FFIEC IT Examination Handbook ⚑
Federal Financial Institutions Examination Council guidance for examining IT operations at supervised institutions.
The FFIEC IT Examination Handbook is the principal interagency guidance used by US bank, credit union, and CFPB examiners to assess technology risk at supervised institutions. It is structured as a set of subject-matter booklets covering Information Security, Architecture & Operations, Audit, Business Continuity Management, Development & Acquisition, Management, Outsourcing/Third-Party Risk, Retail Payment Systems, and Wholesale Payment Systems, each updated on its own cadence. Each booklet pairs principles and expectations with examination work programs, enabling consistent interagency examination by the FFIEC member agencies (Federal Reserve, FDIC, NCUA, OCC, CFPB, and the State Liaison Committee). The Cybersecurity Assessment Tool (CAT), introduced in 2015 to map institutional cybersecurity maturity against inherent risk, is being retired and replaced by reference to NIST CSF and CISA's CRR.
Core components
- Subject-matter booklets (Information Security
- Architecture, Infrastructure, and Operations
- Audit
- Business Continuity Management
- Development and Acquisition
- Management
- Outsourcing/Third-Party Risk
- Retail Payment Systems
- Wholesale Payment Systems)
- Examination work programs
- Risk-based examination approach
- Cybersecurity Assessment Tool (in transition)
Primary use case
Examination guidance for federal and state financial institution IT and cybersecurity examiners; institutional self-assessment baseline.
Common criticisms
- Booklet update cadence trails technology change (cloud, AI, third-party SaaS)
- substantial overlap with NIST CSF creates dual-mapping burden
- CAT retirement created transitional uncertainty
- prescriptive examination work programs can encourage form over substance.
Lineage
- Siblings
- NIST Cybersecurity Framework, ISO/IEC 27001, CCAR