FFIEC CAT Sunset Prep: A Guide to NIST CSF 2.0, CRI Cyber Profile & CIS Controls

The financial industry's cybersecurity landscape is undergoing a significant shift. With the Federal Financial Institutions Examination Council (FFIEC) announcing the sunset of the Cybersecurity Assessment Tool (CAT) by August 31, 2025, financial institutions must pivot to new resources to manage cybersecurity risks effectively. This article explores the implications of this transition and highlights the emerging frameworks that institutions should consider adopting.

The Sunset of FFIEC's Cybersecurity Assessment Tool (CAT)

Introduced in June 2015, the FFIEC's CAT was a groundbreaking tool designed to help financial institutions identify cybersecurity risks and assess their preparedness. While the CAT has served the industry well, advancements in cybersecurity threats and the development of new frameworks have prompted the FFIEC to discontinue its support.

Key Points:

Discontinuation Date: The CAT will be removed from the FFIEC website on August 31, 2025.
Reason for Discontinuation: The FFIEC has decided not to update the CAT to reflect new government resources, such as the National Institute of Standards and Technology's (NIST) Cybersecurity Framework (CSF) 2.0 and the Cybersecurity and Infrastructure Security Agency's (CISA) Cybersecurity Performance Goals.
Alternative Resources: Financial institutions are encouraged to refer directly to updated frameworks like NIST CSF 2.0 and CRI's Cyber Profile.

Read the full FFIEC Statement on Sunsetting of CAT

Embracing the NIST Cybersecurity Framework (CSF) 2.0

The NIST CSF 2.0 offers updated guidance for organizations to manage cybersecurity risks effectively.

What is NIST CSF 2.0?

Framework Overview: A comprehensive guide that provides a taxonomy of high-level cybersecurity outcomes applicable to organizations of any size, sector, or maturity level.
Flexible Implementation: The framework doesn't prescribe specific solutions but links to online resources offering additional guidance on practices and controls.
Alignment with Industry Standards: NIST CSF 2.0 is designed to align with other frameworks and can be integrated into existing risk management strategies.

Benefits for Financial Institutions:

Customized Risk Management: Allows organizations to tailor cybersecurity practices to their specific needs.
Regulatory Compliance: Helps institutions meet regulatory requirements by adhering to recognized standards.
Improved Communication: Facilitates better communication of cybersecurity efforts internally and with stakeholders.

Read the full NIST CSF 2.0

Understanding Profiles in NIST CSF 2.0

A key component of the NIST CSF 2.0 is the creation and use of Organizational Profiles and Community Profiles, which help organizations and communities understand and improve their cybersecurity posture over time.

Organizational Profiles

An Organizational Profile is a detailed representation of an organization’s current and desired cybersecurity outcomes based on the NIST CSF Core functions, categories, and subcategories. It serves as a tool to:

Assess Current State: Understand the organization's existing cybersecurity practices and how effectively they are being implemented.
Set Target Goals: Define desired cybersecurity outcomes based on mission objectives, stakeholder expectations, regulatory requirements, and threat landscape.
Prioritize Actions: Identify gaps between current and target states to develop action plans that prioritize resources and efforts.

Read the full NIST 2.0 Guide for Creating Organizational Profiles

Community Profiles

A Community Profile describes shared interests, goals, and outcomes for reducing cybersecurity risk among a group of organizations with common objectives. It serves as a consensus-driven guide for communities such as industry sectors, technology users, or organizations facing common cybersecurity challenges.

Benefits of Community Profiles:

Shared Taxonomy: Establishes a common language for discussing cybersecurity risk management.
Alignment of Priorities: Helps organizations within a community focus on common cybersecurity outcomes.
Resource Optimization: Minimizes individual effort by providing a framework that can be adapted by multiple organizations.
Enhanced Collaboration: Facilitates sharing of best practices and collective problem-solving.

