CRI Profile — Cyber Risk Institute Profile

Why does it matter?

US and international supervisors expect financial institutions to run cyber and technology risk programs, but each wording differs, so institutions answer the same question many times. CRI built the Profile so that one assessment can be reused across supervisors, scaled to the institution's systemic impact rather than its asset size.

Key benefits include:

• One assessment for many supervisors

The Profile maps its diagnostic statements to about 40 regulatory references and standards, among them NYDFS Part 500, the EU's DORA and the CISA Cybersecurity Performance Goals, so one set of answers can serve several examiners.

• Expectations scale with impact

Nine questions place an institution in one of four Impact Tiers, and version 2.0 applies 318 diagnostic statements to Tier 1, 311 to Tier 2, 282 to Tier 3 and 208 to Tier 4.

• Governance and third parties are named functions

The Govern function follows NIST CSF 2.0, and CRI's own Extend function carries third-party lifecycle management, so supplier risk has its own place in the assessment.

• Evidence is part of the assessment

Each diagnostic statement has explanatory guidance, examples of commonly used artifacts, and fields for the rating, the rationale and the supporting evidence.

• Reporting is ready for the board

A response summary shows the distribution of ratings by function, category and subcategory, which helps boards see gaps and track remediation.

How does it work?

The Profile workbook has seven functions: Govern, Identify, Protect, Detect, Respond, Recover and Extend. Functions divide into categories and subcategories, and each subcategory has at least one diagnostic statement that the institution assesses (User Guide, section 4.2). Version 2.0 kept a direct mapping to NIST CSF 2.0, added Extend, and added subject tags for filtering, 108 at launch.

Four Impact Tiers describe the effect an institution would have if a cyber event substantially hit it: Tier 1 national or super-national, Tier 2 subnational, Tier 3 sector and Tier 4 localized, typically with fewer than one million customers. An institution enters its tier, and the workbook marks each diagnostic statement as To Be Assessed or Not Applicable. Re-evaluation is expected after an acquisition, a new business line, significant growth, a major threat change or a change of tier (User Guide, section 5).

Version 1.0 appeared in 2018 and version 2.0 in February 2024. Version 2.1 followed on April 15, 2025 with a Maturity Model that scores responses at diagnostic statement level and is open only to CRI members, Innovators and Affiliates. Version 2.2, released April 30, 2026, added 13 mappings and updated three, for 40 in total. CRI says versions 2.1 and 2.2 did not change the diagnostic statements.

Key Elements

• Seven functions

Govern, Identify, Protect, Detect, Respond, Recover and Extend organize the Profile. Extend is CRI's addition for third-party lifecycle management, so supply chain controls sit in one place rather than inside Govern.

• Diagnostic statements

The 318 diagnostic statements are the control objectives an institution assesses. They cover about a dozen topics added in version 2.0, such as technology governance, shadow IT management and encryption standards and key management.

• Impact Tiering Questionnaire

Nine questions based on systemic impact, not asset size, assign Tier 1 to Tier 4. The tier decides which statements apply, and a later review of the next tier up gives a roadmap for advanced security.

• Assessment ratings

Each applicable statement is rated Yes, Yes-Risk Based, Yes-Compensating Control, Partial, No, To Be Determined or Not Applicable, with a rationale and supporting evidence. Yes means the control is tested regularly and shown to operate reliably.

• Mapping catalog

CRI publishes the mappings in a catalog. Examples include NIST CSF 2.0, NIST SP 800-53 Rev. 5 through NIST's OLIR program, NYDFS Part 500, CISA's performance goals, EU DORA, EBA and MAS technology risk guidelines, and MITRE ATT&CK.

• Guidebook and supporting documents

CRI offers a Guidebook for implementation, a User Guide, a Fact Sheet and the Impact Questionnaire. The Maturity Model for benchmarking against peers is limited to CRI members, Innovators and Affiliates.

What does it cover?

The Profile is designed for financial institutions, financial services companies, financial firms and their third-party providers, across banking, insurance, asset management, market utilities and broker-dealers (CRI Profile FAQ, question 7). Its use is voluntary, and the Profile does not limit what a supervisor may review or require. A mapping to an agency's publication does not mean that the agency endorses the Profile (User Guide). The assessment covers technology and cybersecurity risk management governance, processes, capabilities and regulatory compliance posture.

What are its objectives?

The Profile gives financial institutions one efficient way to manage technology and cyber risk and show supervisors adequate assurance.

Reduce duplicate assessment by harmonizing regulatory expectations into diagnostic statements.

Scale expectations to an institution's systemic impact through four Impact Tiers.

Keep governance and third-party risk visible through the Govern and Extend functions.

Give boards plain-language gap reporting and a way to track remediation over time.

Give supervisors a consistent framework and better organized evidence in examinations.

Stay current through regular releases and new mappings, rather than a one-time document.

Framework in Context

The Profile extends NIST CSF 2.0 with the Extend function, sector diagnostic statements and regulatory mappings, and draws on ISO/IEC 27001 and 27002 and CPMI-IOSCO guidance (CRI Profile FAQ, questions 4 and 5). In the United States, the FFIEC retired its Cybersecurity Assessment Tool on August 31, 2025 and said institutions may refer to NIST CSF 2.0 and CISA's performance goals directly, or consider industry resources such as the CRI Cyber Profile and the CIS Critical Security Controls. CRI also publishes a Cloud Profile and the Financial Services AI Risk Management Framework.

Common Framework Mappings

CRI publishes mappings from the Profile to the regulations and standards below, and its catalog lists about 40 references in all. The names here match the framework pages on this site.

Mapped frameworks include:

NIST CSF 2.0

NIST 800-53 Rev.5

NYDFS 23 NYCRR 500

EU DORA

EBA GL/2019/04

MAS TRM 2021

CISA CPG

FFIEC CAT

FFIEC IT Handbook

MITRE ATT&CK

CIS Controls v8.1