FFIEC Cybersecurity Assessment Tool
ActiveSpecialized framework
Best for: U.S. financial institutions regulated by the Federal Reserve, FDIC, OCC, NCUA, or state banking departments, including banks, credit unions, savings associations, and bank holding companies. No revenue or asset threshold applies; the CAT is a voluntary self-assessment tool. The FFIEC sunset it effective August 31, 2022, so examiners no longer require it, but institutions may still use it internally.
| Mandatory? | Strongly recommended for U.S. financial institutions; not formally required |
|---|---|
| Who validates? | Federal examiner review (Fed, FDIC, OCC, NCUA, CFPB) |
| Renewal | No fixed cycle; tied to exam cycle |
| Scope | All U.S. financial institutions including banks, credit unions, savings associations |
| Governing body | Federal Financial Institutions Examination Council (FFIEC), a formal interagency body comprising the Federal Reserve Board, FDIC, OCC, NCUA, CFPB, and the State Liaison Committee., FFIEC CAT (2015). Official source |
Get started
Point the module source at the FFIEC Cybersecurity Assessment Tool endpoint and pin a version range you reviewed:
module "..." {
source = "ffiec.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}ffiec.compliance.tf lists every FFIEC Cybersecurity Assessment Tool module with its versions, inputs and outputs.
What compliance.tf covers and what you handle
| Area | Compliance.tf automates | You handle |
|---|---|---|
| Audit Trail and Logging | Checks the CloudTrail lifecycle: multi-region configuration, S3 data event logging for both read and write operations, CloudWatch integration, log group retention periods, and alarm action enablement. | Log review procedures, a security operations function staffed to act on alerts, incident escalation documentation, and examiner-ready evidence that logs are reviewed, not just collected. |
| Encryption and Certificate Management | Checks ACM certificate expiration within 30 days, SSL certificate attachment on API Gateway stages, backup recovery point encryption, and absence of plaintext sensitive values in CodeBuild environment variables. | Establishing a key management policy, defining approved encryption algorithms, managing certificate renewal workflows, and documenting encryption standards in your information security program. |
| Network and Perimeter Security | Validates WAF web ACL association on API Gateway stages and flags Auto Scaling launch configurations that assign public IPs to instances intended to stay private. | WAF rule tuning, firewall change management procedures, network segmentation documentation, and periodic penetration testing to validate perimeter controls. |
| Backup and Disaster Recovery | Confirms backup plan minimum retention of 35 days, recovery point minimum retention of 35 days, manual deletion protection on recovery points, and health check configuration on Auto Scaling groups behind load balancers. | Business continuity plan documentation, annual DR testing with documented results, recovery time objective validation, and examiner-ready evidence that backups are actually restorable. |
| Sensitive Data Handling | Detects plaintext AWS credentials and sensitive values in CodeBuild project environment variables. Flags configurations where secrets should use Parameter Store or Secrets Manager instead. | Data classification per your information classification policy, DLP controls beyond infrastructure configuration, and developer training on secure credential handling. |
Controls by category
60 of 85 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 25 are Mapped only: FFIEC Cybersecurity Assessment Tool lists them, no compliance.tf module checks them.
Cyber Incident Management and Resilience: Backup and Recovery
Domain 5 requires tested backup and recovery capabilities, not just configured ones. Examiners want evidence that retention meets your BCP requirements, that recovery points are protected against premature deletion (ransomware resilience), and that health checks enable automatic failover. The recurring challenge is proving that recovery point objectives align with documented BCP/DR plans.
| Control | Status |
|---|---|
| Backup plan rules should retain recovery points for at least 35 days | Mapped |
Detective Controls: Audit Trail and Monitoring
Domain 3's Detective Controls factor centers on visibility. Examiners check whether logs are centralized, retained per policy and regulatory expectations (the CAT sets no fixed 365-day minimum), and configured to alert on anomalous activity. The most common gap: CloudTrail enabled in only one region, or S3 data event logging missing entirely, which leaves significant blind spots.
