CRI Profile Compliance (Community)
Assess and manage cybersecurity compliance using the Cyber Risk Institute framework — with assessment workflows, shared mappings, and a stronger foundation for supervisory readiness.
Product Overview
Streamline Cybersecurity Compliance with the CRI Profile
CRI Profile Compliance (Community) is a productized solution built to help organizations operationalize the Cyber Risk Institute Profile in a repeatable way. Developed by and for the financial sector, the CRI Profile is grounded in globally recognized standards and designed to support alignment with supervisory expectations. SmartSuite’s CRI Profile Compliance (Community) software gives organizations a scalable system for managing CRI-based assessments, evidence, and remediation.
SmartSuite enables organizations to standardize how CRI diagnostic statements are assessed, how supporting evidence is collected, and how control gaps are tracked across business units and teams. With a central system of record, organizations can manage CRI-aligned compliance activities in a way that is repeatable, auditable, and defensible.
The CRI Profile was created for financial institutions, and CRI makes it available to all institutions. The product therefore suits financial services firms, fintechs, and other organizations that want a stronger foundation for cybersecurity and technology risk compliance.
How the two editions differ
CRI Profile Compliance (Community) covers the core CRI assessment workflow: scoping, responses to diagnostic statements, evidence collection, mapping of CRI requirements to internal controls and policies, gap identification, and remediation tracking. CRI Profile Compliance (Enterprise) adds assessments across multiple entities, regions, and regulatory environments, advanced mapping across frameworks for “test once, comply many” reuse, continuous compliance monitoring, evidence management at scale, and enterprise dashboards.
SmartSuite dashboards show CRI compliance posture as work progresses, so teams can track assessment progress, monitor evidence completion, and identify areas that need remediation. This supports more efficient supervisory preparation, clearer internal accountability, and a more consistent approach to cyber compliance.
As part of SmartSuite’s connected GRC architecture, CRI Profile Compliance (Community) extends beyond a standalone framework assessment.
CRI compliance insights are informed by:
- Control mappings and regulatory libraries
- Risk assessments and enterprise risk activities
- Policy management and governance standards
- Issues and remediation workflows
- Audit and testing activities
CRI compliance is therefore managed as an ongoing process across governance, risk, and operations, not as a one-time exercise.
The product supports a wide range of use cases, including:
- CRI Profile assessments and responses
- Cybersecurity supervisory preparedness
- Control mapping and evidence collection
- Gap identification and remediation tracking
A CRI compliance program built on SmartSuite is:
- Defensible for examiners, auditors, and internal stakeholders
- Efficient and scalable across compliance teams and business units
- Transparent for cybersecurity, risk, and compliance leaders
What is CRI Profile Compliance (Community)?
CRI Profile Compliance (Community) is a solution for managing cybersecurity compliance using the Cyber Risk Institute Profile. It lets organizations assess controls, collect evidence, and improve supervisory readiness against a standardized framework.
Core Capabilities
SmartSuite’s CRI Profile Compliance (Community) product covers the capabilities needed to manage CRI-based compliance programs at scale: assessments, evidence management, and reporting in one platform. Each capability works with other SmartSuite products, so risk, policy, audit, and operational workflows stay aligned.
CRI Profile Assessments
Run assessments against CRI diagnostic statements with consistent workflows, scoring, and evidence requirements.
Evidence Collection
Collect, organize, and manage supporting evidence with traceability and audit-ready documentation.
Control Mapping
Map CRI requirements to internal controls, policies, and related regulatory obligations for stronger alignment.
Gap Identification
Identify control gaps and incomplete responses across diagnostic statements and mapped requirements.
Remediation Tracking
Assign owners, monitor corrective actions, and track progress through remediation workflows.
Assessment Dashboards
Visualize completion status, evidence readiness, and compliance posture through dashboards and reporting.
Workflow Automation
Automate requests, reminders, approvals, and escalations using no-code workflows.
Version & Response History
Maintain a clear history of responses, updates, and evidence changes over time.
Role-Based Access Control
Control who can see CRI assessments, evidence, and remediation data across teams and stakeholders.
The Compliance Lifecycle
SmartSuite supports the full CRI compliance lifecycle, from assessment through remediation, with linked workflows and dashboards.
Scope the Assessment
Define participating teams, business areas, and CRI assessment scope.