Read the full NIST 2.0 Guide for Creating Community Profiles

Informative References and Implementation Examples

NIST provides additional resources to aid organizations and communities:

Informative References: Standards, guidelines, and practices like ISO/IEC 27001 or NIST SP 800-53 that offer detailed controls and measures.
Implementation Examples: Notional examples illustrating how specific cybersecurity outcomes can be achieved.

Utilizing these resources can help in selecting appropriate controls and understanding how to implement them effectively.

Utilizing Crosswalks and Mappings

Communities and organizations often face multiple cybersecurity requirements from various regulations and standards. Mappings provide a way to identify relationships between these requirements and the NIST CSF. The NIST Cybersecurity and Privacy Reference Tool (CPRT) stores mappings that can be leveraged to align practices.

Creating and Using Organizational Profiles

NIST CSF 2.0 outlines a systematic five-step process to help organizations build and leverage Organizational Profiles effectively:

NIST CSF 2.0: Creating & Using Organizational Profiles

Scope the Organizational Profile

Define Purpose: Establish why the profile is being created (e.g., compliance, risk management, strategic planning).
Set Boundaries: Determine the scope—entire organization, specific departments, data types, technologies, or third-party relationships.
Assign Responsibility: Identify the teams or individuals responsible for developing and maintaining the profile.
Consider Threats and Requirements: Outline the types of cybersecurity threats and regulatory requirements relevant to the scope.

Tip: Organizations may create multiple profiles for different areas, such as IT systems, operational technology (OT), or specific data assets.

Gather Needed Information

Collect information necessary to build the profile, which may include:

Existing Policies and Procedures: Review current cybersecurity policies, standards, and guidelines.
Risk Assessments: Incorporate findings from recent risk assessments and audits.
Regulatory Requirements: Understand applicable laws, regulations, and compliance obligations.
Community Profiles: Leverage relevant Community Profiles as a starting point or benchmark.
NIST Organizational Profile Template: Use NIST’s provided template to organize and document the profile effectively.

Prioritization is Key: Determine the relative importance of various cybersecurity outcomes to focus resources on the most critical areas.

Create the Organizational Profile

Develop both the Current Profile and the Target Profile:

Current Profile

Document Practices: Describe existing cybersecurity practices, controls, and technologies in place.
Assess Implementation: Evaluate how well each cybersecurity outcome is being achieved using qualitative or quantitative measures (e.g., ratings, percentages).
Identify Artifacts: Reference policies, procedures, and evidence that demonstrate implementation.

Target Profile

Set Goals: Define desired cybersecurity outcomes that align with organizational objectives and, where applicable, align with Community Profiles.
Assign Priorities: Use a consistent scale (e.g., High, Medium, Low) to prioritize each outcome based on its importance.
Plan Enhancements: Outline strategies and resources needed to achieve the target outcomes, considering new technologies or changes in the threat landscape.

Tailor the profiles to include information relevant to your organization, and adjust the NIST template as needed.

Analyze Gaps and Create an Action Plan

Gap Analysis

Compare Profiles: Identify differences between the Current Profile and Target Profile for each cybersecurity outcome.
Determine Gaps: Highlight areas where current practices do not meet desired goals.
Assess Impact: Evaluate the potential risks associated with each gap.

Action Plan Development

Prioritize Actions: Rank the gaps based on risk exposure and business impact to focus on high-priority areas.
Define Activities: Specify actions required to address each gap, including developing new policies, implementing controls, or acquiring technologies.
Assign Responsibilities: Identify owners for each action item and set realistic timelines.
Allocate Resources: Determine necessary resources, such as budget, personnel, or training.

Reference NIST's Informative References and Implementation Examples to guide the selection of appropriate controls and best practices.

Implement Action Plan and Update Profile

Action Plan Implementation

Execute Activities: Carry out the tasks outlined in the action plan, ensuring alignment with organizational processes.
Monitor Progress: Track implementation status, milestones, and any obstacles encountered.
Communicate: Keep stakeholders informed about progress, achievements, and changes.

