We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Amethyst Risk Management Limited review

Advisory firm

A UK cyber-security consultancy listed by the NCSC for audit and review, risk management and cyber resilience audits. It also offers ISO/IEC 27001 support and CISO-as-a-Service.

Relevant if you need a Cyber Assessment Framework audit from an NCSC-listed firm, or ISO/IEC 27001 help

Price Not published
Indemnity cover Not published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

Amethyst Risk Management scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 2/5
Qualifications of the people who do the work 4/5
What it publishes about fees 2/5
Knowledge of your sector 4/5
Independence from what it sells 4/5
Who carries the risk if the advice is wrong 2/5

What Amethyst Risk Management offers, and what it publishes

The NCSC register lists Amethyst under two schemes. As an assured consultancy it covers audit and review, and risk management, for UK customers only. Under the Cyber Resilience Audit scheme it is certified to audit against the Cyber Assessment Framework on behalf of Cyber Oversight Bodies. Founder Stephen Howe is still a director, and the site names its senior team.

Amethyst Risk Management does not publish a price on its site or its G-Cloud listing. The NCSC scheme page says you agree the cost with the provider. It does not publish its indemnity cover, client case studies or how it uses AI. It files exempt accounts, so its turnover and profit are not public.

The site says Amethyst holds ISO 9001, ISO/IEC 27001 and Cyber Essentials Plus, and that all staff hold government security clearance. We found no certificate number or issuing body for the ISO claims on an independent register such as UKAS. The site also shows a Microsoft Partner badge. The firm has traded since May 2007.

Strengths

  • Independently listed on NCSC's own register under two live assurance schemes (Assured Cyber Security Consultancy, and the Cyber Resilience Audit scheme), not just a self-published claim.
  • Publishes ISO 9001, ISO/IEC 27001 and Cyber Essentials Plus certification claims, with all staff said to hold government security clearance.
  • 18+ years of continuous trading (incorporated May 2007) with the founder, Stephen Howe, still an active director and company secretary.
  • Named senior team (Stephen Howe, Karina Green, Georgina Amron-Coetzee, Ross Thomson) with stated long tenure and relevant professional/technical credentials.

Things to check

  • No day rates or pricing are published anywhere found; the NCSC's own Cyber Resilience Audit page states cost is agreed privately between buyer and provider.
  • No professional indemnity insurance or liability disclosure appears on any of the firm's own website pages reviewed.
  • The firm files total exemption full accounts at Companies House, so no turnover, profit or balance-sheet detail is publicly available.

Common questions

Does Amethyst Risk Management publish its fees?

No. Its website lists no day rates or prices. The NCSC's Cyber Resilience Audit page says the buyer agrees the cost privately with the provider.

Is Amethyst's accreditation independently confirmed?

Partly. The NCSC register lists it under two assurance schemes. Its ISO 9001 and ISO/IEC 27001 claims appear only on its own website. We did not find them on an independent register such as UKAS.

Does Amethyst disclose professional indemnity insurance?

No. Its About, Services and Insights pages give no insurance figure, insurer or liability commitment.

Does Amethyst publish client case studies?

No. We found no case study, named result or testimonial on its site.

Evidence for each Amethyst Risk Management score

Show our working

Notes behind each thing to check

  • No day rates or pricing are published anywhere found; the NCSC's own Cyber Resilience Audit page states cost is agreed privately between buyer and provider. (NCSC CRA scheme page states: "You agree the cost of the service with the service provider.")
  • No professional indemnity insurance or liability disclosure appears on any of the firm's own website pages reviewed. (Absence of any PI insurance or liability statement on amethystrisk.com About, Services and Insights pages checked.)
  • The firm files total exemption full accounts at Companies House, so no turnover, profit or balance-sheet detail is publicly available. (Companies House filing history record: "Total exemption full accounts made up to 31 May 2025.")
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 2/5 No published incident-response or regulatory-defence case studies were found on the firm's site or in search; only generic audit and compliance service descriptions were located.
Qualifications of the people who do the work 4/5 NCSC's own register independently lists the firm under two assurance schemes, and the firm publishes ISO 9001, ISO/IEC 27001 and Cyber Essentials Plus claims.
What it publishes about fees 2/5 No rates or pricing are published on the firm's site or its G-Cloud listing; the NCSC scheme page confirms cost is privately negotiated.
Knowledge of your sector 4/5 Two NCSC-assured schemes plus 18 years trading and named directors with stated cyber-security and defence-sector experience support specialism.
Independence from what it sells 4/5 Services described are consultancy and audit led rather than tied to reselling one product, though a Microsoft Partner badge was noted on site.
Who carries the risk if the advice is wrong 2/5 No professional indemnity insurance, warranty or liability commitment is disclosed on any firm-published page reviewed.

Sources for Amethyst Risk Management

  • Company status at Companies House (Active) (Companies House, checked 19 September 2026)
  • Incorporation date (8 May 2007) (Companies House, checked 19 September 2026)
  • NCSC Assured Cyber Security Consultancy listing (Listed for Audit & Review and Risk Management (UK customers only)) (ncsc.gov.uk, checked 19 September 2026)
  • NCSC Cyber Resilience Audit (CRA) scheme certification (Certified to deliver independent cyber audits against the Cyber Assessment Framework (CAF) on behalf of Cyber Oversight Bodies; cost is agreed privately with the provider) (ncsc.gov.uk, checked 19 September 2026)
  • Most recent accounts filed at Companies House (Total exemption full accounts made up to 31 May 2025, filed 4 November 2025) (Companies House, checked 19 September 2026)
  • Certifications the firm publishes about itself (Site states the company is certified to ISO 9001, ISO/IEC 27001 and Cyber Essentials Plus) (amethystrisk.com, checked 19 September 2026)

Listed on NCSC's Assured Cyber Security Consultancy scheme for Audit & Review and Risk Management, UK customers only (stated on ncsc.gov.uk, checked 2026-09-19). Certified under NCSC's Cyber Resilience Audit (CRA) scheme to deliver independent cyber audits against the Cyber Assessment Framework on behalf of Cyber Oversight Bodies (stated on ncsc.gov.uk, checked 2026-09-19). States on its own website that it holds ISO 9001, ISO/IEC 27001 and Cyber Essentials Plus certification; this is a self-published claim, and no certificate number or issuing body was found on an independent register such as UKAS as of 2026-09-19.

Regulated sectorsSeeking ISO 42001 certificationFirst DPO or AI policy

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.