Skip to content

FFIEC Cybersecurity Assessment Tool

Best for: U.S. financial institutions regulated by the Federal Reserve, FDIC, OCC, NCUA, or state banking departments, including banks, credit unions, savings associations, and bank holding companies. No revenue or asset threshold applies; the CAT is a voluntary self-assessment tool. The FFIEC sunset it effective August 31, 2022, so examiners no longer require it, but institutions may still use it internally.

Mandatory?Strongly recommended for U.S. financial institutions; not formally required
Who validates?Federal examiner review (Fed, FDIC, OCC, NCUA, CFPB)
RenewalNo fixed cycle; tied to exam cycle
ScopeAll U.S. financial institutions including banks, credit unions, savings associations

🏛 Federal Financial Institutions Examination Council (FFIEC), a formal interagency body comprising the Federal Reserve Board, FDIC, OCC, NCUA, CFPB, and the State Liaison Committee. · FFIEC CAT (2015) Official source →

Get Started

module "..." {
  source  = "ffiec.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

What Compliance.tf Covers vs. What You Handle

  • What Compliance.tf automates

    • Audit Trail and Logging: Ten controls check the full CloudTrail lifecycle: multi-region configuration, S3 data event logging for both read and write operations, CloudWatch integration, log group retention periods, and alarm action enablement.
    • Encryption and Certificate Management: Checks ACM certificate expiration within 30 days, SSL certificate attachment on API Gateway stages, backup recovery point encryption, and absence of plaintext sensitive values in CodeBuild environment variables.
    • Network and Perimeter Security: Validates WAF web ACL association on API Gateway stages and flags Auto Scaling launch configurations that assign public IPs to instances intended to stay private.
    • Backup and Disaster Recovery: Four controls confirm backup plan minimum retention of 35 days, recovery point minimum retention of 35 days, manual deletion protection on recovery points, and health check configuration on Auto Scaling groups behind load balancers.
    • Sensitive Data Handling: Detects plaintext AWS credentials and sensitive values in CodeBuild project environment variables. Flags configurations where secrets should use Parameter Store or Secrets Manager instead.

  • What you handle

    • Audit Trail and Logging: Log review procedures, a security operations function staffed to act on alerts, incident escalation documentation, and examiner-ready evidence that logs are reviewed, not just collected.
    • Encryption and Certificate Management: Establishing a key management policy, defining approved encryption algorithms, managing certificate renewal workflows, and documenting encryption standards in your information security program.
    • Network and Perimeter Security: WAF rule tuning, firewall change management procedures, network segmentation documentation, and periodic penetration testing to validate perimeter controls.
    • Backup and Disaster Recovery: Business continuity plan documentation, annual DR testing with documented results, recovery time objective validation, and examiner-ready evidence that backups are actually restorable.
    • Sensitive Data Handling: Data classification per your information classification policy, DLP controls beyond infrastructure configuration, and developer training on secure credential handling.

Controls by Category

Cyber Incident Management and Resilience: Backup and Recovery (1 control)

Domain 5 requires tested backup and recovery capabilities, not just configured ones. Examiners want evidence that retention meets your BCP requirements, that recovery points are protected against premature deletion (ransomware resilience), and that health checks enable automatic failover. The recurring challenge is proving that recovery point objectives align with documented BCP/DR plans.

Backup plan min frequency and min retention check

Detective Controls: Audit Trail and Monitoring (5 controls)

Domain 3's Detective Controls factor centers on visibility. Examiners check whether logs are centralized, retained per policy and regulatory expectations (the CAT sets no fixed 365-day minimum), and configured to alert on anomalous activity. The most common gap: CloudTrail enabled in only one region, or S3 data event logging missing entirely, which leaves significant blind spots.

At least one enabled trail should be present in a region CloudTrail trails should be integrated with CloudWatch logs API Gateway stage logging should be enabled CloudWatch alarm should have an action configured compliance.tf module Log group retention period should be at least 365 days compliance.tf module

Preventative Controls: Data Protection and Encryption (1 control)

Under Domain 3 Preventative Controls, examiners verify that data in transit and at rest is encrypted using current standards. Expired or soon-to-expire TLS certificates, plaintext credentials in build configurations, and unencrypted backups are recurring findings. Institutions must also show that encryption key management aligns with the institution's risk appetite and that sensitive values never appear in plaintext configuration.