Update Organizational Profile

Review Changes: Update the Current Profile to reflect new implementations and improved practices.
Reassess Gaps: Perform subsequent gap analyses to measure progress towards the Target Profile.
Adjust Goals: Modify the Target Profile if organizational objectives or external factors have changed.
Continuous Improvement: Use the insights gained to refine strategies and enhance cybersecurity maturity over time.

Regularly revisit the profiles to ensure they remain relevant and continue to drive progress.

Creating and Using Community Profiles

NIST CSF 2.0: Creating & Using Community Profiles

The process of creating a Community Profile involves several key steps:

1. Plan

Define Audience and Scope: Determine the community's characteristics and the scope of the Profile.
Identify Participants: Gather experts and stakeholders from the community.
Determine Content: Decide what to include in the Profile, such as prioritized outcomes, rationales, and references.

2. Develop

Identify Priorities: Establish shared cybersecurity priorities and objectives.
Align with CSF Outcomes: Map community priorities to NIST CSF Core outcomes.
Document the Profile: Compile the information into a usable format, including priorities, rationales, and informative references.
Engage Community Feedback: Solicit input from the wider community to refine the Profile.

3. Use

Adopt the Profile: Organizations within the community use the Community Profile to inform their own Target Profiles and cybersecurity strategies.
Assess and Benchmark: Utilize the Profile to assess current practices against community expectations.
Collaborate: Work collectively to address common challenges and improve cybersecurity posture.

4. Maintain

Measure Impact: Evaluate the effectiveness of the Community Profile in achieving cybersecurity goals.
Update Regularly: Monitor changes in threats, technologies, and regulations to keep the Profile current.
Retire if Necessary: Discontinue the Profile when it no longer serves the community's needs.

Using Community Profiles in Organizational Profiles

Organizations can incorporate Community Profiles into their Organizational Profiles by:

Leveraging Shared Priorities: Aligning organizational cybersecurity goals with those identified in the Community Profile.
Adopting Best Practices: Implementing recommended controls and practices outlined by the community.
Enhancing Assessments: Using the Community Profile to benchmark against peers and industry standards.

Example: A financial institution may use a Community Profile developed by a banking association to inform its own cybersecurity strategies, ensuring alignment with sector-specific priorities and regulatory requirements.

Next Steps and Best Practices for NIST Profiles

To effectively create and use Organizational and Community Profiles:

For Organizations:

Download NIST’s Organizational Profile Template: Use the provided Excel spreadsheet to structure your profiles.
Explore Relevant Community Profiles: Check if sector-specific profiles are available that align with your organization.
Customize the Profiles: Adjust templates and examples to fit your organizational context.
Engage Stakeholders: Involve key personnel across departments to ensure comprehensive input and buy-in.
Educate and Train: Ensure teams understand the NIST CSF and the purpose of Organizational and Community Profiles.
Leverage NIST Resources: Utilize additional guides and publications for deeper insights.

For Communities:

Collaborate with Members: Bring together organizations within the community to identify shared priorities and challenges.
Plan the Profile: Define the scope, participants, and content of the Community Profile.
Develop the Profile: Align community priorities with CSF outcomes, documenting rationales and references.
Engage the Wider Community: Solicit feedback to ensure the Profile meets the community's needs.
Promote Adoption: Encourage organizations to use the Community Profile in their cybersecurity planning.
Maintain the Profile: Regularly review and update the Profile to reflect changes in the cybersecurity landscape.

Understand the Cyber Risk Institute (CRI) Cyber Profile

The Cyber Risk Institute's (CRI) Cyber Profile is an industry-specific framework tailored for financial institutions.

About CRI:

Not-for-Profit Coalition: CRI is a coalition of financial institutions and trade associations focused on enhancing cybersecurity and resiliency through standardization.
The Cyber Profile Tool: A curated list of assessment questions based on global regulations and cybersecurity standards like ISO and NIST.

