Your IT examination is six weeks out.
Federal-examined banks and credit unions get tested against the FFIEC IT Handbook on a fixed cadence. Your examiner already has the question list. RiskWatch builds your answers continuously so “preparing for examination” stops being a quarter of work.
- FFIEC IT Handbook + Cybersecurity Assessment Tool (CAT)
- InTREx framework + URSIT rating preparation
- 9 examination domains scored continuously · OCC / FDIC / Fed / NCUA / CFPB aligned
- For audit committee: cybersecurity maturity dashboard ready quarterly
What is FFIEC compliance software?
Your IT examination starts on a fixed cadence. The examiner already has the question list. RiskWatch builds your answers continuously across the FFIEC IT Handbook + Cybersecurity Assessment Tool + InTREx framework, scores 9 examination domains across all five regulators (OCC, FDIC, Fed, NCUA, CFPB), and produces the audit-committee maturity dashboard before the regulator asks. Examination week stops being a quarter of work.
Examiners arrive with a checklist. You don't have a copy.
Community bank IT compliance is the asymmetric-information problem. The FFIEC handbook is public, but the examination procedures examiners use vary by agency, by examiner, by year. Even the FDIC's OIG found in a 2023 report that InTREx itself has gaps. Here's where small banks actually lose points.
Examiners arrive with a checklist. You don't have a copy.
Examination procedures vary by agency and by examiner. The FFIEC IT Handbook is public, but the specific evidence requests are not. Pre-loaded examiner checklists by agency (OCC vs FDIC vs Fed vs NCUA vs CFPB), the questions and artifacts each examiner type asks for, organized by booklet.
Cyber threat landscape changes monthly. Your last InTREx was 18 months ago.
Examiners want active engagement with FS-ISAC and other information-sharing networks. Many community banks don't fully understand the specific threats they face, let alone share intelligence about them. FS-ISAC integration captures threat-intelligence ingestion as examiner-visible evidence. Quarterly threat-landscape briefings auto-generated for board reporting.
FFIEC CAT maturity drops every quarter you don't update.
The Cybersecurity Assessment Tool (CAT) scores 494 statements across 5 domains. Maturity isn't static, controls drift, new threats emerge. Continuous CAT scoring with quarterly re-baselining, integrated with your security tooling, examiners see a current maturity score, not a stale annual snapshot.
Every module a bank IT examination needs, in one platform.
Built around the IT Examination Handbook + Cybersecurity Assessment Tool. Pre-loaded examiner checklists per agency. FS-ISAC integration for the threat-sharing examiners now expect.
CAT + handbook posture
Per-domain CAT maturity, top open statements, examination countdown, FS-ISAC sharing rate.
All booklets pre-loaded
Architecture · Operations · BCP · InfoSec · Outsourcing · Audit · Management · Development & Acquisition · Wholesale Payment Systems · Retail Payment Systems · E-Banking · FedLine.
All 494 statements
Per-statement scoring (Baseline → Innovative). Per-domain composite. Trend across cycles.
Layered authentication + risk-based
FFIEC Authentication Supplement covering customer authentication + transaction monitoring.
Threat sharing examiners expect
Ingest threat intelligence from FS-ISAC. Examiner-visible audit trail of intelligence consumption.
Per-agency artifact requests
Pre-loaded artifact requests per agency: OCC vs FDIC vs Fed vs NCUA vs CFPB. Organized by handbook booklet.
FDIC IT examination ready
InTREx-aligned checklist + composite rating tracker. URSIT components covered (Audit · Management · Development · Support · Acquisition).
FFIEC + NIST CSF + NIST 800-53
FFIEC CAT mapped to NIST CSF 2.0 functions; handbook controls cross-walked to NIST 800-53.
Board cyber reporting
Quarterly cyber-risk reports for board cyber-risk committees per FFIEC oversight expectations.
Business Continuity booklet
BCP planning, testing, RTO/RPO tracking, third-party BCP coordination.
Outsourcing booklet alignment
FFIEC outsourcing-risk requirements: due diligence, contract, ongoing monitoring, termination.
Examiner-grade
Timestamped log for every score change, evidence upload, examination response. Admissible for regulator review.
From Baseline to Innovative.
The Cybersecurity Assessment Tool (CAT) scores 494 statements across 5 domains. Each statement has 5 maturity tiers: Baseline, Evolving, Intermediate, Advanced, Innovative. Examiners use CAT scoring to gauge cybersecurity maturity and to drive examination focus. RiskWatch ships with all 494 statements + tier scoring + per-domain composite + cross-mapping to FFIEC handbook booklets.
