The CAT’s retirement freed the framework and orphaned the risk profile
When the FFIEC retired its Cybersecurity Assessment Tool on August 31, 2025, attention went to picking a replacement framework. The harder loss was the inherent risk profile, the step that told a bank how much security it needed.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
The Federal Financial Institutions Examination Council removed its Cybersecurity Assessment Tool from its website on August 31, 2025. The council had announced the sunset on August 29, 2024. It cited newer resources such as NIST’s Cybersecurity Framework 2.0 and CISA’s Cross-Sector Cybersecurity Performance Goals, and named industry-developed tools as alternatives without endorsing any one. The tool, released in 2015, had always been voluntary. Supervisors stressed that expectations for cybersecurity risk assessment were unchanged. The Federal Reserve relayed the sunset to its institutions in SR 24-7 in November 2024. The NCUA said it would keep its own Automated Cybersecurity Evaluation Toolbox, built on the same structure, available to credit unions and update its content toward the newer frameworks. The first week of September 2025 was the first in a decade without the FFIEC tool.
Most discussion of the sunset was about which framework to adopt next. That question has reasonable answers and plenty of vendor support. A quieter loss deserves more attention. The tool had two halves. The second half, the maturity assessment, has many substitutes. The first half, the inherent risk profile, has almost none. It was the step that told a community bank, before any control was scored, how much security its business model demanded. This article looks at three things: what the risk profile did, why the replacement frameworks do not supply it, and how an institution can rebuild the sizing step on ground it owns.
What the risk profile did
The inherent risk profile asked an institution to rate its activities in five categories. They were technologies and connection types, delivery channels, online and mobile products and technology services, organizational characteristics, and external threats. Each activity was placed on a scale from least to most risk. A bank with a handful of branches, no mobile deposit and a single core processor would land low. A bank offering business payments, many vendor connections and a fintech partnership program would land much higher.
The maturity half then had a built-in benchmark. The tool’s guidance expected maturity to rise as inherent risk rose. A low-risk bank at Baseline maturity could defend that position. A high-risk bank at the same level had a visible gap. That pairing gave boards and examiners a simple test of proportionality. The interagency information security standards under the Gramm-Leach-Bliley Act ask for exactly that: a program appropriate to the institution’s size, complexity, and the nature and scope of its activities.
The profile also forced change to show up. Launching instant payments, adding an API channel or acquiring a branch network moved specific ratings. A bank could see its required maturity drift upward before an incident made the case.
Why the replacements do not supply it
NIST’s Cybersecurity Framework 2.0 is a strong structure for describing outcomes. It asks organizations to build a current profile and a target profile. It does not tell them where the target should sit. Its tiers, from Partial to Adaptive, describe the rigor of risk governance practices, not the exposure created by a business model. An institution can pick a modest target and still be internally consistent.
CISA’s Performance Goals go the other way. They are a common baseline intended for organizations of every size, so they say little about what a more exposed institution needs beyond the floor.
The Cyber Risk Institute’s Profile, built for financial firms on the NIST structure, comes closest. It begins with a tiering questionnaire that scopes which diagnostic statements apply. Its tiers center on an institution’s potential impact on the financial sector and its customers, which is related to exposure but is not the same thing. Two community banks of similar size may tier alike under that approach while carrying very different attack surfaces. Credit unions that keep using the NCUA’s toolbox retain a version of the original profile, which makes their position simpler for now.
The result is a gap at the start of the process. Many banks moved to a new framework in 2025 and kept scoring controls, but stopped asking how much control their activities required.
How to rebuild the sizing step
The fix does not require a new tool. It requires putting the exposure inventory back inside the institution’s own information security risk assessment, where the interagency standards already locate it. That assessment is an obligation in its own right, separate from any framework choice.
A practical rebuild has three pieces. The first is an exposure register that tracks the drivers the old profile captured, in the institution’s own terms: payment rails offered, such as wires, ACH and instant payments; customer channels and APIs; third-party connections into the core; fintech and banking-as-a-service partners; and recent mergers or conversions. Each entry needs an owner in the business line, because the security team rarely hears about a new channel first.
The second is a rule that links the register to the framework target. A bank might decide that offering instant payments raises its target for detection and response outcomes, or that any third-party connection with write access to the core raises its target for supply chain risk management. The rules can be simple. What matters is that the target follows from documented exposure, so a reviewer can trace why it sits where it does.
The third is a trigger. New products, channels and vendors should pass through the register before launch, through the new product and third-party approval processes most banks already run. That restores the early warning the old profile gave, while it can still change a design.
The trade-off is effort. The CAT came with categories already written. A home-built register needs maintenance, and it can be gamed by an institution that wants a low target. Internal audit should test it the way it tests any risk assessment: by checking that known products and vendors appear in it and that ratings moved when the business changed.
With hindsight
Examinations continued through late 2025 and 2026 under existing procedures and the FFIEC IT Examination Handbook, and institutions presented assessments built on a range of frameworks, including NIST CSF 2.0 and the CRI Profile. The NCUA kept its toolbox available to credit unions, as it had said it would. We have not seen evidence of examiners penalizing any particular framework choice, which is consistent with supervisors’ statements that expectations had not changed.
The sizing gap is harder to observe from outside, because it shows up as targets that never move rather than as findings. Institutions that wired product and vendor approvals into their risk assessment kept a link between business change and security investment. Those that only swapped scoring frameworks kept measuring controls without a clear view of how much control their business model needed.