Alignment with NIST CSF 2.0:

Tight Integration: CRI's Cyber Profile version 2.0 is fully aligned with NIST CSF 2.0.
Focused on Governance: Incorporates a new "Govern" function, emphasizing cybersecurity governance—an element critical to the financial sector.
Supply Chain Risk Management: Addresses cybersecurity supply chain issues, organizing them under an "Extend" function to highlight third-party risk management.

Why Choose CRI's Cyber Profile?

Industry-Specific: Tailored to the unique needs and regulatory environment of financial institutions.
Efficiency: Streamlines the assessment process by focusing on the most relevant risks and controls.
Collaboration with NIST: Participation in NIST's update process ensures alignment and relevance.

Read the full CRI Profile v2.0

Key Features of the CRI Profile

The CRI Profile stands out as a practical and efficient tool for financial institutions seeking to assess and strengthen their cybersecurity posture. It is thoughtfully designed to cater to organizations of varying sizes, complexities, and interconnectedness within the financial services sector. Below are its most critical components:

Impact Tiers

The CRI Profile segments organizations into four distinct impact tiers based on the potential consequences of a cybersecurity event. This categorization ensures that each organization addresses the appropriate level of risk and complexity:

Tier 1: National/Super-National Impact

Organizations in this tier are deemed the most critical by global regulatory bodies. A cyber incident at this level could destabilize national or global financial markets. Institutions like systemically important banks (SIBs) fall under this tier and must address all 318 diagnostic statements.

Tier 2: Subnational Impact

These institutions, while not globally critical, are essential to regional economies. They provide mission-critical services to millions of customers and respond to 311 diagnostic statements.

Tier 3: Sector Impact

Institutions in this tier play a vital role within the financial sector but have limited impact on national or global stability. They are assessed against 282 diagnostic statements.

Tier 4: Localized Impact

Smaller institutions, such as community banks and credit unions with less than one million customers, fall into this category. They address 208 diagnostic statements tailored to their localized impact.

This tiered approach ensures that organizations are evaluated and supported based on their operational scale and significance.

Diagnostic Statements

At the heart of the CRI Profile are its 318 diagnostic statements, each addressing critical aspects of cybersecurity, resilience, and risk management. These statements are categorized under seven core functions that reflect the components of an effective cybersecurity framework:

Govern: Focuses on aligning cybersecurity strategies with organizational goals and ensuring proper oversight.
Identify: Helps organizations assess and understand their cyber risk environment, including asset management and risk assessments.
Protect: Emphasizes the implementation of safeguards to ensure data security, identity management, and access control.
Detect: Covers continuous monitoring and event detection processes to identify potential threats.
Respond: Outlines steps for effective incident management, communication, and mitigation.
Recover: Highlights strategies for recovery planning and restoring operations after a cyber event.
Supply Chain Management: Focuses on managing risks associated with third-party vendors and external dependencies.

These diagnostic statements guide organizations through comprehensive self-assessments, highlighting areas for improvement while providing actionable steps to enhance cybersecurity resilience.

Functions and Categories

The CRI Profile’s seven core functions are broken down into detailed categories and subcategories, each corresponding to specific elements of an effective cybersecurity program. For example:

Within the Govern function, categories like Risk Management and Oversight ensure that cybersecurity policies and practices are integrated into enterprise-wide risk management frameworks.
The Protect function includes categories like Data Security and Identity Management, helping organizations implement robust safeguards for sensitive information.

This modular structure allows organizations to focus on specific aspects of cybersecurity while maintaining alignment with broader risk management goals.

Flexibility and Scalability

One of the most remarkable features of the CRI Profile is its scalability. Whether you are a global bank with complex international operations or a small community credit union, the Profile adapts to your organization’s size and risk exposure. This flexibility ensures that the framework is both practical and effective for a wide range of financial institutions.

Practical Guidance and Evidence Collection

To help organizations meet its requirements, the CRI Profile provides:

Response Guidance: Detailed explanations for each diagnostic statement, clarifying intent and offering examples of effective implementation.
Examples of Effective Evidence: Suggestions on what evidence organizations can provide to demonstrate compliance. These include mission statements, board meeting minutes, cybersecurity policies, and documented risk assessments.

