McAfee will pay US$60 million to acquire Citadel Security Software, a producer of security compliance products that ensure corporate employees are using assigned IT policies.

The deal comes four months after McAfee paid $10 million to acquire PreventSys, also a vendor of risk management and compliance reporting software. McAfee said in March that it aimed to acquire companies in wireless security and Internet surfing.

The new acquisition will buttress McAfee's existing compliance enforcement products, such as ePolicy Orchestrator, Preventsys, Policy Enforcer and Foundstone, said McAfee President Kevin Weiss.

Security compliance is a growing area of concern for IT administrators. McAfee competitor Symantec said last week that it will install a security product in the firmware of Intel Corp. chips to stop hackers and users from disabling security protections.

Citadel's software guides computer users through automated steps to ensure they meet regulatory requirements and internal policies. McAfee could now extend that application to a potential 45 million desktop PCs subscribed to ePolicy Orchestrator.

Citadel was delisted by the Nasdaq stock exchange in May after its share price fell below US$1. The company's troubles continued through the second quarter of 2006, when it posted a US$2.4 million loss on revenue of US$2.9 million earned from sales of its flagship Hercules enterprise vulnerability management software. Hercules customers it listed then included the U.S. departments of Treasury and Defense, and private sector businesses including State Street Bank and Verizon.

McAfee expects to close the Citadel transaction by the fourth quarter of 2006, following stockholder and regulatory approval. The company did not say whether it would retain Citadel's 42 employees.