FFIEC CAT & QUANTITATIVE RISK ASSESSMENT

Financial institutions are heavily targeted by cyber threats. As such, FFIEC (Federal Financial Institution Examination Council) guidelines smartly require ongoing assessments dedicated to both improving cybersecurity and maintaining acceptable cybersecurity risk. In fact, for all but very small banks, compliance with their guidelines calls for the annual completion of an FFIEC CAT assessment as well as an Information Technology risk assessment. GMI’s service efficiently accomplishes both, while providing unmatched clarity of your biggest cyber risks.

FFIEC CYBERSECURITY ASSESSMENT TOOL

The FFIEC CAT (Cybersecurity Assessment Tool) provides financial institutions with a repeatable and measurable process that enterprises can use to gauge cybersecurity preparedness. The framework has two focuses. It helps assess an institution’s inherent cyber risk profile and its cybersecurity maturity level.

The Inherent Risk Profile focuses on the following five categories:

Technologies and connection types
Delivery channels
Online / Mobile products and technology services
Organizational characteristics
External threats

The Cybersecurity Maturity Level is assessed for five primary domains:

Cyber risk management and oversight
Threat intelligence and collaboration
Cybersecurity controls
External dependency management
Cyber incident management and resilience

The combined effort enables an organization to determine if its security maturity levels are appropriate for its calculated inherent risk, allowing them to implement measures to make adjustments as needed.

COMPLIANCE AND CLARITY

The GMI approach utilizes the FFIEC CAT to efficiently assess both inherent cyber risk and cybersecurity maturity. Unlike similar offerings, we pair ours with an exceptional quantitative risk assessment. Using statistical modeling to enable easier measurement of mitigation strategies and by incorporating current financial-industry threat data to apply real-world context, we numerically identify an institution’s biggest financial exposures and give clear recommendations to help prioritize cyber security program improvements.

THE GMI APPROACH

The reality is, simply following FFIEC guidance and “best practices” is no longer enough for protecting customer data. Banks must focus resources in areas that yield the most benefit. Where other assessments might identify problem areas, our approach goes further. Exposures are rated and inform a prioritized plan that helps you address the areas of greatest risk first.

GMI Strategic Advisory consultants start by reviewing your organization’s inherent risk profile. Once validated, the organization will be assessed against the five domains of the FFIEC Cybersecurity Assessment Tool framework to ensure that the appropriate level of maturity has been achieved. Uniquely, GMI’s independent deep dive review includes an effectiveness score for each security control in place. Recommendations for any identified gaps will be provided. Simply put, we ensure you have simple guidance backed by clear findings to enable not just compliance, but a detailed and prioritized roadmap to reach your desired level of cybersecurity risk.

BENEFIT FROM TWO SERVICES AT ONCE

While a GMI FFIEC CAT Assessment and a Quantitative Risk Assessment can be tackled separately, GMI recommends addressing them together in the same work stream. Doing so minimizes overlaps to speed the process and lower cost. Fewer interviews are required. Redundancies are eliminated. Improved cybersecurity posture and FFIEC cyber security compliance are efficiently achieved in one fell swoop.

Next Steps