This feature ensures that organizations can confidently navigate regulatory reviews and demonstrate their commitment to robust cybersecurity practices.

By combining these elements—impact tiers, diagnostic statements, and core functions—the CRI Profile provides financial institutions with a clear, actionable, and scalable framework for managing cyber risks.

Implementing the CRI Profile in Your Organization

Getting started with the CRI Profile requires a structured approach to ensure that it aligns with your organization’s unique needs. Here’s how to begin:

Determine Your Impact Tier: Use the Impact Tiering Questionnaire to identify your organization’s criticality. This step ensures that you address the appropriate number of diagnostic statements based on your potential impact on the financial sector.
Assess Cyber Risk Management Practices: Evaluate your organization using the Profile’s diagnostic statements. This process will help identify strengths and weaknesses in your cybersecurity framework.
Select Appropriate Responses: Organizations can choose from response options such as “Yes,” “No,” “Partial,” and others to indicate the status of their controls. This step provides clarity on areas that need improvement.
Develop Supporting Evidence: Collect and maintain documentation to support your responses. Examples of effective evidence include cybersecurity strategies, risk management policies, and board meeting minutes.

By following these steps, organizations can implement the CRI Profile to bolster their cybersecurity frameworks and ensure resilience against emerging threats.

Exploring the Center for Internet Security (CIS) Controls

Another valuable resource is the CIS Controls, developed by the Center for Internet Security.

What are CIS Controls?

Prioritized Safeguards: A set of 18 critical security controls designed to mitigate prevalent cyber-attacks.
Implementation Groups (IGs): Controls are grouped into IGs (one through three), allowing organizations to implement controls based on their risk assessment.
Comprehensive Support: Offers mappings to other frameworks like NIST CSF and provides free tools like the CIS Controls Assessment Tool (CIS-CAT).

Advantages for Financial Institutions:

Best Practices: Provides actionable recommendations for securing systems and networks.
Versatile Application: Suitable for organizations of various sizes, but may be more resource-intensive.
Benchmarking: Offers configuration baselines (CIS Benchmarks) for operating systems and applications.

Read the full CIS Controls v8.1

Key Updates in CIS Controls v8.1

Realigned Security Functions: Mappings updated to match NIST CSF 2.0, with added focus on governance as a critical security function.
Expanded Definitions: New glossary entries clarify terms such as "sensitive data" and "process."
Updated Asset Classes: Revised categories for enterprise assets, including IoT devices and cloud-based environments, ensuring comprehensive coverage.

The Importance of Implementation Groups (IGs)

CIS Controls are segmented into three IGs, allowing organizations to prioritize safeguards based on their size, resources, and risk profile:

IG1: Essential cyber hygiene for small enterprises with limited IT capabilities.
IG2: Advanced safeguards for medium-sized enterprises handling sensitive data.
IG3: Comprehensive measures for large organizations with regulatory and compliance obligations.

Each IG builds on the previous, ensuring a scalable approach to cybersecurity.

Critical CIS Controls for Enterprises

1. Inventory and Control of Enterprise Assets

Why It Matters: Accurate asset inventories prevent unauthorized access and support incident response.
Key Steps:
- Maintain detailed asset inventories, including cloud and IoT devices.
- Use discovery tools for real-time updates.
- Implement processes to address unauthorized assets promptly.

2. Inventory and Control of Software Assets

Why It Matters: Unauthorized or outdated software creates vulnerabilities.
Key Steps:
- Maintain an updated software inventory with details like version and licensing.
- Remove unauthorized software and implement allow listing.
- Automate software inventory management for efficiency.

3. Data Protection

Why It Matters: Data breaches lead to financial and reputational damage.
Key Steps:
- Develop a data classification scheme (e.g., sensitive, public, confidential).
- Encrypt sensitive data both in transit and at rest.
- Implement data loss prevention (DLP) solutions and log sensitive data access.

