Citicus ICS is a web-based risk management platform specifically implemented for industrial control systems (ICS), including SCADA, DCS, PLC, and RTU environments. It is a specialized version of the Citicus ONE software, adapted to account for the real-time and operational characteristics of ICS environments. The platform follows a four-phase Plan-Do-Check-Act (PDCA) risk management lifecycle, guiding organizations through continuous assessment and treatment of ICS-related risks. At the core of Citicus ICS is a risk scorecard that evaluates five key risk factors: - Criticality: Measures the potential impact of ICS incidents on availability, data integrity, and confidentiality of control systems. - Status of Controls: Assesses controls against a library of industry best practice frameworks, including CPNI Good Practice Guides and NIST 800-82. The control framework can be used as-is or customized. - Special Circumstances: Accounts for ICS-specific risk drivers such as system complexity, degree of change, interconnections, and external accessibility. - Level of Threat: Evaluates incident probability using historical metrics including malfunctions, human error, malicious actions, and environmental disruptions. - Business Impact: Measures actual business harm from past ICS incidents, covering financial, reputational, environmental, and safety impacts. Assessment results are presented graphically, showing the status of each risk factor and the overall risk level. The platform also supports the creation of risk treatment plans that can be costed, prioritized, and assigned to individuals, feeding into subsequent assessment cycles.