Cyber Risk Institute (CRI) Profile

1. Introduction: The CRI Profile as the Financial Sector's Cybersecurity Rosetta Stone

The Cyber Risk Institute (CRI) Profile, formerly known as the Financial Services Sector Cybersecurity Profile (FSSCP), is a benchmark cybersecurity and resilience framework purpose-built for financial institutions. It was created to solve a very specific pain that CISOs and boards in banking, insurance, asset management and financial market infrastructure feel acutely: regulatory fragmentation. A single global bank may be subject to dozens of overlapping supervisory expectations across jurisdictions, each phrasing broadly similar controls in incompatible language and demanding separate attestations. The CRI Profile harmonises these into a single, extensible questionnaire of diagnostic statements that map back to more than 3,000 individual regulatory provisions and standards worldwide.

For an auditor, the Profile is a structured assessment instrument: each diagnostic statement is a testable assertion of control existence and effectiveness, backed by an explicit mapping to authoritative sources (NIST CSF, ISO 27001, FFIEC, CPMI-IOSCO, G7 Fundamental Elements, GDPR, and many national regulations). For an implementer or CISO, it is a rationalised control catalogue that lets a firm 'answer once, comply many' — completing the Profile once and reusing the answers to demonstrate compliance across multiple examinations. This guide walks both audiences through what the Profile is, how it is structured, and — most importantly — provides a master assessment checklist that enumerates every function and category so nothing is skipped.

2. What is the CRI Profile

The CRI Profile is a cybersecurity risk-management and resilience assessment framework that expresses cybersecurity expectations as a set of diagnostic statements grouped into functions and categories. It began life in 2018 as an initiative of the Financial Services Sector Coordinating Council (FSSCC) and was subsequently stewarded by the Cyber Risk Institute, which released the Profile as an evolving standard. Version 1.x aligned to the NIST Cybersecurity Framework v1.1 five-function model (Identify, Protect, Detect, Respond, Recover) plus two additional financial-sector functions: Govern and Supply Chain / Dependency Management.

CRI Profile v2.0, released to align with NIST Cybersecurity Framework 2.0, reorganised the content around a seven-function model that elevates Governance to a first-class function (mirroring NIST CSF 2.0's new GOVERN function) and retains an explicit Extend / third-party-dependency function that the generic NIST CSF does not carry in the same depth. The Profile is deliberately 'impact-tiered': the number and stringency of diagnostic statements a firm must satisfy scales with its size, complexity and systemic importance, so a community bank and a global systemically important bank (G-SIB) do not answer an identical question set.

• Not a certification scheme — there is no CRI-issued pass/fail certificate; the Profile is a self-assessment and third-party-assessment instrument whose output is a defensible evidence package.
• Regulator-recognised — U.S. and international supervisors (including the FFIEC agencies, and via mappings the EU, UK PRA/FCA, MAS, HKMA and others) recognise Profile-based responses as a way to demonstrate control coverage.
• Extensible — CRI publishes 'extensions' that add mappings to new regulations (e.g., DORA, NYDFS 500, Cloud, AI) without rewriting the core.
• Free to eligible firms — distributed by CRI to promote sector-wide adoption rather than sold as a commercial standard.
• Machine-usable — delivered as a structured workbook so answers can be tracked, versioned and reused across examinations.

3. Who Must Comply / Scope of Applicability

The CRI Profile is voluntary in the sense that no single law says 'thou shalt use the CRI Profile'. However, the underlying regulatory provisions it maps ARE mandatory, and a large and growing set of financial-sector supervisors either accept, encourage or effectively expect Profile-based responses. In practice, any regulated financial entity that faces multiple cyber supervisors benefits from — and is increasingly asked to use — the Profile.

Scope boundaries an assessor must fix first

• Legal entities and business lines in scope (group vs. subsidiary vs. branch).
• Systems supporting critical financial services and 'important business services' (aligned to operational-resilience rules).
• Data classes: customer NPI/PII, transaction records, market data, credentials.
• Third parties, nth-party dependencies and cloud service providers (the Extend function).
• Geographies and the regulators whose mapped provisions are 'switched on' for this assessment.

4. Structure of the CRI Profile

The Profile is organised hierarchically. At the top sit Functions (the seven high-level outcomes). Each Function contains Categories (outcome groupings). Each Category contains diagnostic statements — the atomic, testable requirements a firm answers. Diagnostic statements carry impact-tier applicability flags and an extensive set of mappings to external authorities. The table below sets out the v2.0 seven-function model with its approximate category coverage; treat category counts as indicative, since CRI revises them across releases.

5. Master Assessment Checklist — Every Function and Category

This is the core of the guide. Each h3 below covers one Function; the table under it enumerates its categories with what an assessor must verify and the evidence typically requested. Work through every table — do not skip any function or category. Diagnostic-statement identifiers follow the pattern Function.Category (e.g., GV.RM), with individual statements numbered within the category in the official workbook.