4. Secure Configuration of Enterprise Assets and Software

Why It Matters: Default configurations often lack adequate security.
Key Steps:
- Establish secure baseline configurations for all assets.
- Manage firewalls and session locking.
- Document and monitor configuration changes.

5. Account and Access Management

Why It Matters: Compromised accounts are a common entry point for attackers.
Key Steps:
- Maintain inventories of user, administrator, and service accounts.
- Enforce unique passwords and multi-factor authentication (MFA).
- Regularly audit accounts to identify dormant or unauthorized users.

How to Transition to CIS Controls v8.1

Organizations using earlier versions, such as v7 or v7.1, can transition seamlessly by leveraging the updated resources and mappings provided by CIS. The holistic approach in v8.1 ensures compatibility with existing frameworks and facilitates easier implementation.

Steps for Implementation

Assess Current Security Posture: Identify gaps using the CIS Controls self-assessment tool.
Prioritize Based on IGs: Begin with IG1 safeguards for foundational security, scaling up to IG2 and IG3 as needed.
Utilize Companion Guides: Leverage resources such as the Cloud, IoT, and Mobile Companion Guides for specific environments.
Monitor and Update Regularly: Review safeguard implementations bi-annually or as enterprise changes occur.

Choosing the Right Framework

Financial institutions must assess which framework or combination of resources best suits their cybersecurity needs.

Considerations:

Alignment with Regulations: Ensure the chosen framework aligns with regulatory requirements and industry standards.
Resource Availability: Evaluate the organization's capacity to implement and maintain the framework.
Risk Profile: Consider the institution's risk appetite and the complexity of its operations.

Current Trends:

Preference for CRI: Many institutions are gravitating towards the CRI Cyber Profile due to its industry-specific focus and alignment with NIST CSF 2.0.
Combination Approach: Some organizations may opt to use multiple resources in tandem, such as CRI, CISA's Cybersecurity Performance Goals, and CIS Controls, to achieve comprehensive coverage.

Action Steps for Financial Institutions

Review Current Cybersecurity Measures: Assess existing frameworks and tools in use, including any reliance on the FFIEC's CAT.
Explore New Frameworks: Familiarize yourself with NIST CSF 2.0, CRI Cyber Profile, and CIS Controls.
Attend Informational Webinars: Participate in upcoming webinars and workshops hosted by regulatory bodies and industry groups to gain insights.
Engage Stakeholders: Involve executive leadership and key departments in discussions about transitioning to new frameworks.
Develop an Implementation Plan: Outline a strategic approach for adopting new frameworks, including timelines, resources needed, and training requirements.
Monitor Updates: Stay informed about the release of new resources, such as CISA's upcoming Cybersecurity Performance Goals for the Financial Sector.

Partner with NETBankAudit for Cybersecurity Audits and Risk Management

The discontinuation of the FFIEC's CAT signals a significant shift in how financial institutions approach cybersecurity risk management. By embracing updated frameworks like NIST CSF 2.0 and CRI's Cyber Profile, institutions can enhance their cybersecurity posture in line with evolving threats and regulatory expectations.

NETBankAudit is your trusted partner in navigating these changes. With decades of experience specializing in cybersecurity audits, risk assessments, and compliance for financial institutions, NETBankAudit offers tailored services to help your organization achieve regulatory alignment while fortifying its defenses. From conducting penetration tests and vulnerability scans to implementing safeguards outlined in frameworks like CIS Controls v8.1, NETBankAudit ensures a comprehensive approach to risk management.

Explore our services and reach out with any questions. When you are ready to proceed with a formal proposal, complete our RFP form.

 
class SampleComponent extends React.Component { 
  // using the experimental public class field syntax below. We can also attach  
  // the contextType to the current class 
  static contextType = ColorContext; 
  render() { 
    return <Button color={this.color} /> 
  } 
}