program built around the old tool onto the frameworks that replaced it.

What happened to the FFIEC Cybersecurity Assessment Tool

The FFIEC released the tool in June 2015 as a voluntary assessment to help institutions identify their risks and judge their cybersecurity preparedness. It paired an inherent risk profile with a maturity assessment across five domains, from cyber risk management and oversight to incident management and resilience, and graded maturity from Baseline to Innovative. Using it was never a regulatory requirement, although many institutions treated it as the working standard.

In its sunset statement, the FFIEC said the tool's fundamental security controls were sound, but that it had decided not to update the tool for newer government resources, including NIST CSF 2.0 and CISA's Cybersecurity Performance Goals. The statement names those two, the Cyber Risk Institute's Profile and the Center for Internet Security Critical Security Controls as resources institutions may use, while saying the FFIEC endorses no particular tool and that such tools are not examination programs. The NCUA continues to support its own voluntary Automated Cybersecurity Examination Toolbox for credit unions.

NIST CSF 2.0 in brief

NIST CSF 2.0, published in February 2024, is voluntary and written for organizations of any size and sector. Its Core sorts cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is new in 2.0, and it now holds cybersecurity supply chain risk management along with strategy, roles and policy. An organization describes where it stands and where it wants to be in current and target Organizational Profiles, and four Tiers, from Partial through Risk Informed and Repeatable to Adaptive, describe how rigorous its risk governance and management are.

The framework says what outcomes to reach, not how to reach them. That is its strength for a bank with an established program, and its weakness for one that relied on the old tool's statements to tell it what good looked like.

How the two compare

What banks use now

• NIST CSF 2.0 as the organizing framework, with Organizational Profiles for current and target state.
• CISA's Cybersecurity Performance Goals, a voluntary baseline of high-priority practices that CISA has aligned to the CSF 2.0 functions, useful as a floor for a smaller institution.
• The CRI Profile, built for and by the financial sector on top of the CSF. The Cyber Risk Institute describes the current version as aligned to CSF 2.0, with mappings to regulatory references, which is the closest thing to the old tool's banking specificity.
• The CIS Critical Security Controls for a prioritized set of technical safeguards.
• The NCUA's ACET, for credit unions that want an assessment shaped around NCUA examinations.

What examiners still look at

Retiring a self-assessment tool did not change what supervisors examine. Examiners take a risk-focused approach, and the FFIEC IT Examination Handbook's Information Security booklet remains the guidance they work from. The FFIEC's statement asks institutions to make sure any self-assessment tool they use supports an effective control environment and is commensurate with their risk, which places the burden on the institution's own choice and evidence rather than on a form.

Some obligations sit outside any framework. Under the computer-security incident notification rule, a banking organization must notify its primary federal regulator as soon as possible and no later than 36 hours after determining that a notification incident has occurred, and bank service providers have notification duties of their own. An incident response program mapped to the CSF's Respond function still has to carry that clock explicitly.

Moving a program from the old tool to CSF 2.0

Most institutions that used the old tool already hold most of what the CSF asks for. The work is reorganization and evidence, not a new program.

• Keep the inherent risk view. The old tool's strongest idea was setting expected maturity from the institution's own risk profile. The CSF leaves that to the organization, so write it down: the technologies, delivery channels, products and threats that drive the institution's risk, and the target Profile they justify.
• Map the old domains to the CSF functions. As a working approximation, not an official crosswalk: cyber risk management and oversight moves largely to Govern; threat intelligence and collaboration to Identify and Detect; cybersecurity controls across Protect and Detect; external dependency management to supply chain risk management under Govern; and incident management and resilience to Respond and Recover.
• Re-point the evidence. Policies, test results and board reporting gathered for the old maturity statements usually support CSF outcomes too. Re-index them to the subcategories rather than collecting them again.
• Choose a sector layer deliberately. The CSF alone is sector-agnostic. A bank that wants assessment statements written for financial institutions can use the CRI Profile on top of it; a smaller one may find the CISA goals a more practical baseline.
• Tell the board what changed. Board reporting built on maturity levels needs a new scale, and Tiers measure risk governance rather than control maturity, so avoid presenting one as a renamed version of the other.