5.1 Govern (GV)

5.2 Identify (ID)

5.3 Protect (PR)

5.4 Detect (DE)

5.5 Respond (RS)

5.6 Recover (RC)

5.7 Extend (EX) — Third-Party and Dependency Management

6. Scoping, Materiality and Impact Tiering

A defining feature of the CRI Profile is impact tiering: rather than imposing every diagnostic statement on every firm, the Profile flags which statements apply based on the institution's national and global systemic footprint. This lets a small institution answer a proportionate subset while a G-SIB answers the full set. The tiering is derived from an impact-tier questionnaire the firm completes before assessment.

Materiality also governs which mapped regulations are 'switched on'. A firm operating only in the US does not need the DORA extension activated; a firm with an EU entity does. The assessor should confirm the impact-tier determination and the enabled regulatory mappings at kickoff, because these two decisions define the entire scope of applicable diagnostic statements. Getting the tier wrong either over-burdens a small firm or, more dangerously, under-scopes a systemically important one.

• Complete the impact-tier questionnaire and obtain sign-off from the CISO and risk committee.
• Enumerate applicable jurisdictions and enable the corresponding regulatory mappings/extensions.
• Confirm important business services and impact tolerances (aligns with operational-resilience rules).
• Document scope exclusions with rationale and compensating rationale for any de-scoped diagnostic statements.

7. Implementation Approach (Phased)

A pragmatic CRI Profile programme runs in five phases. Each phase below lists activities and deliverables.

Phase 1 — Mobilise and Scope

• Activities: secure board/executive sponsorship; obtain the official CRI Profile workbook; complete the impact-tier questionnaire; enable relevant regulatory mappings; define legal entities, business lines and important business services in scope.
• Deliverables: programme charter, scope statement, impact-tier determination, enabled-mappings list, stakeholder RACI.

Phase 2 — Baseline Assessment (Current State)

• Activities: answer each applicable diagnostic statement with a maturity/implementation rating; collect current evidence; interview control owners across the three lines of defence.
• Deliverables: completed baseline workbook, evidence repository index, current-state maturity heatmap by function.

Phase 3 — Gap Analysis and Target State

• Activities: compare current state to target (tier-appropriate) state; identify gaps; assess risk of each gap against appetite; prioritise using impact and likelihood.
• Deliverables: gap register, prioritised remediation roadmap, target-state maturity profile, risk-accepted exceptions log.

Phase 4 — Remediation and Control Uplift

• Activities: execute remediation projects (IAM/MFA uplift, DLP, segmentation, third-party assurance, IR playbooks); update policies; embed controls in BAU.
• Deliverables: remediated controls with evidence, updated policy suite, control-operation runbooks, closed gap items.

Phase 5 — Assurance, Attestation and Continuous Improvement

• Activities: independent (internal audit or third-party) validation; produce regulator-facing response packages; schedule periodic reassessment; feed lessons learned back (ID.IM).
• Deliverables: assurance report, reusable regulatory attestation package, reassessment calendar, continuous-improvement backlog.

8. Maturity / Capability Tiering Model

While the Profile's diagnostic statements are primarily answered as implemented / not implemented with supporting rationale, mature programmes overlay a capability-maturity scale to communicate control effectiveness to the board and to drive uplift. The following five-level model is commonly used alongside the Profile.

A tier-appropriate target is usually Level 3 (Defined) as a floor for all applicable statements, with Level 4 (Managed) expected for high-impact firms on critical functions such as Detect, Respond and Extend.

9. Assessment and Audit Approach

The following ordered steps describe how an independent assessor should conduct a CRI Profile assessment.

1. Confirm engagement scope: Profile version, NIST CSF baseline, impact tier and enabled regulatory mappings.
2. Request and index the evidence set against each applicable diagnostic statement (see section 10).
3. Conduct control-owner interviews across the three lines of defence for each function (GV through EX).
4. Test control design: does the documented control, if operating, satisfy the diagnostic statement?
5. Test control operating effectiveness: sample records over the review period to confirm the control actually operated.
6. Rate each diagnostic statement (implemented / partially / not implemented) with a maturity overlay and cite evidence.
7. Aggregate findings by function and category; produce a maturity heatmap and gap register.
8. Assess each gap against the firm's risk appetite and rate residual risk.
9. Validate third-party and nth-party (Extend) coverage, including concentration risk and exit strategies.
10. Draft findings, obtain management responses and remediation commitments with owners and dates.
11. Issue the assessment report plus a reusable regulatory-response package mapped to applicable supervisors.
12. Agree a reassessment cadence and continuous-monitoring metrics for interim assurance.

