We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Arcanum Cyber Security (Arcanum Information Security Limited) review

Advisory firm

A UK cyber-security consultancy for regulated sectors, assured by the NCSC for audit and review, risk management and security architecture, which also does NCSC CHECK penetration testing.

Relevant if you need NCSC-assured audit, risk management or security architecture work in a regulated sector

Price Published
Indemnity cover Published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

Arcanum Cyber Security scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 2/5
Qualifications of the people who do the work 5/5
What it publishes about fees 4/5
Knowledge of your sector 4/5
Independence from what it sells 4/5
Who carries the risk if the advice is wrong 3/5

What Arcanum Cyber Security offers, and what it publishes

Arcanum Cyber Security holds NCSC Assured Cyber Security Consultancy status for audit and review, risk management and security architecture, UK-wide. It also offers a virtual chief information security officer service. Named case studies cover OneWeb (satellite and telecoms) and Britvic (manufacturing), with a quote from Britvic's David Cox.

Arcanum Cyber Security publishes day rates only in its G-Cloud pricing document for public-sector buyers: £800 Practitioner, £950 Senior Practitioner, £1,200 Principal, excluding VAT. Its own website has no pricing page. The document says indemnity insurance is included in the rate, but names no cover level or insurer.

The firm names its leaders: Jane Chappell, Operations Director, and Lawrie Abercrombie, Technical Director, who it lists as Chartered for Cyber Security. It says it holds CREST accreditation, ISO 27001, ISO 9001, Cyber Essentials Plus and CAA ASSURE membership. We found no NCSC Cyber Incident Response listing for it. Its Companies House accounts do not disclose turnover or profit.

Strengths

  • NCSC Assured Cyber Security Consultancy across three capabilities (Audit and Review, Risk Management, Security Architecture), UK-wide, per its NCSC register page.
  • Named, credentialled leadership: Jane Chappell (MBA, MSc Information Assurance, Fellow of the British Computer Society) and Lawrie Abercrombie (Chartered for Cyber Security), per the firm's own site.
  • Multiple stacked accreditations beyond NCSC assurance: CREST-accredited penetration testing, ISO 27001, ISO 9001, Cyber Essentials Plus, and CAA ASSURE scheme membership for aviation/space clients.
  • Named vCISO/vISM service page describing a defined, ongoing advisory offering rather than only project-based work.
  • Sector breadth evidenced with named case studies: OneWeb (satellite/telecoms ISMS build for Team Telecom compliance) and Britvic (FMCG manufacturing OT compliance, with a named client quote from David Cox).
  • Published, structured day-rate pricing (Practitioner/Senior Practitioner/Principal) with professional indemnity insurance stated as included in the rate, in its public G-Cloud pricing document.

Things to check

  • Arcanum combines NCSC-assured consultancy with NCSC CHECK penetration-testing delivery under one roof, mixing assurance and delivery-layer work.
  • Consultancy day rates are published only in Arcanum's public-sector G-Cloud pricing document, not on its general commercial website.
  • Arcanum files small-company total exemption accounts, which limits public financial detail such as turnover or profit.
  • No NCSC Cyber Incident Response (CIR) scheme assurance was found for Arcanum despite incident-response-adjacent marketing language.

Common questions

Is Arcanum assured by the NCSC?

Yes. It holds NCSC Assured Cyber Security Consultancy status for audit and review, risk management and security architecture. It is also an NCSC Cyber Advisor for SMEs and holds separate CHECK penetration-testing assurance.

What does Arcanum charge?

£800 a day for a Practitioner, £950 for a Senior Practitioner and £1,200 for a Principal, excluding VAT. The rates appear only in its G-Cloud pricing document, which says indemnity insurance is included.

Does Arcanum handle cyber incident response?

Not under the NCSC scheme. We found no NCSC Cyber Incident Response listing; its NCSC page lists consultancy, Cyber Advisor and audit scheme entries, plus separate CHECK penetration testing.

Does Arcanum do penetration testing?

Yes. It holds NCSC CHECK penetration-testing assurance, listed separately from its consultancy. It says it also holds CREST accreditation for penetration testing.