Assess Requirements
Evaluate diagnostic statements and document responses across relevant functions.
Collect Evidence
Gather supporting evidence and validate completion against assessment expectations.
Identify Gaps
Highlight missing controls, incomplete evidence, and areas requiring action.
Remediate & Report
Track remediation and provide clear reporting for leadership, auditors, and exam readiness.
Connected Risk Ecosystem
CRI Profile Compliance (Community) shares data with other SmartSuite GRC products, so CRI compliance can be reviewed alongside risk, controls, audit, and operational work.
Keep controls in one library and map them across frameworks to reduce duplication and enable a test-once, comply-many approach.
Manage assessment campaigns and testing schedules with a reusable question library, automated workflows, and one place for evidence collection.
Plan, execute, and report on audits with complete assurance oversight — linking findings to risks, controls, and remediation actions in a single workspace.
Centralize enterprise risk management with standardized assessments, dashboards, and linked workflows that align risk, controls, and mitigation across your organization.
Who This Product Is For
The CRI Profile Compliance (Community) product supports stakeholders across cybersecurity, compliance, risk, and audit teams, giving them one consistent approach to CRI-based compliance.
Chief Information Security Officer
Compliance Manager
IT Risk Manager
Control Owner
Internal Auditor
Executive / Board Member
Frequently Asked Questions
Answers to the questions readers ask most about this topic.
CRI Profile Compliance (Community) is built on the Cyber Risk Institute (CRI) Profile, a standardized set of cybersecurity and risk management controls designed for financial institutions. The Community edition offers a foundational way to manage cybersecurity compliance with a widely recognized industry framework. That matters because financial institutions face growing regulatory pressure and need a consistent way to demonstrate compliance. SmartSuite lets organizations operationalize the CRI Profile in one platform, which makes it easier to manage controls, assessments, and evidence, and adopting a common framework reduces complexity.
SmartSuite turns the CRI Profile into data models, workflows, and control libraries that teams use directly in the platform. Organizations manage controls, map requirements, and run assessments based on CRI guidelines, and each control links to workflows for testing, validation, and evidence collection. Embedding the framework in workflows means it is used in daily operations, not only documented.
The CRI Profile gives financial institutions a common language and structure for managing cybersecurity risks and controls. SmartSuite applies that structure by standardizing how controls are defined, assessed, and monitored, so all teams follow consistent practices. Aligning cybersecurity activities with CRI also improves comparability, which helps organizations that work with regulators and partners.
Organizations define CRI-aligned controls and manage assessments through workflows in SmartSuite. Each control can be tested, validated, and linked to supporting evidence, and assessments are assigned to responsible teams and tracked as they progress. Automated workflows keep assessments on schedule and replace manual processes.
Evidence links directly to CRI controls and assessments in SmartSuite, so teams upload, review, and validate it in one place. Activity history keeps each item traceable, and automated workflows prompt owners to refresh evidence regularly. During audits, teams retrieve evidence without hunting through files, which shortens audit preparation.
SmartSuite connects CRI Profile Compliance with enterprise risk, audit, and control management workflows. Controls can be linked to risks, which shows how cybersecurity affects overall risk exposure, and audit workflows can validate CRI compliance from the same data. Teams share one platform instead of separate tools, which gives leaders a broader view of governance.
Adopting a recognized industry framework gives organizations a structured way to build cybersecurity maturity. SmartSuite provides the tools to implement CRI-aligned controls, monitor them, and keep improving them, with dashboards that show compliance status and performance. Over time, teams identify gaps, strengthen controls, and improve resilience.
Both editions help organizations assess themselves against the Cyber Risk Institute Profile. The Community edition covers the core workflow: scoping the assessment, responding to diagnostic statements, collecting evidence, mapping CRI requirements to internal controls and policies, identifying gaps, and tracking remediation. The Enterprise edition adds assessments across multiple entities, regions, and regulatory environments, advanced mapping across frameworks for “test once, comply many” reuse, continuous compliance monitoring, evidence management at scale, and enterprise dashboards. Organizations that need those capabilities should review CRI Profile Compliance (Enterprise).
Strengthen Cyber Compliance with a CRI-Aligned Foundation
SmartSuite gives you a GRC platform for managing CRI assessments, evidence, and remediation with more structure and visibility.