The tool your maturity process was built on was withdrawn. What goes in the board packet now.

A board approved process points at a withdrawn document.

In many community banks and credit unions the tool did more than its status suggested: its risk profile and maturity view fed the board pack, the audit plan, approved target maturities and a yearly comparison someone had to move.

None of that was required. All of it was documented, and documented decisions outlive the documents they were made on.

Revisiting an approved process is board work, best done at a scheduled meeting rather than discovered by an examiner reading last year's minutes. The question is not which framework replaces the tool, but what the board sees next.

What moved, and what did not.

Neither the examination procedures in the FFIEC Handbook nor the board oversight duty moved. The duty depends on your charter and has no size threshold. An institution that stopped running the tool is not out of compliance with anything.

Six things belong in the packet. A maturity score is not first.

1. What the prior process produced, and when it last ran. The approved view, its target maturities and last cycle's date: the baseline most often left out.
2. The withdrawal, and its date. Removed on 31 August 2025, voluntary throughout; no obligation arose or disappeared when it went.
3. The options considered, and why each was on the list. Including running the prior method internally. A list of one is not a decision record.
4. The option chosen, by whom, and on what date. A named owner, a named approver and a date: read first by an examiner, and most often missing.
5. How the new view maps to the prior view. Item by item, so a lower level reads as a different measurement, not a decline; otherwise every movement looks like a regression.
6. The review date, and who owns it. When, on what trigger, and whose name is against it in the minutes.

To explain the change to an examiner without appearing to have lowered the bar, use the same items. Show the mapping and the decision record, not the new number: what you used, why it changed, who approved the change and how the views line up. That is governance. A new score with no record invites one reading: the bar moved and nobody noticed.

Tell the board: a maturity view is a decision tool and not a grade. It decides where the next dollar goes, under any defensible structure.

The AI item has the same shape.

The position is structurally identical: the recognized frameworks for governing AI are voluntary, no regulator examines against them as a binding standard, no body has designated one, and the institution therefore has to record what it chose, who approved it and on what basis.

The obligations that reach the AI are the ones on this page: board oversight of the information security program and oversight of the third parties the tools arrived inside. A counterparty may adopt a framework's structure by contract, and Freddie Mac's Section 1302.8 uses the NIST framework's terms of mapping, measuring and managing AI risk. Frameworks: AI Governance. Register and approval record: AI Governance Assessment.

What this is not.

If you do not want to write the mapping and decision record, that is the work, inside the Security Assessment. Examination and Evidence Readiness puts it in examination form; advisory and vCISO owns the board reporting cycle.

Sources, checked 23 September 2026

1. FFIEC Cybersecurity Assessment Tool Sunset Statement, FFIEC.
2. FFIEC Information Technology Examination Handbook, FFIEC.
3. Interagency Guidelines Establishing Information Security Standards, Appendix B to 12 CFR Part 30, eCFR.
4. 12 CFR Part 748, Appendix A and Appendix B, eCFR.