Preventative Controls: Data Protection and Encryption
Under Domain 3 Preventative Controls, examiners verify that data in transit and at rest is encrypted using current standards. Expired or soon-to-expire TLS certificates, plaintext credentials in build configurations, and unencrypted backups are recurring findings. Institutions must also show that encryption key management aligns with the institution's risk appetite and that sensitive values never appear in plaintext configuration.
| Control | Status |
|---|---|
| API Gateway REST API stages should have a client certificate configured | Mapped |
Additional controls (78)
AWS Database Migration Service (1)
| Control | Status |
|---|---|
| DMS replication instances should not be publicly accessible | Enforced |
AWS IAM (7)
AWS Lambda (4)
Amazon CloudFront (1)
| Control | Status |
|---|---|
| CloudFront distributions should use the recommended TLS security policy | Enforced |
Amazon DynamoDB (1)
| Control | Status |
|---|---|
| DynamoDB tables should have point-in-time recovery enabled | Enforced |
Amazon EBS (1)
| Control | Status |
|---|---|
| Attached EBS volumes should have encryption enabled | Enforced |
Amazon EC2 (3)
| Control | Status |
|---|---|
| EC2 instances should have IAM profile attached | Enforced |
| EC2 instances should be in a VPC | Mapped |
| EC2 instances should not have a public IP address | Enforced |
Amazon EFS (2)
| Control | Status |
|---|---|
| EFS file systems should have encryption at rest enabled | Enforced |
| EFS file systems should be encrypted with CMK | Enforced |
Amazon EMR (1)
| Control | Status |
|---|---|
| EMR cluster Kerberos should be enabled | Mapped |
Amazon ElastiCache (1)
Amazon OpenSearch Service (3)
Amazon RDS (16)
Amazon Redshift (9)
Amazon S3 (12)
Amazon SageMaker (1)
| Control | Status |
|---|---|
| SageMaker notebook instances should not have direct internet access | Mapped |
Amazon VPC (3)
Elastic Load Balancing (8)
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| FedRAMP Moderate Baseline Rev 4 | High 94% | |
| NIST SP 800-171 Rev 2 | High 93% | |
| NIST SP 800-53 Rev 5 | High 92% |
Frequently asked questions
Is the FFIEC CAT mandatory, or is it optional guidance?
The CAT is voluntary. No law or regulation requires its use. FFIEC announced the sunset effective August 31, 2022 and confirmed it will not be updated. Examiners assess cybersecurity through FFIEC handbooks and agency procedures; institutions may still use the CAT internally, but there is no examiner requirement to do so.
How long does a full FFIEC CAT self-assessment take?
For a community bank or credit union, expect 2 to 4 weeks of staff time across IT, compliance, and risk management. The Inherent Risk Profile takes a few days; the Cybersecurity Maturity assessment is the bulk of the work, requiring evidence gathering across all five domains. Larger institutions with complex environments and multiple business lines may need 6 to 8 weeks. The first assessment always takes the longest; subsequent annual updates go faster if you maintain your evidence repository.
How does the Inherent Risk Profile affect what maturity level I need?
The CAT uses a matrix. Your Inherent Risk Profile score (Least, Minimal, Moderate, Significant, or Most) determines the minimum cybersecurity maturity level expected. A Least-risk institution may only need Baseline maturity; a Significant-risk institution needs at least Intermediate, and examiners may push for Advanced in specific domains. Most mid-size banks land at Moderate risk, which requires Evolving maturity at minimum.
What is the relationship between FFIEC CAT and the FFIEC IT Examination Handbooks?
The CAT complements the IT Examination Handbooks but does not replace them. The handbooks (Information Security, Business Continuity, Outsourcing Technology Services, and others) contain the detailed examination procedures that examiners follow. The CAT is a higher-level self-assessment that maps to concepts in the handbooks. Think of the handbooks as the examiner's detailed playbook and the CAT as a self-check tool institutions can use between exams.
Can compliance.tf cover everything the FFIEC CAT asks for?
No. The controls in this mapping are infrastructure configuration checks. They cover a meaningful subset of the CAT's Cybersecurity Controls domain (Domain 3), particularly Preventative and Detective controls. The full CAT spans governance, risk assessment, threat intelligence, vendor management, incident response, and training, none of which can be validated through infrastructure scanning alone. The rest needs policy documentation, process evidence, and human attestation.