Trusted Standards for
Evolving Risks
The Cyber Risk Institute's mission is to advance the development and harmonization of cybersecurity, technology, and AI risk management standards for the financial services industry.
As a not-for-profit (501[c][6]), standards development organization, CRI connects threats to mitigating controls and associated compliance to provide institutions with a comprehensive view of risk—from the server room to the boardroom. We do this through our products—CRI Profile, Cloud Profile, and FS AI RMF—member engagement, and an ecosystem of globally-known tool providers and consulting firms.
One Framework for Global Alignment
The CRI Profile is a cybersecurity and technology framework built by and for the financial sector grounded in globally recognized standards. It connects the dots between best practices and regulatory expectations from all over the world—helping institutions stay secure, aligned, and prepared.
Key Benefits:
Regulatory Alignment:
Aligns with major financial sector cybersecurity and technology risk management standards supporting global supervisory expectations.
Streamlined Assessments:
Simplifies and reduces the burden of compliance assessments through a unified, standardized approach.
Industry-Driven, Broadly Accessible:
Developed by industry leaders and made available to all institutions – promoting consistent, scalable risk management.
Bridging Threats, Compliance and the Boardroom:
Connects leading threat frameworks to control objectives and regulatory expectations—enabling clear, risk-informed oversight at the executive and board levels.
What is the Profile?
The CRI Profile is a financial-sector-led cybersecurity framework aligned with globally recognized standards and regulatory expectations. It supports consistent implementation of risk management practices, facilitates supervisory engagement, and promotes harmonization across jurisdictions.
What makes the Profile different from other frameworks is that CRI seeks regulatory feedback to ensure more complete mappings, thus increasing its acceptance.
CRI Profile v2.0
The CRI Profile is based on the National Institute of Standards and TechnologyĘĽs (NIST) “Framework for Improving Critical Infrastructure Cybersecurity” and is aligned to NIST Cybersecurity Framework version 2.0.Â
The Profile offers an efficient approach tailored to the needs of the financial services sector–helping institutions spend less time on compliance and more time on front-line defense.
Cloud
CRI’s Cloud Profile is an extension of the CRI Profile developed through collaboration with the Cloud Service Providers. It provides actionable cloud security guidance for firms looking to implement or strengthen existing cloud technologies and operations.
Translated
CRI is helping the financial sector speak the same language across borders. Find the Profile translated in Japanese, Spanish, and Portuguese.
Membership
The Cyber Risk Institute mission is to advance the development and harmonization of cybersecurity, technology, and AI risk management standards for the financial services industry.Â
Marketplace
The CRI Marketplace is a hub for tools, products, and services designed to help financial institutions adopt and implement CRI resources. Whether you’re just getting started or looking to modernize your program, the CRI Marketplace offers resources to support every stage of your journey. The CRI is a not-for-profit coalition of financial institutions and trade associations working to protect the global economy by enhancing cybersecurity through standardization.
Become A Member
Help shape the future of cybersecurity, resilience, and AI risk management.
Develop Products
Be at the forefront of standards development and global alignment:
- Profile updates and mappings
- Artificial Intelligence (AI) Framework
- Maturity Model
- Minimum Controls for Third Parties
- New Global Mappings from EU, Australia, Japan
Equip Members
Get the support and resources you need to implement with confidence:
- Free Online Tool
- Committees & Working Groups
- In-Person Events
- Ecosystem Relationships
- Training Materials
- CRI Profile Translations
Engage Regulators
Stay informed and represented in global regulatory discussions through CRI’s relationships. See statements of acknowledgement from:
- Japan’s Financial Services Agency as a “relevant guideline” alongside the NIST Cybersecurity Framework
- CISA included a CRI mapping in the CPGs and acknowledged CRI in its CPG Matrix
- NYDFS re-cited the Profile in its public FAQs
- ...And more
){kind=icon}