FFIEC Cybersecurity Assessment Tool

Watkins Consulting designed an Excel-based workbook to simplify the record keeping of responses and to calculate corresponding scores for the FFIEC Cybersecurity Assessment. We are pleased to offer a free download of this Excel workbook.  Upon downloading and deciding to use this tool, please register it so we can send you update notices. If you need help expanding this assessment into governance or need help with cybersecurity compliance efforts, please contact us at [email protected].

Additional download information is below.

Background

In June 2015, the Federal Financial Institutions Examination Council (FFIEC) published a Cybersecurity Assessment Tool (CAT) to help financial institutions identify and evaluate their cybersecurity risk awareness and readiness; click here to view their web page describing this tool. The tool consists of an extensive set of questions designed to evaluate the cybersecurity risk of a Financial Institution. In 2017 the FFIEC made some minor adjustments to the tool.

The FFIEC published the CAT to encourage consistent analysis, evaluation, and examination of cybersecurity risks inherent in US Financial Institutions. The Tool leverages industry standards, guidelines and best practices, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF, see our post on this), to help organizations better manage, evaluate, and reduce cybersecurity risk. The FFIEC has added an additional metric to the NIST CSF by considering the maturity cycle of an institution and its products and services, thereby aligning cybersecurity maturity to cyber risk—or, the greater the cyber risk, the greater the need for mature cybersecurity. Watkins has also published a short video containing a background description and a worked example using the CAT; click here to view that post.

The CAT was published in a static PDF format; therefore, in order to assist our clients Watkins has derived an equivalent Excel-based workbook that automates the tracking and scoring of an institution’s maturity levels and risk profile. Upon completion, this workbook will provide a snapshot of a Financial Institution’s cyber readiness and exposure. And, a series of workbooks over time will document cyber risk remediation efforts.

An immediate benefit is that our clients and contacts can download and use the FFIEC CAT Excel workbook. It is our hope that this tool will reduce the level of clerical work involved, allowing you to immediately engage in the important work of effective cybersecurity governance. Watkins is offering this tool for your use free of charge; however, we do recommend that you register your tool so that you can receive version updates as they become available. We recommend that you let us know that you are using the Excel workbook by sending us an email.

The purpose of this tool is to record responses and calculate corresponding scores. Should your institution require further explanation of results or interpretation of the FFIEC Cybersecurity Assessment requirements, please contact us at [email protected] or (888) 230-3032.

Free Excel Cybersecurity Assessment Tool Change Log