# Arcanum Cyber Security (Arcanum Information Security Limited) - **Type:** Advisory firm - **Website:** https://arcanum-cyber.com/ - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A UK cyber-security consultancy for regulated sectors, assured by the NCSC for audit and review, risk management and security architecture, which also does NCSC CHECK penetration testing. ## Arcanum Cyber Security scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 2/5 No NCSC Cyber Incident Response (CIR) scheme assurance found; NCSC register lists only Consultancy, Cyber Advisor and Audit schemes for Arcanum. ### Qualifications of the people who do the work: 5/5 NCSC Assured Consultancy (Audit and Review, Risk Management, Security Architecture), CREST accreditation, ISO 27001, ISO 9001 and Cyber Essentials Plus, per firm's site and NCSC register. ### What it publishes about fees: 4/5 G-Cloud pricing document names day rates (£800/£950/£1,200) and fixed-price or time-and-materials options, though not shown on its main commercial site. ### Knowledge of your sector: 4/5 Named case studies span satellite/telecom (OneWeb ISMS build), FMCG manufacturing OT (Britvic) and space (Spaceflux), plus aviation via CAA ASSURE. ### Independence from what it sells: 4/5 Revenue model is day-rate consultancy per its own G-Cloud pricing document; no evidence found of a tied proprietary software product driving assessments. ### Who carries the risk if the advice is wrong: 3/5 Firm's own G-Cloud pricing document states professional indemnity insurance is included in the day rate, but no cover level or insurer is published. ## Sources for Arcanum Cyber Security Every line carries the page it was read on and the date it was checked. - Arcanum Information Security Limited is an active company, incorporated 16 April 2008, registered office in Bedwas, Caerphilly, Wales. - Source: https://find-and-update.company-information.service.gov.uk/company/06567907 - Checked: 2026-09-19 - Arcanum holds NCSC Assured Cyber Security Consultancy status covering Audit and Review, Risk Management and Security Architecture, offered UK-wide by a team sized 20+. - Source: https://www.ncsc.gov.uk/organisation/arcanum-cyber-security/cyber-security-consultancy - Checked: 2026-09-19 - Arcanum is also an NCSC-approved Cyber Advisor for SMEs and a provider under the Cyber Resilience Audit Scheme for Cyber Oversight Bodies. - Source: https://www.ncsc.gov.uk/organisation/arcanum-cyber-security - Checked: 2026-09-19 - Arcanum separately holds NCSC CHECK Penetration Testing scheme assurance, a delivery-layer service distinct from its consultancy assurance work. - Source: https://www.ncsc.gov.uk/organisation/arcanum-cyber-security/check-penetration-testing - Checked: 2026-09-19 - Arcanum publishes standard consultancy day rates (Practitioner £800, Senior Practitioner £950, Principal £1,200, exclusive of VAT) and states professional indemnity insurance is included in the day rate, in its G-Cloud pricing document. - Source: https://assets.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-14/documents/92656/514226994123838-pricing-document-2024-05-07-1215.pdf - Checked: 2026-09-19 - Arcanum states on its own site that it holds CREST accreditation for penetration testing, ISO 27001, ISO 9001 and Cyber Essentials Plus certification, and CAA ASSURE scheme membership. - Source: https://arcanum-cyber.com/about-arcanum-cyber-security/ - Checked: 2026-09-19 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Published - Indemnity cover: Published - Credentials: Published - Independent accreditation: Published - Client results: Published - How it uses AI: Not published ## Strengths - NCSC Assured Cyber Security Consultancy across three capabilities (Audit and Review, Risk Management, Security Architecture), UK-wide, per its NCSC register page. - Named, credentialled leadership: Jane Chappell (MBA, MSc Information Assurance, Fellow of the British Computer Society) and Lawrie Abercrombie (Chartered for Cyber Security), per the firm's own site. - Multiple stacked accreditations beyond NCSC assurance: CREST-accredited penetration testing, ISO 27001, ISO 9001, Cyber Essentials Plus, and CAA ASSURE scheme membership for aviation/space clients. - Named vCISO/vISM service page describing a defined, ongoing advisory offering rather than only project-based work. - Sector breadth evidenced with named case studies: OneWeb (satellite/telecoms ISMS build for Team Telecom compliance) and Britvic (FMCG manufacturing OT compliance, with a named client quote from David Cox). - Published, structured day-rate pricing (Practitioner/Senior Practitioner/Principal) with professional indemnity insurance stated as included in the rate, in its public G-Cloud pricing document. ## Things to check Each one carries the factual basis it rests on. - Arcanum combines NCSC-assured consultancy with NCSC CHECK penetration-testing delivery under one roof, mixing assurance and delivery-layer work. - Basis: NCSC's own register lists Arcanum separately for Cyber Security Consultancy and for CHECK Penetration Testing. - Consultancy day rates are published only in Arcanum's public-sector G-Cloud pricing document, not on its general commercial website. - Basis: arcanum-cyber.com carries no pricing page; rates appear only in the Digital Marketplace G-Cloud pricing PDF for supplier 92656. - Arcanum files small-company total exemption accounts, which limits public financial detail such as turnover or profit. - Basis: Companies House filing history shows 'Total exemption full accounts' filed 30 April 2026, made up to 30 April 2025. - No NCSC Cyber Incident Response (CIR) scheme assurance was found for Arcanum despite incident-response-adjacent marketing language. - Basis: NCSC's organisation page for Arcanum lists only Consultancy, Cyber Advisor and Cyber Resilience Audit schemes, no CIR listing. ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [After a cyber attack: what to report, and to whom](https://theassurancedesk.com/best/security-incident) - [Which data protection, AI governance and cyber security providers publish a price?](https://theassurancedesk.com/lists/providers-that-publish-a-price) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.