What Is FFIEC?

The FFIEC exists so that a bank examined by the FDIC and a credit union examined by the NCUA face consistent supervisory expectations. For security teams, its most visible output is the IT Examination Handbook series, whose booklets on information security, business continuity, architecture and operations, and development set the baseline examiners test against during IT examinations. The FFIEC also issues joint statements on emerging risks such as ransomware and authentication.

Its standards matter to every federally supervised depository institution, meaning banks, thrifts, and credit unions, and by extension to the technology service providers those institutions rely on, since examiners review third-party relationships as part of the same process.

The most consequential recent change is the retirement of the FFIEC Cybersecurity Assessment Tool (CAT) on August 31, 2025. For nearly a decade the CAT was the default self-assessment for community and mid-size institutions. Institutions that built their board reporting around CAT maturity levels now need a replacement, and supervisory communications have pointed toward recognized alternatives such as the NIST Cybersecurity Framework and sector profiles. The practical implication is a migration project: pick a successor framework, map prior CAT results into it, and preserve the trend history examiners and boards expect. Z Cyber runs this transition for institutions as described on our financial services page.