2025 Regulatory Summit

Internal Use Only

Sunsetting of the FFIEC CAT • Sunset: August 31 2025 • CSBS conducted two joint webinars with the Federal Reserve and two with the FFIEC in support of educating industry on alternatives to the FFIEC CAT • Focus on industry-developed alternatives o Cyber Risk Institute (CRI) Cyber Risk Profile o Center for Internet Security (CIS) Controls • CSBS also conducted a joint webinar with the Federal Reserve in support of educating examiners on alternatives seen in the field • Addressed all alternatives noted in the FFIEC CAT Sunset Statement • CSBS is actively researching emerging industry-developed alternatives

Internal Use Only

Commissioner Cyber TTX • CSBS cybersecurity tabletop exercise with Treasury: May 2025 • Commissioners and deputies from 24 states • Focus on responses to significant multi-state cybersecurity incident • Examined roles and responsibilities for commissioners • Examined sequence of internal state responses to an incident • Reviewed collaboration and coordination with other state commissioners • Several positive next steps developed (broadened state engagement with law enforcement and cybersecurity agencies; demand for additional exercises; development of critical service provider database)