The Challenge
When the news broke that the FFIEC Cybersecurity Assessment Tool (CAT) would retire in August 2025, IT leaders in the community banking sector scrambled to find a replacement. Dan Brunnquell, Director of IT at Wolf River Community Bank, watched peers in ICBA meetings and industry tabletops piece together spreadsheets, work through NIST 2.0, or stretch into frameworks broader than their IT scope called for. After months of work, many still haven’t found a solution and face weeks of work to put one in place.
Wolf River started preparing well before sunset. Dan paid for access to NIST, CIS, and CRI assessments, evaluating each against the bank’s specific needs. His read differed from the industry’s: the tool they had used for years didn’t need to be rebuilt, it needed a direct replacement.
The Solution
The bank signed on with Finosec in December of 2025, as soon as the Finosec CAT became available. More than 60% of Wolf River’s control set imported directly into the new tool, leaving only a small set of differentials. Dan finished that work in a single afternoon.
Dan routed the differentials through the ISO and outside IT consultant for independent review before bringing the package to the board. The CIS framework fit Wolf River’s IT scope without pulling the assessment into broader data-governance work. An open-ended project for most institutions became a once-a-year checkpoint for Wolf River Community Bank.