Regulatory updates

FFIEC CAT Sunset Date

January 23, 2025

On August 29, 2024, the FFIEC published announcement 2024-03 stating that the Cybersecurity Assessment Tool (CAT) would sunset on August 31, 2025.

FFIEC originally released the CAT in June 2015 allowing financial institutions to voluntarily identify and remediate their cybersecurity risks. A lot has changed since the CAT was released and the FFIEC has decided to not update the CAT, and to instead allow its members to utilize new government resources like the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 and the Cybersecurity and Infrastructure Security Agency’s (CISA) Cybersecurity Performance Goals.

If you're looking for assistance in this transition to NIST CSF 2.0 or other information security, privacy, and AI compliance needs.

Resources:

https://www.ffiec.gov/press/an082924.htm
https://www.ffiec.gov/press/pdf/CAT_Sunset_Statement_FFIEC_Letterhead.pdf