10. Evidence Request List

Evidence, categorised by function, that assessors typically request. Provide current, dated artefacts covering the review period.

Governance and strategy

• Board and risk-committee charters and minutes referencing cyber oversight.
• Cyber risk appetite and tolerance statements with approval evidence.
• Cybersecurity policy suite with version history and review records.
• CISO mandate, org chart, RACI and three-lines-of-defence definition.

Identify

• Asset inventory / CMDB exports and data classification register.
• Risk assessments, vulnerability scans and the risk register.
• Important-business-service catalogue and dependency maps.
• Improvement / lessons-learned tracker.

Protect

• IAM/PAM policies, MFA configuration and access-recertification records.
• Security awareness and phishing-simulation reports.
• Encryption and key-management standards; DLP configuration and alerts.
• Patch-management SLAs/reports and hardening baselines (CIS/vendor).

Detect and Respond

• SIEM/EDR coverage matrix and log-source inventory.
• Incident-response plan, severity matrix and sample incident tickets.
• Forensic and root-cause reports; regulatory-notification records.
• SOC monitoring use-cases and alerting thresholds.

Recover and Extend

• Backup/restore test results, RTO/RPO targets and DR exercise reports.
• Third-party inventory, due-diligence questionnaires and SOC 2/ISO 27001 assurance reports.
• Concentration-risk analysis and exit/substitutability plans.
• Recovery and stakeholder-communication logs.

11. Roles and Responsibilities

12. KPIs and Metrics to Track

• Percentage of applicable diagnostic statements fully implemented, by function.
• Maturity index (mean level 0-5) per function and overall trend over time.
• Mean time to detect (MTTD) and mean time to respond/recover (MTTR) for incidents.
• MFA coverage of privileged and remote accounts; percentage of accounts recertified on schedule.
• Critical/high vulnerability remediation SLA adherence and open-vulnerability ageing.
• Percentage of critical third parties assessed within cycle; nth-party mapping completeness.
• Concentration-risk exposure to top providers and exit-plan readiness for critical services.
• Backup-restore and DR test success rate against RTO/RPO objectives.
• Phishing-simulation click and report rates; training completion percentage.
• Number of open high-risk gaps against risk appetite and their ageing.

13. Readiness Checklist

• Official CRI Profile workbook obtained and correct version confirmed.
• Impact-tier questionnaire completed and signed off by risk committee.
• Applicable jurisdictions identified and regulatory mappings/extensions enabled.
• Board-approved cyber risk appetite and cybersecurity policy suite in place.
• Asset inventory and data classification current and complete.
• MFA enforced on privileged, remote and internet-facing access.
• Encryption, key management and DLP operating per data classification.
• Patch and vulnerability management meeting defined SLAs.
• SIEM/EDR monitoring covers all critical assets with tuned use-cases.
• Incident-response plan tested via exercise within the last 12 months.
• Regulatory breach-notification runbooks and contact trees current.
• Backups tested for restore and integrity against RTO/RPO targets.
• Critical third parties risk-tiered, assessed and continuously monitored.
• Concentration risk analysed with documented exit/substitutability plans.
• Evidence repository indexed against each applicable diagnostic statement.
• Independent (internal audit or third-party) validation scheduled.

14. Common Gaps and Findings

• Impact tier set too low, under-scoping applicable diagnostic statements for a systemically important firm.
• Extend function treated superficially — nth-party dependencies and concentration risk unmapped.
• Risk appetite defined but not operationalised; no linkage between appetite breaches and remediation.
• MFA gaps on legacy systems, service accounts or third-party B2B connections.
• Asset and data inventories incomplete, undermining every downstream control.
• Detection coverage gaps: critical assets or SaaS not fed to SIEM; use-cases untuned.
• Incident-response plans exist on paper but are untested; regulatory-notification timelines undefined.
• Backups not tested for restore/integrity, or recovery objectives (RTO/RPO) unvalidated.
• Evidence not indexed to diagnostic statements, forcing re-work at each regulatory examination.
• No continuous-monitoring metrics between annual assessments, leaving control drift undetected.
• Third-party assurance relies solely on attestations (SOC 2) without independent validation.
• Governance oversight lacks quantified KRIs, so board reporting is qualitative and non-actionable.

15. CRI Profile Mapped to Other Frameworks

The Profile's core value is its extensive mapping. The table shows how its functions relate to major frameworks and regulations that firms also face.

Because each diagnostic statement carries these mappings, a firm completing the Profile once can generate targeted response packages for a NYDFS examination, a DORA assessment, an FFIEC review or an ISO 27001 audit without re-answering the underlying questions — the 'answer once, comply many' promise.

16. How CyberSigma Helps

Frequently asked questions

Need help with CRI Profile?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.