The ORICO Framework is the foundation for the ORICO Tool Both build an Information Security Governance  Risk and Compliance application which can be used for Gap Analysis  Risk Analysis and as a general IT Security Risk Management tool