CRI Profile

TRAC's CRI Profile Module offers an efficient way to replace the FFIEC Cybersecurity Assessment Tool (CAT) with the Cyber Risk Institute’s CRI Profile. Built on a foundation of NIST CSF 2.0, the CRI Profile condenses more than 2,500 regulatory guidelines into a simple, easy-to-use assessment, providing a robust and dedicated alternative for financial institutions looking to replace the CAT.

A Financial Institution-Focused Cybersecurity Framework

While the NIST CSF 2.0 is the most well-known and broadly adopted framework in the World, one potential drawback for financial institutions is that it is also industry-agnostic. For those institutions seeking a CAT replacement that is more focused on the financial services industry, the CRI Profile is a great alternative. Using an Impact Tiering questionnaire, the CRI Profile customizes the control objectives based on the size and complexity of the institution. The control objectives themselves take into account more than 2,500 regulatory expectations, allowing users to meet compliance requirements, while also gaining a better and more holistic understanding of their risk posture.

Endorsed by the Cyber Risk Institute Document your current risk, reasoning, and planned improvements for all 318 diagnostic statements.

Effortlessly Measure and Improve Risk Levels User-friendly TRAC module that aligns with existing risk assessment tools, cross-module functionality, and robust reporting functions.

Always Up to Date

Our team of experts monitors any changes implemented by the CRI to ensure you always have access to the latest CRI Profile.

The flexibility of NIST or the financial focus of CRI? At this pivotal moment of the CAT sunsetting, the decision between the NIST Cybersecurity Framework and the Cyber Risk Institute (CRI) Profile isn’t just technical — it’s strategic. It’s about choosing the roadmap that best supports your mission, your risk posture, and your regulatory environment. Whether you choose the flexibility of NIST or the financial focus of CRI, rest assured that TRAC has you covered with basic and premium implementations of NIST and a fully licensed CRI Profile, endorsed by the Cyber Risk Institute.

Which One Is Right for You?

NIST CSF

CRI Profile

Recognition

The most widely adopted gold standard cybersecurity framework

Underpinned by NIST but built with financial regulators in mind

Flexibility

Universal framework, versatile across industries

Tailor-made for financial institutions for compliance confidence

Depth

High-level map for good cybersecurity practices

Turn-by-turn directions based on over 2500 regulatory exceptions

Audit-friendliness

Audit-adaptable with additional context

Exam-ready by design

Revisions

Only updated once in the 10 years prior to the 2024 version 2.0 release

Updated annually with new content. Major updates every 2-3 years.

Learn More

Request a Demo

It's a great product. Everything is there that is needed.

SBS is helping us solve for the challenges of managing all the critical areas of our information security program through their TRAC software, which provides a centralized, easy-to-use platform. This software streamlines the overall management and provides so many useful tools.

Maranda Baseler

Products are easy to navigate, and reporting is great!

Leah Jo More

We use their TRAC software for all our policies and risk assessments, as well as tracking action items from audit findings.

Lisa Boe

Having the TRAC system is amazing! This platform houses our policies, risk assessments, and vendor management along with the action tracking.

It helps with completing tedious risk assessments and produces customized results that align with regulatory requirements, best practices, and the bank's strategic goals.

Wade Carlson

Information Security & User Experience

Lake Ridge Bank, Wisconsin

Their TRAC system keeps us organized and on track for updates.

SBS helped me create an information security program and everything that goes with it.

Crystal Schuman

Their TRAC product greatly simplifies the reporting and action items for our security policies.

Due to our relationship with them, our regulatory audits have been a breeze with few findings, and those findings are minor or just recommendations.

Angela Jesse

I did not have to recreate the wheel to develop a comprehensive information security program. The TRAC software has all the components, including policies, that are easy to use.

Kim Praeuner

TRAC is very easy to use, and the features available are great.

TRAC is helping to streamline our program while maintaining a level of understanding that fits all across our management and board.

Jenna Parmater

The online portal is very user-friendly and has lots of capabilities to help with risk assessments and reporting.

It is user-friendly and covers all necessary components of the banking industry.

Gwen Loll

TRAC helps me keep organized with documents and offers templates to all the various IT policies.

TRAC helps manage all your policies, procedures, plans, reports, vendor review, and risk assessments. They provide top-notch, experienced consultants to help institutions understand how to best utilize TRAC for their organization.