Compliance FrameworksAmericas
FFIEC CAT
Financial institution cyber risk management, threat intelligence, cybersecurity controls.
Financial institution cyber risk management, threat intelligence, cybersecurity controls.
| Short name | FFIEC |
| Region | Americas |
| Country or scope | United States |
| Sector | Finance |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers FFIEC
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 14 controls from Safeguard's control catalog for FFIEC.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 26: 4 written for FFIEC and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
FFIEC-CAT-D1-INV IT Asset Inventory Baseline | Baseline maturity in cyber risk management requires an inventory of the institution's technology assets, including the software components of business-critical systems (FFIEC CAT Domain 1 - Governance, asset inventory declarative statements) | Scan |
FFIEC-CAT-D4-DEP External Dependency Identification | External dependency management requires identifying third parties and the software connections they provide, attributing components to their external suppliers (FFIEC CAT Domain 4 - External Dependency Management) | Scan |
FFIEC-CAT-D3-PATCH Patch Management Visibility | Cybersecurity controls include a patch management program, which requires current version information for the software in the environment (FFIEC CAT Domain 3 - Preventative Controls, patch management) | Scan |
FFIEC-CAT-D2-TI Threat Intelligence Correlation | Using threat intelligence effectively requires mapping advisories to the institution's own software, so components need standard identifiers (FFIEC CAT Domain 2 - Threat Intelligence and Collaboration) | Scan |
FFIEC-CAT-D3-INT System Integrity Controls | Preventative controls extend to detecting unauthorized changes to software, supported by integrity hashes for deployed components (FFIEC CAT Domain 3 - Cybersecurity Controls) | Scan |
FFIEC-CAT-D1-DOC Assessment Evidence Records | Maturity assessment relies on documented, dated evidence that examiners can verify, so composition documentation must be identifiable and timestamped (FFIEC CAT - assessment process documentation) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
D1.G.IT.B.1 | Establish IT Asset Inventory |
D1.G.IT.B.2 | Classify Data by Sensitivity |
D1.RM.Ra.B.1 | Conduct Enterprise Cyber Risk Assessment |
D2.MA.Ma.B.1 | Establish Threat Intelligence Program |
D3.PC.Am.B.1 | Implement Network Access Controls |
D3.PC.Im.B.1 | Manage Patch and Vulnerability Remediation |
D3.CC.Se.B.1 | Encrypt Customer Data in Transit and at Rest |
D4.C.Co.B.1 | Implement Cybersecurity Monitoring |
D4.C.De.B.1 | Detect Anomalous Transactions |
D5.IR.Pl.B.1 | Maintain Incident Response Plan |
D5.IR.Re.B.1 | Escalate and Report Cyber Incidents |
D1.TC.Te.B.1 | Provide Cybersecurity Awareness Training |
D3.PC.Se.B.1 | Manage Third-Party and Supply Chain Risk |
D5.BR.Pl.B.1 | Establish Cyber Resilience and Recovery Capabilities |
Policy templates
Written for FFIEC:
- FFIEC CAT Cybersecurity Risk Management Policy
- FFIEC CAT Cybersecurity Controls Policy
- FFIEC CAT Cyber Incident Response and Notification Policy
- FFIEC CAT Third-Party and Supply Chain Risk Management Policy
And 22 from the standard set, adapted to FFIEC.