FFIEC Cybersecurity Assessment Tool (CAT): What Banks Get Wrong and How to Pass Your Next Exam
The FFIEC CAT has been the primary cybersecurity examination framework for US banks since 2015. Yet examiners still find the same gaps repeatedly — inherent risk underestimation, maturity level inflation, and governance documentation that does not match actual practice. Here is how to close those gaps before your next exam.
Why Banks Fail FFIEC Cyber Exams
The FFIEC Cybersecurity Assessment Tool assesses two dimensions: Inherent Risk (the risk embedded in your business model, products, and technology) and Cybersecurity Maturity (the controls you have in place to manage that risk). The most common examiner findings are not about missing controls — they are about the gap between documented maturity and actual practice.
The 5 Most Common FFIEC Exam Findings
- Inherent risk underestimated: Organisations rate themselves lower-risk than their technology stack, third-party dependencies, and transaction volumes justify. Examiners see through this immediately.
- Maturity levels not supported by evidence: Claiming "Managed" maturity requires documented metrics, control testing results, and independent validation — not just policy documents.
- Third-party risk register incomplete: Many banks cannot produce a complete list of ICT vendors with documented criticality ratings and last assessment dates.
- Incident response plan not tested: A plan that has never been exercised is not a plan — it is a document. Examiners ask for tabletop exercise records.
- Board reporting insufficient: Cybersecurity risk must be reported to the board in language the board can act on, with KPIs and trend data. Generic security updates do not satisfy examiners.
The Pre-Exam Preparation Checklist
- Complete inherent risk self-assessment with supporting evidence (transaction volumes, third-party count, technology complexity)
- Maturity statements backed by documented evidence for each declarative statement
- Third-party vendor register with criticality, last assessment date, and remediation tracking
- Incident response plan with tabletop exercise record from the last 12 months
- Board cybersecurity report from the last 3 board meetings
- Penetration test report from the last 12 months, with remediation tracking
- User access review evidence from the last 90 days
HorizonShield FFIEC Readiness Assessment
We conduct FFIEC pre-examination readiness assessments that simulate the examiner's process — identifying gaps before examiners do. Our team has direct experience operating inside institutions subject to FFIEC examination, which means we know the questions examiners ask before they ask them.
Cybersecurity expert at HorizonShield, specializing in threat intelligence, incident response, and enterprise security architecture.