Choosing the Right Cybersecurity Assessment Tool in a Post-FFIEC CAT World

/in , , , , , , /by
Since the announcement of the FFIEC Cybersecurity Assessment Tool’s sunset, many financial institutions have taken meaningful steps to identify what comes next for their cyber risk management. The question is no longer whether to move on from the CAT, but how to do so in a way that remains practical, regulator-ready, and right-sized for your institution.
Strunk’s Cyber Risk Assessments feature was built with that exact challenge in mind. Our solution gives organizations the freedom to choose the best approach; designed specifically to align with two leading frameworks recommended by the FFIEC: NIST Cybersecurity Framework (CSF) and the Cyber Risk Institute (CRI) Profile. Both frameworks offer a structured, defensible approach to evaluating cybersecurity risk without adding unnecessary complexity.
For institutions seeking flexibility, NIST CSF offers a high-level, outcome-based structure across six core functions (Govern, Identify, Protect, Detect, Respond, and Recover). Our tool translates those outcomes into clear scoring, progress tracking, and the documentation that examiners expect, supporting strategic planning and board-level reporting.
For institutions looking for greater financial-sector specificity, the CRI Profile builds on NIST with more granular diagnostic statements, nuanced response options, and a dedicated focus on supply chain risk via its Extend function. Strunk’s tool streamlines CRI assessments by automating tiering and highlighting gaps most important to regulators and stakeholders.
Whether you’re transitioning from the FFIEC CAT or looking to modernize an existing program, Strunk’s cyber risk assessment solution helps transform complex frameworks into valuable, actionable results. We are committed to making cybersecurity assessments efficient and repeatable, ensuring your institution can move forward with clarity and confidence.
Contact Strunk at 800.728.3116 or info@strunkaccess.com to learn more.

An independent certified public accountant has examined Strunk’s operations and found them to be in compliance with the AICPA’s Trust Service Principles. It was determined that Strunk meets the Security, Availability, Processing Integrity, Confidentiality, and Privacy criteria for SOC 2 established by the AICPA.