Risk And Compliance Management Software For Enterprise Assets

Citicus Limited is a British software company formed in 2000 to develop and sell security, risk and compliance management software along with supporting services. Its buyers are enterprise risk, security, and audit teams that need a consistent way to assess and compare exposure across IT systems, cloud services, suppliers and outsourcing partners, physical sites, and industrial automation. Assessments carried out with its products span more than 160 countries, and the company works from London.

The flagship product, Citicus ONE, applies a single scoring method to every kind of asset. Users register what they want to assess, work through criticality and risk questionnaires, and receive a numeric risk score together with a ranked view of the control weaknesses driving it. Because the method does not change between asset classes, results can be compared and rolled up. Remediation actions are tracked to closure, with compliance reporting against frameworks including COBIT 5 and the ISF Standard of Good Practice.

Two companion products extend the same engine. Citicus MOCA collects assessment data on iPhone, iPad, and iPod touch, which suits an assessor walking a site rather than sitting at a desk. Citicus ICS targets industrial control and SCADA environments, where safety and availability shape risk differently than in corporate IT. Citicus ONE is offered as a cloud-based service, its scoring draws on more than 25 years of research into risk factors, and it earned a five-star outstanding rating in an SC Magazine review.