- D1 · Cyber Risk Management & Oversight, governance, risk management, resources, training, culture
- D2 · Threat Intelligence & Collaboration, threat intelligence, monitoring & analyzing, information sharing
- D3 · Cybersecurity Controls, preventative, detective, corrective controls
- D4 · External Dependency Management, connections, relationship management
- D5 · Cyber Incident Management & Resilience, planning, detection, response & mitigation, escalation, resilience
FFIEC + NIST CSF 2.0 + NIST 800-53.
FFIEC CAT statements cross-walk to NIST CSF 2.0 functions and NIST 800-53 r5 controls. Banks running FFIEC alongside SOC 2, PCI DSS, or GLBA Safeguards see overlap of 70-80%. RiskWatch maps every CAT statement and handbook booklet to its NIST counterpart.
- NIST CSF 2.0, CAT D1 → CSF Govern; D2 → Identify; D3 → Protect/Detect; D4 → Govern.SC; D5 → Respond/Recover
- NIST 800-53 r5, handbook controls map to 800-53 control families
- PCI DSS v4.0.1, for payment-handling banks
- GLBA Safeguards Rule, non-bank FIs and covered institutions
- NYDFS Part 500, for NY-licensed FIs
Each asks differently.
IT Risk Management Examination Procedures · supervisory framework
InTREx examination · URSIT composite rating · Audit/Mgmt/Dev/Support/Acquisition
Bank Holding Company supervision · IT examinations
ACET (Automated Cybersecurity Evaluation Toolbox) · examiner procedures
From CAT baseline to examination-ready in five stages.
Most banks complete CAT scoring in their first 4 weeks. Continuous CAT updates keep maturity current between examinations.
Score CAT baseline
All 494 statements scored Baseline → Innovative. Per-domain composite calculated.
Map handbook booklets
Architecture · Operations · BCP · InfoSec · Outsourcing booklets reviewed; controls implemented per booklet.
FS-ISAC + threat sharing
Ingest threat intelligence. Document consumption. Quarterly cyber briefing for board.
Examiner artifact prep
Per-agency artifact pack assembled. Examiner-aligned narrative review. Pre-exam tabletop walkthrough.
Examination response
Examiner artifact requests answered with documented evidence. Composite rating assigned. Findings addressed in 30-day plan.
The FDIC InTREx that finished in 5 days, not 8 weeks.
Real community banks. Real CAT maturity scores. Real composite ratings.
The pre-loaded OCC artifact checklist saved us 200 hours on our last exam. Examiner asked for what we already had, in the format he wanted it.
“FS-ISAC integration was the win. Our examiner explicitly asked for evidence of threat-intelligence consumption. We had it timestamped.”
“CAT scoring used to be a quarterly fire drill. Now it's continuous. Examiner saw a current Advanced maturity, not a stale Intermediate.”
Plus every framework banks run alongside FFIEC, cross-mapped.
Score one CAT statement, satisfy NIST CSF, NIST 800-53, GLBA, NYDFS 500. Most regulated banks run 4-5 frameworks simultaneously.
Take RiskWatch home before you sign anything.
Three downloads. Build the FFIEC examination readiness business case.
FFIEC CAT 5-Domain Maturity Checklist
Thirty-two pages walking all 5 CAT domains with the 494 statements, tier-scoring rubric, and per-domain composite calculator.
- All 494 CAT statements
- 5-tier scoring rubric
- Per-domain composite calculator
FFIEC Examiner Artifact Lists
Pre-loaded artifact requests per FFIEC agency: OCC, FDIC, Federal Reserve, NCUA, CFPB. Organized by handbook booklet.
- 5-agency artifact tracker
- Per-booklet organization
- Examiner-aligned narrative templates
FFIEC Platform Buyer's Guide
Vendor scorecard, CAT-tracking depth, FS-ISAC integration, examiner-checklist coverage, pricing.
- Feature matrix · 6 vendors
- Examiner alignment scorecard
- Pricing benchmarks
Common questions, answered up front.
About FFIEC IT examinations, CAT maturity, the Authentication Supplement, InTREx, and how RiskWatch covers all of them.
What is FFIEC compliance software?
How does the Cybersecurity Assessment Tool (CAT) work?
How do FFIEC examination agencies differ?
What is InTREx?
Is there a free trial?
Score your CAT this week. All 494 statements.
Start a 30-day free trial, all FFIEC IT Handbook booklets, CAT maturity, Authentication Supplement, FS-ISAC integration, and per-agency artifact checklists. No credit card required.
No credit card required · 30-day free trial · Cancel anytime