FFIEC cybersecurity assessment: inherent risk against maturity

The distinguishing feature of the FFIEC approach is that neither half means anything alone. You assess your inherent risk, you assess your cybersecurity maturity, and what examiners actually evaluate is whether the second is appropriate to the first. A modest maturity level is entirely defensible at a modest risk profile — and indefensible at a high one.

Part one: inherent risk profile

Assessed across categories including technologies and connection types, delivery channels, online and mobile products, organisational characteristics, and external threats. Each is rated from least to most inherent risk, producing an overall profile.

The honest difficulty is that inherent risk rises with things the business wants: more digital channels, more third-party connections, more acquisitions, more customer-facing products. Growth raises the profile, which raises the maturity expected — so this assessment must be revisited when the business changes, not only annually.

Part two: cybersecurity maturity

Assessed across five domains — cyber risk management and oversight; threat intelligence and collaboration; cybersecurity controls; external dependency management; and cyber incident management and resilience — each at maturity levels from baseline through evolving, intermediate, advanced and innovative.

Maturity is cumulative: you do not reach a level unless all declarative statements at that level and every level below are achieved. A single unmet statement holds the whole domain down, which is why partial progress across many areas scores worse than completing one level properly.

That cumulative rule is the most common source of surprise. Institutions with genuinely sophisticated capabilities score lower than expected because one baseline statement in the same domain is unmet.

What examiners look for

• Both halves completed, current, and reconciled — a high inherent risk profile with baseline maturity is the finding.
• Board and senior management engagement evidenced, not asserted.
• The assessment used to drive decisions — budget, roadmap, risk acceptance — rather than filed.
• Reassessment when the risk profile changes, including after acquisitions and new product launches.
• Third-party and external dependency management, which is weighted heavily.

Using it well

1. Complete the inherent risk profile honestly. Understating it to make maturity look adequate is transparent to an examiner and undermines everything else.
2. Assess maturity against evidence, statement by statement.
3. Identify where maturity lags the profile — that gap is your roadmap and your board narrative.
4. Take the cheapest route up first: unmet baseline statements holding a domain down, which are frequently documentation rather than capability.
5. Reassess on material change, not just annually.

Relationship to other frameworks

The assessment maps onto the NIST CSF, and institutions frequently run both — CSF as the internal organising structure, the FFIEC assessment as the supervisory-facing output. An existing ISO 27001 or CSF programme covers most of the underlying control substance; the work is the assessment mechanics and the risk-to-maturity reconciliation.

Key takeaways

• Examiners evaluate the relationship between inherent risk and maturity, not either alone.
• Maturity is cumulative — one unmet baseline statement holds a domain down.
• Growth raises inherent risk, so reassess on business change.
• Understating inherent risk is transparent and counterproductive.