What makes Citicus ONE so special?

Citicus ONE is the world’s most-advanced tool for measuring information risk, supplier risk and other areas of operational risk and managing these down to a level that is acceptable to top management, because it:

• measures information risk reliably, and applies the same principles to other key areas of risk
• implements a constructive risk management process
• actively supports and promotes compliance with established standards of practice
• offers a highly efficient way of reliably evaluating risk on an enterprise scale
• produces great-looking, meaningful results for decision-makers from Board-level down.

Citicus ONE measures risk reliably, using techniques informed by years of rigorous, quantitative research into:

• the level of risk posed by thousands of mission-critical systems in use or under development in a wide cross-section of leading enterprises, active in most sectors of economic activity around the globe
• the effectiveness of the arrangements made by the ‘owners’ of those systems to control risk, quantified in terms of their measurable effect in reducing the experience of information incidents and the magnitude of their business impact.

This research was led or conducted by the founders of Citicus Limited for and on behalf of the Information Security Forum (ISF), and Citicus ONE’s statistical base is refreshed every two years, by arrangement with the ISF.

A topic paper summarizing the research findings shown opposite can be obtained by clicking Key facts about risk (PDF, 146KB).

Further details of the research that underpins our approach can be found under Our research foundation.

Citicus ONE implements a constructive risk management process called FIRM, which is based on extensive research into:

• what makes risk analysis and risk monitoring processes effective
• key pitfalls to avoid (eg overly-detailed, sporadic processes that take too much time to implement and produce results that business people don’t understand or believe in)
• secrets of success identified from studies of successful practice and many years of statistical investigations.

Key success factors and pitfalls to avoid are identified under How Citicus ONE works.

Back to top
 

Citicus ONE actively supports and promotes compliance with established standards of practice .

The system is neutral about which standards you employ (providing that they cover all control areas known to be critical).  Thus it can support whatever standards are employed by your organization.  To facilitate deployment, Citicus ONE comes pre-loaded with a series of widely-recognized standards of practice including:

• BS7799 / ISO 17999
• ISF Standards of practice
• IT Governance Institute’s COBIT standard for good IT control practices
• Payment Card industry's Data security Standard (PCI/DSS).

In addition, we provide Citicus-devised standards of practice for areas where we feel existing standards are weak, non-existent or not in a form that can be readily applied.  Currently, these include:

• Citicus supplier relationship framework
• Citicus supplied service framework
• Citicus site security, health and safety framework
• Citicus privacy framework.

These pre-loaded standards are ready for use ‘out of the box’. You can also upload your own policies and standards if you wish.

Back to top
 

Citicus ONE offers the most efficient way by far of reliably evaluating information risk, supplier risk and other areas of operational risk on an enterprise scale that is available on the market today.  This is because our software is designed to yield meaningful and reliable business-oriented results by involving business management and subject practitioners in ways that make optimum use of their time.

The effort involved to carry out evaluations and produce results has been minimized by careful design.  This focus on efficiency means that 1000s of assets, activities, processes and / or external parties can be evaluated and evaluations can be routinely kept up-to-date with modest effort.  As a guide:

• a target of evaluation's criticality can be assessed on-line in minutes
• a full evaluation of risk can be completed in three hours initially
• once completed, full evaluations can be updated in minutes.

Although a programme manager needs to be assigned to drive the risk management process, Citicus ONE enables his or her workload to be shared across a network of local co-ordinators, so no one becomes overburdened.

Back to top