The exam didn't go away.
The tool you used for it did.

No — this is the most common misunderstanding. The FFIEC (Federal Financial Institutions Examination Council) is not a certification body and there's no FFIEC certificate to earn. It's an interagency council — the Federal Reserve, FDIC, OCC, NCUA, and CFPB — that issues uniform standards and examination procedures. Its member agencies then examine banks, credit unions, and their technology service providers against those standards.

What you actually prepare for is an IT examination, and what examiners use is the FFIEC IT Examination Handbook — booklets covering information security, business continuity, architecture and operations, development and acquisition, audit, management, and outsourcing. "FFIEC readiness" means being ready to demonstrate, with evidence, that your security and technology risk management meet those expectations. We prepare you for the exam, not a certificate that doesn't exist.

The FFIEC Cybersecurity Assessment Tool was sunset and removed from the FFIEC website on August 31, 2025, and the FFIEC decided not to update it. The critical point is what did not change: examiners still expect an annual cybersecurity self-assessment. Only the tool retired, not the obligation.

The FFIEC didn't endorse a single replacement, but pointed to newer resources including the NIST CSF 2.0 and CISA's Cybersecurity Performance Goals. The most widely adopted successor among financial institutions is the Cyber Risk Institute (CRI) Profile, because it's built for the financial sector, maps directly to the retired CAT, and scales to your size and risk. Credit unions also have the NCUA's ACET, derived from the CAT and still supported. The right move: choose a fitting framework, map your prior CAT results into it so you keep your history, and run your next self-assessment against it before your exam.

No — and treating it that way is the trap. The FFIEC was explicit that expectations for cybersecurity self-assessments have not changed; the only change is the CAT's retirement from the available tools. Many institutions are also subject to state requirements — several state banking departments require state-chartered institutions to assess cybersecurity maturity annually — so the obligation often exists at both the federal-exam and state levels.

If anything, the sunset raises the bar: you can no longer point to a familiar, examiner-recognized tool, and instead must select an appropriate framework, justify the choice, and demonstrate a credible, repeatable process. An institution that quietly stopped self-assessing when the CAT retired would be in a worse position at its next exam, not a better one. We help you make and document the framework selection, run the assessment, and produce results examiners and your board will accept.

They operate at different layers and increasingly point the same direction. NIST publishes the underlying frameworks and control catalogs — the CSF 2.0 and SP 800-53 — that define good practice. The FFIEC sets examination expectations for financial institutions and has steadily aligned its IT Handbook booklets with NIST references rather than maintaining a separate parallel system; retiring the CAT in favor of pointing to the NIST CSF 2.0 is part of that same convergence.

So you're not really choosing between FFIEC and NIST: you use a NIST-aligned framework, or the financial-sector CRI Profile that extends the NIST CSF, to run your assessment, and you map it to the FFIEC IT Handbook expectations examiners apply. For an institution that already has a NIST CSF program, much of the substance carries over — the work is organizing it into a financial-institution self-assessment with the evidence an examiner expects. We handle that mapping so one program satisfies both the framework and the exam.