Scrutineer · By framework
CRI Profile assessment software to replace the FFIEC CAT
The CRI Profile is the cybersecurity self-assessment most US banks and credit unions moved to after the FFIEC retired its CAT on August 31, 2025: a free Cyber Risk Institute framework of 318 diagnostic statements, aligned to NIST CSF 2.0 and now on version 2.2.
Scrutineer is the software side of the assessment: each diagnostic statement mapped to the controls you already run, dated evidence attached to every answer, and findings tracked to closure for the examiner.
Control-mapped findings · linked evidence · you decide what to remediate
Interactive walkthrough on a sample company, not a scan of your systems.
›
Worked example with sample findings, not a scrutiny of your environment. Not an audit attestation.
Controls in evidence-linked report out
AI scrutinizes you decide
Why it works
What you get with CRI diagnostic statements
The Profile is free. The evidence behind each answer is the work
The Cyber Risk Institute gives the Profile away as a registered download, so nobody is buying the framework. What takes the time is the same thing the CAT made you do: evidence for every answer an examiner may pick up. A Yes with nothing behind it reads as a gap, not a pass. Scrutineer attaches dated evidence from your identity, cloud, ticketing and vendor records to each diagnostic statement, so the answer and its proof travel together.
Version 2.1 and 2.2 changed the mappings, not the statements
CRI Profile 2.2 arrived on April 30, 2026 with 13 new and 3 updated mappings, for 40 mappings to regulations and standards in total, plus AI risk resources. The diagnostic statements themselves did not change in 2.1 or 2.2. An institution that assessed against the Profile in 2025 does not have to start over. It has to keep the evidence current and refresh the mappings it reports against, which is a schedule problem software handles well.
Your fintech and SaaS vendors are being handed the Profile too
CRI pitches the Profile to vendors as a way to fill it out once and report to many financial institutions, and its Extend function covers third-party oversight. That cuts both ways. A bank can ask critical vendors for CRI-aligned answers instead of a bespoke spreadsheet, and a fintech selling to banks can answer from one evidence-backed control set instead of rewriting the same response for every sponsor bank. Scrutineer runs both directions on the same library.
What it handles
Controls in, an evidence-linked report out
Point Scrutineer at a framework or a vendor and it maps every control, pulls the evidence it can find, flags the gaps and scores the risk, returning a report with linked evidence and a prioritized remediation list. Scrutineer is decision support for readiness, an accredited auditor still issues the attestation.
- Loads the 318 diagnostic statements as a framework in your workspace and maps each one to the controls you already evidence for SOC 2, ISO 27001 or the GLBA safeguards
- Records your impact tier answers and keeps only the statements that apply to your tier in scope, so a community bank is not assessed like a global bank
- Attaches dated evidence to each answer from identity, cloud, ticketing and vendor systems, collected on a schedule rather than the month before the exam
- Shows a statement as ready only when every control mapped to it is audit-ready, so a thin mapping shows up as a gap instead of a quiet Yes
- Tracks each finding to an owner, a target date and evidence of closure, which is the part of the transition examiners ask about first
- Carries your old CAT work forward: the inherent risk profile informs the tier, and domain evidence is re-pointed to the matching Profile functions
- Covers the Extend function with vendor tiering, due diligence and continuous monitoring on the same platform, instead of a separate TPRM spreadsheet
- Produces a dated assessment record with named reviewers and the committee or board date it was received, the artifact a self-assessment has to leave behind
evidence · MFA enforced and access reviews evidenced.
evidence · Mostly covered; one approval log left untested.
evidence · Two subprocessors missing a current review.
evidence · Data encrypted in transit and at rest, evidenced.
Why Scrutineer
One platform that maps controls and scores risk
Not a static questionnaire, not a pass-fail black box, and not a spreadsheet you maintain by hand. Live control mapping across SOC 2, ISO 27001, HIPAA, GDPR and PCI, automatic evidence and a prioritized gap list, returned as a report you can act on. The AI scrutinizes, you decide.
Mapped to real controls
Every framework is broken down into the controls it actually requires, each scored on a red to amber to green scale, so readiness stays transparent and consistent.
Evidence behind every finding
Each control links to the exact evidence that satisfies it, the policy, the config, the log line, so the finding is auditable and your readiness is defensible.
A prioritized gap list
Open gaps roll up into a ranked remediation list, so the highest-risk findings sit at the top and your team fixes what matters before the audit begins.