API Gateway stage should uses SSL certificate
Additional Controls (77)

AWS Database Migration Service (1)

DMS replication instances should not be publicly accessible compliance.tf module

AWS IAM (7)

Ensure IAM password policy requires a minimum length of 14 or greater Ensure IAM password policy requires at least one lowercase letter Ensure IAM password policy requires at least one number Ensure IAM password policy requires at least one symbol Ensure IAM password policy requires at least one uppercase letter Password policies for IAM users should have strong configurations with minimum length of 8 or greater IAM password policies for users should have strong configurations

AWS Lambda (4)

Lambda functions concurrent execution limit configured compliance.tf module Lambda functions should be configured with a dead-letter queue compliance.tf module Lambda functions should be in a VPC compliance.tf module Lambda functions should restrict public URL compliance.tf module

Amazon DynamoDB (1)

DynamoDB table point-in-time recovery should be enabled compliance.tf module

Amazon EBS (2)

Attached EBS volumes should have encryption enabled compliance.tf module EBS volume encryption at rest should be enabled compliance.tf module

Amazon EC2 (4)

EC2 instances should have IAM profile attached compliance.tf module EC2 instances should be in a VPC compliance.tf module EC2 instances should not have a public IP address compliance.tf module Ensure IAM instance roles are used for AWS resource access from instances compliance.tf module

Amazon EFS (2)

EFS file system encryption at rest should be enabled compliance.tf module EFS file systems should be encrypted with CMK compliance.tf module

Amazon EMR (1)

EMR cluster Kerberos should be enabled compliance.tf module

Amazon ElastiCache (1)

ElastiCache Redis cluster automatic backup should be enabled with retention period of 15 days or greater compliance.tf module

Amazon OpenSearch Service (3)

OpenSearch domains should have encryption at rest enabled compliance.tf module OpenSearch domains logs to AWS CloudWatch Logs compliance.tf module OpenSearch domains node-to-node encryption should be enabled compliance.tf module

Amazon RDS (16)

RDS DB clusters should have automatic minor version upgrade enabled RDS clusters should have deletion protection enabled compliance.tf module RDS DB instance and cluster enhanced monitoring should be enabled compliance.tf module RDS DB instance automatic minor version upgrade should be enabled compliance.tf module RDS DB instance backup should be enabled compliance.tf module RDS DB instances backup retention period should be greater than or equal to 7 compliance.tf module RDS DB instances should be integrated with CloudWatch logs compliance.tf module RDS DB instances should have deletion protection enabled compliance.tf module RDS DB instance encryption at rest should be enabled compliance.tf module Database logging should be enabled compliance.tf module RDS for MariaDB DB instances should publish logs to CloudWatch Logs compliance.tf module RDS DB instance multiple az should be enabled compliance.tf module RDS DB instances should not use public subnet compliance.tf module RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs compliance.tf module RDS DB instances should prohibit public access compliance.tf module RDS for SQL Server DB instances should publish logs to CloudWatch Logs compliance.tf module

Amazon Redshift (9)

AWS Redshift audit logging should be enabled compliance.tf module AWS Redshift clusters should have automatic snapshots enabled compliance.tf module AWS Redshift should have automatic upgrades to major versions enabled compliance.tf module Redshift cluster encryption in transit should be enabled compliance.tf module Redshift cluster audit logging and encryption should be enabled compliance.tf module AWS Redshift enhanced VPC routing should be enabled compliance.tf module AWS Redshift clusters should be encrypted with KMS compliance.tf module AWS Redshift should have required maintenance settings compliance.tf module Redshift clusters should prohibit public access compliance.tf module

Amazon S3 (12)

S3 bucket cross-region replication should be enabled compliance.tf module S3 bucket default encryption should be enabled compliance.tf module S3 bucket default encryption should be enabled with KMS compliance.tf module S3 bucket logging should be enabled compliance.tf module S3 bucket ACLs should not be accessible to all authenticated user compliance.tf module S3 bucket object lock should be enabled compliance.tf module S3 buckets object logging should be enabled S3 bucket policy should prohibit public access compliance.tf module S3 buckets should prohibit public read access compliance.tf module S3 buckets should prohibit public write access compliance.tf module S3 bucket versioning should be enabled compliance.tf module S3 public access should be blocked at account level compliance.tf module

Amazon SageMaker (1)

SageMaker notebook instances should not have direct internet access

Amazon VPC (1)

