Citicus Limited is a UK-based private company founded in 2000 that develops and sells security, risk, and compliance management software along with supporting services. Its flagship product, Citicus ONE, is a web-based application that automates the FIRM (Fundamental Information Risk Management) methodology — a framework originally developed by the company's founders in conjunction with the Information Security Forum (ISF). Citicus ONE enables organizations to measure and manage information risk, supplier risk, industrial control systems (ICS) risk, site risk, and other areas of operational risk on an enterprise-wide basis. The platform provides decision-makers with graphical views of information risk, quantitative risk league tables, and tools for reducing risk to acceptable levels. It can be deployed on-premises via an in-house server or accessed as a hosted cloud service. The software has been used to conduct over 25,000 evaluations across 160+ countries, serving customers in sectors including government, banking, insurance, energy, retail, telecommunications, healthcare, and consumer products. Customers have used it to assess risk across business application systems, IT infrastructure components, numerically-controlled equipment (including SCADA systems), suppliers, business processes, and privacy-related projects. Supporting services include training (delivered on-site across Europe, Asia, and the Americas), implementation consulting, and access to an active user group. The FIRM methodology underpinning Citicus ONE is grounded in over 30 years of independent research into the factors that drive information and operational risk. Citicus ONE has received recognition from SC Magazine, including a five-star "outstanding" rating and an Editor's Award.