Primary Job Title Founder & Director Primary Organization 
Citicus
Location London, England, United Kingdom Regions Europe, Middle East, and Africa (EMEA) Gender Male
Marco Kapp’s 40+ years of experience of IT includes developing and running major systems and providing advice and assistance to leading IT users and suppliers around the world.
As a Director of Coopers & Lybrand’s UK consulting practice, he led a major study into the security of network system which was supported by the European Commission
and over 50 other organizations throughout Europe, and was instrumental in establishing the European Security Forum (ESF) as a successor organization - which itself went on to become the Information Security Forum (ISF). He directed the ESF during its first year of operation.
He subsequently directed, managed or contributed to numerous ESF and ISF projects, including:
development of the 1996 and 1998 Information Security Status Surveys
evolution of the ISF’s Standard of Good Practice for Information Security
statistical analysis of results of the Survey, culminating in the key factor / benchmarking process employed in recent Surveys
numerous publications on the results of the Survey (eg Driving information risk out of the business, information risk reference guide)
development of FIRM - a rigorous, research-based and easy to apply methodology for managing information risk and similar areas of risk across an enterprise
contributing to the ISF’s fast-track-project on e-commerce.
Marco was the chief architect of the FIRM methodology and is a founder and Director of Citicus Limited.
He was a member of the Group of Experts on information security charged by the highly influential OECD with developing Guidelines for the Security of Information Systems. When published, these stimulated and shaped the development of security legislation around the world. He also contributed to the development of the widely used COBIT 4 framework for managing information security enterprise-wide, published by the IT Governance Institute® (ITGI) in 1998.