VPC subnet auto assign public IP should be disabled compliance.tf module

Elastic Load Balancing (8)

ELB application and classic load balancer logging should be enabled compliance.tf module ELB application load balancer deletion protection should be enabled compliance.tf module Application and Network Load Balancers with listeners should use recommended security policies compliance.tf module ELB application and network load balancers should only use SSL or HTTPS listeners compliance.tf module Application and Network Load Balancer listeners should use secure protocols to encrypt data in transit compliance.tf module ELB classic load balancers should have cross-zone load balancing enabled compliance.tf module ELB network load balancers should have TLS listener security policy configured compliance.tf module ELB listeners SSL/TLS protocol version should be checked compliance.tf module

Other (4)

ES domain encryption at rest should be enabled ES domains should be in a VPC Elasticsearch domain should send logs to CloudWatch Elasticsearch domain node-to-node encryption should be enabled

  • NIST CSF — 🟢 High overlap (70%)

    The FFIEC CAT was designed to align with the NIST Cybersecurity Framework. There is substantial overlap across Identify, Protect, Detect, Respond, and Recover, but the CAT's five maturity domains are not a direct one-to-one rename of the NIST CSF functions. Institutions already using NIST CSF will find significant reuse, though the CAT adds financial-sector-specific context around inherent risk profiling.

  • NIST 800-53 Rev 5 — 🟡 Medium overlap (55%)

    NIST 800-53 provides the detailed control catalog that underpins many FFIEC expectations. The CAT's maturity statements at the Evolving and Intermediate levels often correspond to specific 800-53 control families (AU for audit, SC for system and communications protection, CP for contingency planning). The FFIEC mapping is less granular but covers similar ground.

  • PCI DSS v3.2.1 — 🟡 Medium overlap (35%)

    Overlap concentrates in encryption requirements, logging and monitoring, and access controls. PCI DSS is more prescriptive about specific technical configurations (e.g., TLS versions, log retention of one year). Financial institutions processing card transactions often satisfy both frameworks with a unified control set, but PCI DSS has stricter scoping rules around cardholder data environments.

Frequently Asked Questions

Is the FFIEC CAT mandatory, or is it optional guidance?

The CAT is voluntary. No law or regulation requires its use. FFIEC announced the sunset effective August 31, 2022 and confirmed it will not be updated. Examiners assess cybersecurity through FFIEC handbooks and agency procedures; institutions may still use the CAT internally, but there is no examiner requirement to do so.

How long does a full FFIEC CAT self-assessment take?

For a community bank or credit union, expect 2 to 4 weeks of staff time across IT, compliance, and risk management. The Inherent Risk Profile takes a few days; the Cybersecurity Maturity assessment is the bulk of the work, requiring evidence gathering across all five domains. Larger institutions with complex environments and multiple business lines may need 6 to 8 weeks. The first assessment always takes the longest; subsequent annual updates go faster if you maintain your evidence repository.

How does the Inherent Risk Profile affect what maturity level I need?

The CAT uses a matrix. Your Inherent Risk Profile score (Least, Minimal, Moderate, Significant, or Most) determines the minimum cybersecurity maturity level expected. A Least-risk institution may only need Baseline maturity; a Significant-risk institution needs at least Intermediate, and examiners may push for Advanced in specific domains. Most mid-size banks land at Moderate risk, which requires Evolving maturity at minimum.

What is the relationship between FFIEC CAT and the FFIEC IT Examination Handbooks?

The CAT complements the IT Examination Handbooks but does not replace them. The handbooks (Information Security, Business Continuity, Outsourcing Technology Services, and others) contain the detailed examination procedures that examiners follow. The CAT is a higher-level self- assessment that maps to concepts in the handbooks. Think of the handbooks as the examiner's detailed playbook and the CAT as a self-check tool institutions can use between exams.

Can compliance.tf cover all 50 FFIEC controls in this benchmark?

The 50 controls in this benchmark are the infrastructure configuration checks that can be automated via Terraform and Steampipe. They cover a meaningful subset of the CAT's Cybersecurity Controls domain (Domain 3), particularly Preventative and Detective controls. The full CAT spans governance, risk assessment, threat intelligence, vendor management, incident response, and training, none of which can be validated through infrastructure scanning alone. Expect compliance.tf to automate roughly 30-40% of your evidence needs, with the remainder requiring policy documentation, process evidence, and human attestation.