CRI Profile by function
Where your existing evidence already answers the CRI Profile, and where it does not
Most guides compare the Profile with the old CAT. The more useful comparison for a bank that already holds a SOC 2 report or ISO 27001 certificate, or runs its GLBA program on similar controls, is against that evidence set. Protect and Detect mostly re-map. Govern and Extend are where the new work sits.
| Profile function | What an examiner asks to see | What a SOC 2 or ISO 27001 evidence set already gives you | Net-new work for a bank or credit union |
|---|---|---|---|
| Govern | Board-approved cyber risk strategy and risk appetite, roles, policy review cycle, cyber reporting to the board | Control environment and policy evidence (SOC 2 CC1 and CC2, ISO 27001 clauses 5 and 6) | Board or committee minutes receiving the assessment, a cyber risk appetite statement, and the GLBA information security program report to the board |
| Identify | Asset inventory, data classification, a documented risk assessment and its refresh date | Asset and risk assessment evidence (SOC 2 CC3, ISO 27001 clause 6.1 and Annex A 5.9) | Inherent risk tied to products and channels, and the impact tier answers kept with the assessment |
| Protect | Access control, MFA, encryption, secure configuration, training, change management | Most of it. This is where SOC 2 and ISO 27001 evidence overlaps the Profile the most | Mostly re-mapping. Gaps tend to sit in customer-facing channels such as online banking and payments |
| Detect | Logging, monitoring, anomaly detection and who reviews alerts | Monitoring evidence (SOC 2 CC7, ISO 27001 Annex A 8.15 and 8.16) | Fraud and transaction monitoring linkage, and threat intelligence sharing such as FS-ISAC participation |
| Respond | Incident response plan, tests, escalation and regulatory notification | Incident management evidence (SOC 2 CC7.3 to CC7.5, ISO 27001 Annex A 5.24 to 5.28) | The 36-hour computer-security incident notification to your primary federal regulator under the 2021 interagency rule (72 hours to the NCUA for federally insured credit unions under 12 CFR 748.1(c)), and records of the tabletop that tested it |
| Recover | Recovery plans, backup restoration tests, lessons learned | Availability and continuity evidence (SOC 2 A1, ISO 27001 Annex A 5.29 and 5.30) | Recovery objectives for critical banking services and evidence of a restore test, not only a backup policy |
| Extend | Third-party inventory, due diligence, contract terms, ongoing monitoring of critical vendors | Vendor management evidence (SOC 2 CC9.2, ISO 27001 Annex A 5.19 to 5.22) | Criticality tiering aligned with the interagency third-party guidance, contract review, and a monitoring record for each critical vendor |
Sources: Cyber Risk Institute, CRI Profile Overview (318 diagnostic statements harmonizing 3,500+ regulatory expectations, aligned to NIST CSF 2.0, nine impact tiering questions, version 2.2 with about 40 mappings), read October 2026. FFIEC Cybersecurity Assessment Tool sunset statement of August 29, 2024 (OCC Bulletin 2024-25), effective August 31, 2025. Computer-Security Incident Notification rule, 12 CFR part 53 (OCC), 225 subpart N (Federal Reserve) and 304 subpart C (FDIC); NCUA 12 CFR 748.1(c). SOC 2 and ISO 27001 references show where evidence usually overlaps; your mapping depends on your controls.
Good questions
Questions about CRI diagnostic statements
Keep reading
Guides for banks moving off the FFIEC CAT
FFIEC CAT sunset and what replaces it
The four named alternatives compared, and how to carry your CAT work forward.
Read the guideBest third-party risk management software
The tools behind the Extend function and vendor oversight.
Read the guideBest GRC software
Where a CRI Profile assessment sits inside a wider GRC program.
Read the guideExplore more
More ways to scrutinize compliance and risk with Scrutineer
SOC 2 compliance
Map controls to the Trust Services Criteria, collect evidence, and close gaps before audit.
Learn moreSOC 2 compliance software
A platform that maps SOC 2 controls, automates evidence, and tracks readiness continuously.
Learn moreISO 27001 compliance
Map your ISMS to Annex A, automate evidence, and stay certification-ready.
Learn moreStop guessing about readiness. Scrutinize on real evidence.
Point Scrutineer at a framework or a vendor and it maps every control, gathers evidence and scores the risk, returning an evidence-linked report and a prioritized gap list. The AI scrutinizes, you decide.
SOC 2, ISO 27001, HIPAA, GDPR & PCI · evidence-linked controls · readiness, not certification