From Framework to Risk Assessment: Closing the Gap

The CAT is gone, and with it the default answer to “what framework do we use?” What’s left is a menu: NIST CSF 2.0, the CRI Profile, and more. Most institutions have picked something. Far fewer have made it do any work.

This session is about closing that gap. We’ll start with the choice itself — where NIST and CRI actually differ, which one fits an institution your size, and how to check your pick against the exam procedures your regulator will follow during your exam. Then we’ll move past selection into what matters more: mapping your real control universe to the framework so you can see coverage instead of assuming it, finding the blind spots your second line can’t see today, tracking against the framework over time rather than once a year, and using it as a maturity path instead of a filing cabinet.

Frameworks list controls. They don’t list risks. We’ll close by connecting the two — how a framework-mapped control universe feeds a risk assessment that stands on its own, so the framework, the controls, and the risks tell one story to your board and your examiner.

You’ll leave with

• A clear view of the NIST vs. CRI differences that matter for a bank or credit union.

• A practical method for mapping controls to a framework and reading the coverage picture honestly.

• The second-line blind spots we see most often, and how to surface them.

• A path from framework coverage back to risk assessment, so the two stop living in separate spreadsheets.