Evidence for each Arcanum Cyber Security score

Show our working

Notes behind each thing to check

  • Arcanum combines NCSC-assured consultancy with NCSC CHECK penetration-testing delivery under one roof, mixing assurance and delivery-layer work. (NCSC's own register lists Arcanum separately for Cyber Security Consultancy and for CHECK Penetration Testing.)
  • Consultancy day rates are published only in Arcanum's public-sector G-Cloud pricing document, not on its general commercial website. (arcanum-cyber.com carries no pricing page; rates appear only in the Digital Marketplace G-Cloud pricing PDF for supplier 92656.)
  • Arcanum files small-company total exemption accounts, which limits public financial detail such as turnover or profit. (Companies House filing history shows 'Total exemption full accounts' filed 30 April 2026, made up to 30 April 2025.)
  • No NCSC Cyber Incident Response (CIR) scheme assurance was found for Arcanum despite incident-response-adjacent marketing language. (NCSC's organisation page for Arcanum lists only Consultancy, Cyber Advisor and Cyber Resilience Audit schemes, no CIR listing.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 2/5 No NCSC Cyber Incident Response (CIR) scheme assurance found; NCSC register lists only Consultancy, Cyber Advisor and Audit schemes for Arcanum.
Qualifications of the people who do the work 5/5 NCSC Assured Consultancy (Audit and Review, Risk Management, Security Architecture), CREST accreditation, ISO 27001, ISO 9001 and Cyber Essentials Plus, per firm's site and NCSC register.
What it publishes about fees 4/5 G-Cloud pricing document names day rates (£800/£950/£1,200) and fixed-price or time-and-materials options, though not shown on its main commercial site.
Knowledge of your sector 4/5 Named case studies span satellite/telecom (OneWeb ISMS build), FMCG manufacturing OT (Britvic) and space (Spaceflux), plus aviation via CAA ASSURE.
Independence from what it sells 4/5 Revenue model is day-rate consultancy per its own G-Cloud pricing document; no evidence found of a tied proprietary software product driving assessments.
Who carries the risk if the advice is wrong 3/5 Firm's own G-Cloud pricing document states professional indemnity insurance is included in the day rate, but no cover level or insurer is published.

Sources for Arcanum Cyber Security

  • Arcanum Information Security Limited is an active company, incorporated 16 April 2008, registered office in Bedwas, Caerphilly, Wales. (Active; incorporated 16/04/2008) (Companies House, checked 19 September 2026)
  • Arcanum holds NCSC Assured Cyber Security Consultancy status covering Audit and Review, Risk Management and Security Architecture, offered UK-wide by a team sized 20+. (NCSC Assured Consultancy: Audit and Review, Risk Management, Security Architecture) (ncsc.gov.uk, checked 19 September 2026)
  • Arcanum is also an NCSC-approved Cyber Advisor for SMEs and a provider under the Cyber Resilience Audit Scheme for Cyber Oversight Bodies. (NCSC Cyber Advisor + Cyber Resilience Audit Scheme provider) (ncsc.gov.uk, checked 19 September 2026)
  • Arcanum separately holds NCSC CHECK Penetration Testing scheme assurance, a delivery-layer service distinct from its consultancy assurance work. (NCSC CHECK-assured penetration testing provider) (ncsc.gov.uk, checked 19 September 2026)
  • Arcanum publishes standard consultancy day rates (Practitioner £800, Senior Practitioner £950, Principal £1,200, exclusive of VAT) and states professional indemnity insurance is included in the day rate, in its G-Cloud pricing document. (Day rates £800/£950/£1,200; PI insurance included in rate) (G-Cloud, checked 19 September 2026)
  • Arcanum states on its own site that it holds CREST accreditation for penetration testing, ISO 27001, ISO 9001 and Cyber Essentials Plus certification, and CAA ASSURE scheme membership. (CREST, ISO 27001, ISO 9001, Cyber Essentials Plus, CAA ASSURE) (arcanum-cyber.com, checked 19 September 2026)

NCSC Assured Cyber Security Consultancy for Audit and Review, Risk Management and Security Architecture, UK-wide (stated on ncsc.gov.uk, checked 2026-09-19) NCSC-approved Cyber Advisor for SMEs, and provider under the NCSC Cyber Resilience Audit Scheme for Cyber Oversight Bodies (stated on ncsc.gov.uk, checked 2026-09-19) NCSC CHECK Penetration Testing scheme assurance, listed separately from its consultancy assurance entry (stated on ncsc.gov.uk, checked 2026-09-19) CREST accreditation for penetration testing, ISO 27001, ISO 9001, Cyber Essentials Plus certification and CAA ASSURE scheme membership, self-stated on arcanum-cyber.com, checked 2026-09-19, not independently verified against the CREST, ISO or CAA registers in this fact-set

First DPO or AI policyRegulated sectorsAfter a ransomware or security incident

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.