Requirements & evidence
FFIEC IT Examination Handbook
The living technology-supervision reference used by US financial institution examiners, with current booklets, work programs, laws, and guidance. It is supervisory guidance, not a certification; the separate FFIEC Cybersecurity Assessment Tool was retired in 2025.
- Edition on record
- Current booklets (living collection)
- Edition published
- Not stated by the authority
- Source last checked
Understand the scope
What the framework covers.
The library records this framework for banking, credit unions, financial services, technology service providers, across US. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.
Areas of requirement
- Architecture, infrastructure, and operations
- Audit
- Business continuity management
- Development, acquisition, and maintenance
- Information security
- Management
- Outsourcing technology services
- Retail payment systems
- Supervision of technology service providers
- Wholesale payment systems
The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.
Prepare with context
The evidence behind
the requirements.
Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.
A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.
ControlFrame availability
Framework reference available
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
How availability is determined
FFIEC IT Examination Handbook is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.
Metadata only; the living handbook is not normalized or released as a product module. Any future ingest must pin each booklet revision and must not present the retired CAT as current.
Follow the source
Editions and transitions.
These are the editions recorded in the library, checked August 28, 2026. Confirm the applicable edition with the authority before beginning an assessment.
- Current booklets (living collection)Current edition on recordPublication date not recorded
Check the basis
Sources you can follow.
Verified against the issuing authority’s own publication. Source verification was recorded on August 28, 2026.
- Federal Financial Institutions Examination Council (opens in a new tab)
Issuing authority and framework publication.
- Edition reference: Current booklets (living collection) (opens in a new tab)
The publication used to establish the recorded edition.
Catalog provenance and record details
Framework record: ffiec-it-examination-handbook.
Source artifact: acquisition required.
Parsed catalog: Not ingested.
Control families as published: Architecture, infrastructure, and operations · Audit · Business continuity management · Development, acquisition, and maintenance · Information security · Management · Outsourcing technology services · Retail payment systems · Supervision of technology service providers · Wholesale payment systems.
Record last updated: August 28, 2026.
Common questions
A closer look.
What is FFIEC IT Examination Handbook?
The living technology-supervision reference used by US financial institution examiners, with current booklets, work programs, laws, and guidance. It is supervisory guidance, not a certification; the separate FFIEC Cybersecurity Assessment Tool was retired in 2025.
Who does FFIEC IT Examination Handbook apply to?
FFIEC IT Examination Handbook applies to banking, credit unions, financial services, technology service providers, US, per Federal Financial Institutions Examination Council.
What is the current version of FFIEC IT Examination Handbook?
The current edition is Current booklets (living collection), issued by Federal Financial Institutions Examination Council. Source: https://ithandbook.ffiec.gov/.
What does an assessment under FFIEC IT Examination Handbook require?
No control catalog has been ingested for FFIEC IT Examination Handbook yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.
At a glance
FFIEC IT Examination Handbook
Current booklets (living collection)
- Framework reference
- Authority and edition tracked
- Evidence preparation
- Framework reference available
- Source confidence
- Primary authority
A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.
Make the requirements
part of the work.
Explore how ControlFrame can organize FFIEC IT Examination Handbook requirements, evidence preparation, and review for your assessment scope.