Enterprise risk & compliance · 4 frameworks · 6 business units
Know exactly where your risk lives.
CITADEL maps every risk, control and compliance obligation in one place, so residual exposure and control gaps read as a heat-map you can act on, not a spreadsheet you dread.
Is our exposure under control?
Eight vitals for the programme, each against its 12-month trend. Filter or click any mark below to focus the whole page.
Where the risk concentrates, before and after controls
The shape of the register: the inherent-vs-residual heat map, how open risk has trended, which categories carry it, how controls move inherent exposure to residual, and where residual sits against appetite.
How a top risk is actually controlled
The bowtie for a chosen top risk — threats, preventive barriers, the top event, mitigating barriers and consequences — plus how effective controls are by type and framework, whether risks are truly covered, and the overall control status.
Are we compliant against our frameworks?
Posture across ISO 27001, SOC 2, NIST CSF and GDPR — the radial composition of every domain by status, framework-level implementation, the improving trend, where the gaps cluster, and NIST CSF maturity against target.
What's open, and is remediation keeping pace?
The findings register with aging and severity, how findings flow in by severity over time, the treatment pipeline from identified to complete, whether open treatments are burning down to plan, and who is carrying overdue work.
Where the dollars at risk are
Residual likelihood against impact with the top exposures named, exposure by business unit and category, the largest individual risks, the rhythm of control testing, and the programme's vitals as small multiples.