What Replaced the FFIEC CAT? A Bank Exam Guide for 2026

For community and mid-size banks, a cybersecurity examination in 2026 doesn't look like the one your institution sat through three years ago. Here's what's actually changed, what examiners are testing against now, and where the industry is headed next.

 

For nearly a decade, the FFIEC Cybersecurity Assessment Tool (CAT) was the closest thing community banks had to a shared script for exam prep. You mapped your controls to its maturity tiers, walked in with a completed workbook, and had a rough sense of what the examiner would ask. On August 31, 2025, the FFIEC pulled that script away — the CAT was formally retired and removed from the FFIEC's website, with no single tool named to replace it.

 

That gap is exactly why banks are asking what a "modern" exam actually looks like now. Here's what we know, grounded in the regulators' own guidance rather than speculation.

 

What Actually Changed: The CAT Retirement, Explained

 

The FFIEC's sunset announcement and the follow-up notices from the Federal Reserve (SR 24-7) and the OCC (Bulletin 2024-25) all say the same thing in slightly different words: the CAT is gone, and the FFIEC is deliberately not endorsing a single replacement.

 

Instead, the FFIEC points institutions toward a menu of frameworks that examiners will accept as a basis for your risk assessment:

 

The examination approach itself doesn't change — it's still described as "risk-focused" — but the tool you use to demonstrate that risk focus is now your choice to make and defend, not a checkbox you fill in against a single FFIEC-issued worksheet.

 

Practically, that means two things for a mid-size bank: first, you need to formally pick a framework (or a documented blend) and be able to explain why it fits your risk profile. Second, "we used to use the CAT" is no longer an answer an examiner will accept on its own — the underlying risk assessment still has to exist, it just doesn't have a single prescribed shape anymore.

 

What Examiners Are Actually Testing Against

 

With the CAT gone, the FFIEC IT Examination Handbook has become the more visible backbone of what examiners test against. The Handbook's booklets — including Information Security, Business Continuity Management, Outsourcing Technology Services, and Management — remain live and current on the FFIEC's InfoBase.

 

In the exam room, that translates into the same core questions it always has, just without a single scoring tool tying them together:

 

 

 

The 2026 Focus Areas Regulators Are Flagging

 

The OCC's 2026 Cybersecurity and Financial System Resilience Report calls out a few specific themes worth knowing before your next exam cycle: AI-enabled cybercrime (automated reconnaissance, social engineering, and adaptive malware), third-party and vendor concentration risk — specifically around core processors, cloud providers, and fintech partners — and continued attention to the 36-hour Computer-Security Incident Notification Rule.

 

Third-party risk in particular is showing up across the industry, not just at the OCC. Reporting from early-to-mid September 2026 indicates the banking agencies are moving toward a more prescriptive third-party risk management framework, with additional scrutiny of core provider business practices specifically.

 

It's worth noting what we didn't find: unlike the National Credit Union Administration, which issues a numbered supervisory priorities letter each year — Letter 26-CU-01 lays out NCUA's 2026 priorities in one place, with vendor and payment-systems governance called out directly8 — the OCC, FDIC, and Federal Reserve don't publish an equivalent single document for banks. Their priorities are spread across the OCC's Semiannual Risk Perspective, its Cybersecurity and Financial System Resilience Report, and similar periodic publications, which makes them easy to miss if you're not tracking all of them.

 

Why This Matters: The Cost of Getting Vendor Risk Wrong

 

The regulatory emphasis on third-party risk isn't abstract. In August 2025, Marquis Software Solutions — a vendor serving more than 700 banks and credit unions — was breached after attackers, believed to be affiliated with the Akira ransomware group, exploited a SonicWall firewall vulnerability. The incident affected 74 financial institutions and exposed data on more than 400,000 consumers, including Social Security numbers, dates of birth, and financial account information.

 

That incident sits alongside several of the largest banking data breaches of 2025 tracked by American Banker, from a 13.1-million-record exposure at Prosper Marketplace to a social-engineering-driven breach at TransUnion affecting 4.5 million people.10 The pattern across nearly all of them is the same one regulators are now examining more closely: the breach didn't start inside the bank's own walls.

 

Exams Are Evolving Beyond Just the Tools

 

The CAT retirement isn't happening in isolation. American Banker reported in June 2026 that the FFIEC is also revisiting the "Management" component of the CAMELS rating system — the framework examiners use to rate institutions overall — moving toward more objective, less subjective metrics. Taken together with the CAT's retirement, it points to a broader shift: less reliance on a single standardized tool, more expectation that institutions can independently demonstrate and document sound judgment.

 

What This Means for Your Institution

 

None of this means your next exam will be harder in a way that requires new capabilities you don't already have. It means the burden of proof has shifted slightly — from "did you fill out the standard tool correctly" to "can you show your work." A few practical steps worth taking before your next cycle:

 

InfoSight has spent more than 25 years building risk assessments and security programs for financial institutions that hold up under this kind of scrutiny — not just on paper, but in the exam room. If your risk assessment framework hasn't been revisited since before the CAT retirement, it's worth a conversation before your next exam, not during it.

 

That's the "Powered by AI, Fueled by Experts" model in practice — automation that keeps pace with your environment, and people who've done this work long enough to know what an examiner is actually asking.

 

Sources

This post is for informational purposes only and does not constitute legal or regulatory compliance advice.

1. Cybersecurity Assessment Tool | FFIEC — official retirement notice and guidance on the menu of replacement frameworks (NIST CSF 2.0, CISA CPGs, CRI Profile, CIS Controls).
2. SR 24-7: Sunset of the FFIEC Cybersecurity Assessment Tool | Federal Reserve, Nov. 22, 2024.
3. OCC Bulletin 2024-25.
4. FFIEC IT Examination Handbook InfoBase — booklet list including Information Security, Business Continuity Management, Outsourcing Technology Services, and Management.
5. OCC 2026 Cybersecurity and Financial System Resilience Report; summarized in Young & Associates, "Takeaways from the OCC Cybersecurity Report," June 2026.
6. Consumer Finance Monitor, "Banking Agencies Propose More Prescriptive Third-Party Risk Management Framework," Sept. 17, 2026.
7. ABA Banking Journal, "Banking agencies pledge more scrutiny of core provider business practices," Sept. 2026.
8. NCUA's 2026 Supervisory Priorities (Letter 26-CU-01), issued January 2026.
9. BleepingComputer, "Marquis data breach impacts over 74 US banks, credit unions," 2025.
10. American Banker, "The seven largest banking data breaches of 2025". ↩
11. American Banker, "Ready or not, bank examination is changing for good," June 8, 2026.
12. Industry commentary on post-CAT framework selection: Ncontracts, "What Examiners Expect After the FFIEC CAT"; CompassITC, "Replacing the FFIEC CAT with NIST CSF 2.0". These are vendor/advisory perspectives, not regulatory guidance, and are cited here as industry color rather than authoritative sources.