The FFIEC Cybersecurity Assessment Tool Sunset a Year Ago. Policies Still Cite It.

The FFIEC announced on September 29, 2024 that it would sunset the Cybersecurity Assessment Tool on August 31, 2025. That date has passed. The tool is not being maintained.

The sunset statement is specific about what that means. The FFIEC said it would not update the CAT to reflect new government resources, naming NIST Cybersecurity Framework 2.0 and CISA's Cybersecurity Performance Goals as examples of material the tool would not catch up to.

A self-assessment framework that stopped tracking NIST CSF in 2024 is now two major reference updates behind. If your information security policy still names the CAT as your assessment methodology, that reference points at a frozen document.

Start with what the CAT was, because it changes the fix

The CAT was voluntary. The FFIEC released it in June 2015 as a voluntary assessment tool to help institutions identify risks and determine cybersecurity preparedness. It was never a requirement.

That matters for two reasons.

First, nobody is out of compliance for having used it, and nobody becomes compliant by adopting a specific replacement. There is no mandated successor.

Second, the actual requirement never lived in the tool. For credit unions it lives in 12 CFR Part 748 and its appendices, and the examination runs through NCUA's Information Security Examination program. The CAT was one way to prepare for that. Its retirement changes your preparation method, not your obligation.

What the FFIEC named as alternatives

The sunset statement points institutions to referring directly to current government resources and to ensuring that any self-assessment tool they use supports an effective control environment and is commensurate with their risk.

It names five specific resources:

NIST Cybersecurity Framework 2.0. CISA's Cybersecurity Performance Goals, in both the cross-sector and financial sector versions. The Cyber Risk Institute Cyber Profile. The Center for Internet Security Critical Security Controls. And for credit unions specifically, NCUA's Automated Cybersecurity Evaluation Toolbox.

Where NCUA stands

NCUA's 2026 Cybersecurity and Credit Union System Resilience Report confirms the position for credit unions.

ACET was updated in September 2025 to incorporate NIST Cybersecurity Framework 2.0 content, and NCUA notified credit unions it was available at no cost. ACET remains voluntary and is offered to help credit unions evaluate the maturity of their information security programs.

Separately, NCUA notified subscribers of an FFIEC-hosted webinar on the CAT retirement and alternative resources, which the report says highlighted solutions from the Cyber Risk Institute.

Examination itself runs through the ISE program, which NCUA describes as risk-focused and scalable, giving examiners flexibility to concentrate on areas of current or potential material risk for each credit union. The ISE program aligns with Parts 748 and 749.

So for a credit union the practical picture is: ISE is what the examination uses, ACET is the voluntary self-assessment aligned to it, and it has been current with NIST CSF 2.0 since September 2025.

What the examination actually runs on

NCUA describes the Information Security Examination program as risk-focused and scalable, tailored to each credit union's business model, and says examiners conduct an information security review through the ISE at each examination. That approach gives examiners flexibility to concentrate on areas of current or potential material risk for the specific institution.

The report also describes an ISE Toolbox application that gives examiners access to industry security standards and frameworks from NIST, the Center for Internet Security, and CISA.

Two things follow from that.

The examination is not a checklist run against a fixed questionnaire, so matching your self-assessment to a particular tool does not by itself align you to what the examiner does. And the standards bodies referenced inside the examiner toolbox are the same ones the FFIEC named as CAT alternatives, which makes the choice among them less consequential than the quality of what you produce from it.

What to do

Search your documents for the tool by name. Information security policy, risk assessment methodology, board reporting, vendor questionnaires, and any SOC 2 attestation scope language you provide to customers. The CAT tends to appear in more places than people remember putting it.

Replace the reference with your actual method, then justify the fit. Whichever framework you adopt, write down why it matches your size, complexity, and risk profile. That reasoning is the thing the FFIEC statement asks for, and it is what survives an examiner question.

If you are a credit union, download the current ACET. It has been aligned to NIST CSF 2.0 since September 2025 and costs nothing. If you last ran ACET before that update, your maturity results were scored against superseded content.

Do not treat a framework swap as a control change. Moving from the CAT to NIST CSF 2.0 or the CRI Profile changes how you measure and describe your program. It does not by itself improve anything. Run the new assessment and work the gaps it finds.

Check what your vendors still reference. Third parties who built questionnaires or attestations around the CAT may be citing a retired tool back to you. A vendor risk assessment that accepts CAT-based responses is accepting a measurement against a frozen baseline.

Source note

This article is based on the FFIEC Cybersecurity Assessment Tool Sunset announcement of September 29, 2024 and the accompanying CAT Sunset Statement, which names the alternative resources described here; and NCUA's 2026 Cybersecurity and Credit Union System Resilience Report, published June 2026 and last modified September 25, 2026, for the ACET update, the FFIEC webinar, and the description of the Information Security Examination program. NCUA regulations at 12 CFR Parts 748 and 749 are referenced as the examination basis.

Disclaimer

This article is provided for general information and does not constitute legal advice. Regulatory requirements, compliance dates, examiner priorities, and enforcement posture change frequently. The Cybersecurity Assessment Tool was a voluntary resource and no specific replacement framework is mandated. Verify current requirements against primary agency sources and your legal counsel before acting on anything described here.