We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

RightCue Consulting Services Ltd review

Advisory firm

A UK cyber-security consultancy, founded in 2009 by two former PwC colleagues, offering ISO 27001 help, Cyber Essentials preparation and virtual-CISO services for smaller firms.

Relevant if you are a small firm seeking Cyber Essentials or appointing a first virtual CISO

Price Not published
Indemnity cover Not published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

RightCue Consulting Services scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 3/5
Qualifications of the people who do the work 4/5
What it publishes about fees 2/5
Knowledge of your sector 4/5
Independence from what it sells 3/5
Who carries the risk if the advice is wrong 2/5

What RightCue Consulting Services offers, and what it publishes

The UK's National Cyber Security Centre lists it as an Assured Service Provider for Cyber Incident Exercising and an approved Cyber Advisor for smaller firms. Its named case studies cover defence, finance, healthcare and pharma, and legal clients; Nurture Group's CIO, Eoin O'Connell, describes its virtual-CISO work, from staff training to phishing tests and board advice.

RightCue Consulting Services does not publish a price. Every service page leads to an enquiry form. It does not publish professional-indemnity insurance. Apart from its two founder-directors, it names no consultants and describes staff only as a group, for example as 'Chartered Cyber Security Professionals'. Its privacy notice says nothing about its own use of AI.

RightCue Consulting Services says it became a Cyber Essentials certification body through the IASME Consortium in 2014, and is one for DCC too. We could not check this on IASME's register. It also sells paid help preparing for those same schemes, a dual role its site discloses. Its NCSC listing covers simulated incident exercises; we found no case of live breach response.

Strengths

  • NCSC Assured Service Provider status for Cyber Incident Exercising, plus NCSC-approved Cyber Advisor status for SMEs.
  • IASME Cyber Essentials certification body since 2014 (per the firm's own site), one of the scheme's earlier-approved bodies.
  • CREST-accredited for penetration testing and ISO 27001 certified, with named founder-directors (ex-PwC) in place since 2009.
  • Named, dated case studies across defence, finance, healthcare/pharma and legal clients, including a named client contact (Nurture Group CIO Eoin O'Connell) for the vCISO service.

Things to check

  • No fee rates, ranges or pricing model are published anywhere on the firm's website; every service page routes enquirers to a direct 'talk to us' contact form.
  • No professional indemnity insurance cover, limit or provider is disclosed on the firm's website or in its privacy notice.
  • Individual consultant credentials are described only collectively (e.g. 'Chartered Cyber Security Professionals'), with no named individual qualifications or membership numbers published.

Common questions

Does RightCue publish its fees?

No. It publishes no rates, ranges or pricing model; every service page leads to an enquiry form.

Is RightCue a Cyber Essentials certification body?

It says so. Its site states it became one through the IASME Consortium in 2014. We could not check this on IASME's own register.

Does RightCue disclose professional-indemnity insurance?

No. Neither its website nor its privacy notice mentions cover, a limit or an insurer.

Which sectors do its case studies cover?

Defence, finance, healthcare and pharma, and legal. The case studies are named and dated, and include Nurture Group's CIO, Eoin O'Connell, on its virtual-CISO service.

Evidence for each RightCue Consulting Services score

Show our working

Notes behind each thing to check

  • No fee rates, ranges or pricing model are published anywhere on the firm's website; every service page routes enquirers to a direct 'talk to us' contact form. (Checked rightcue.com/it-audit/ and rightcue.com/virtual-ciso/; neither page contains any pricing or fee-structure text.)
  • No professional indemnity insurance cover, limit or provider is disclosed on the firm's website or in its privacy notice. (Reviewed rightcue.com/about/ and rightcue.com/privacy-notice/; neither mentions PI insurance.)
  • Individual consultant credentials are described only collectively (e.g. 'Chartered Cyber Security Professionals'), with no named individual qualifications or membership numbers published. (rightcue.com/about/ names only the two director-founders; no other named, credentialed consultants appear on the site.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 3/5 NCSC lists RightCue as an Assured Service Provider for Cyber Incident Exercising, but no independently verifiable case of live regulatory-defence or breach-response work was found in public sources.
Qualifications of the people who do the work 4/5 Firm's own site and NCSC confirm CREST accreditation (2023), IASME Cyber Essentials CB status since 2014, ISO 27001 certification (2020) and DCC CB status (2025).
What it publishes about fees 2/5 No fee rates, ranges or pricing structure are published on any service page; all pricing requires direct enquiry, per rightcue.com.
Knowledge of your sector 4/5 Named, dated case studies span defence, finance, healthcare/pharma and legal clients, including a named CIO testimonial for the vCISO service.
Independence from what it sells 3/5 Firm is both an IASME/DCC certification body and a paid consultancy preparing clients for those same certifications, a structural dual role disclosed on its own site.
Who carries the risk if the advice is wrong 2/5 No professional indemnity insurance cover, limit or liability commitment is disclosed on the firm's website, privacy notice or Companies House filings reviewed.

Sources for RightCue Consulting Services

  • RightCue Consulting Services Ltd is registered at Companies House under number 06866953, status Active, incorporated 1 April 2009 (previously named Right Cue Consulting Services Limited, and before that Svyam Limited). (Active; incorporated 1 April 2009) (Companies House, checked 19 September 2026)
  • NCSC lists RightCue Consulting Services Ltd as an Assured Service Provider for Cyber Incident Exercising and as an NCSC-approved Cyber Advisor providing guidance to UK SMEs. (NCSC Assured Service Provider (Cyber Incident Exercising) + approved Cyber Advisor) (ncsc.gov.uk, checked 19 September 2026)
  • RightCue's own site states it became a Cyber Essentials certification body via the IASME Consortium in 2014, and was founded in 2009 by ex-PwC colleagues Yogesh Agarwal and Sonal Agarwal. (Cyber Essentials CB since 2014; founded 2009) (rightcue.com, checked 19 September 2026)
  • Companies House records both Sonal Agarwal (appointed 25 May 2009) and Yogesh Agarwal (appointed 1 April 2009) as the company's current, active directors. (2 active directors: S. Agarwal, Y. Agarwal) (Companies House, checked 19 September 2026)
  • RightCue's privacy notice states 'We do not use automated decision-making in relation to your personal data' and contains no statement about the firm's own use of AI tools in service delivery. (No automated-decision-making; no AI-use disclosure) (rightcue.com, checked 19 September 2026)

NCSC-listed Assured Service Provider for Cyber Incident Exercising (stated on ncsc.gov.uk, checked 2026-09-19) NCSC-approved Cyber Advisor providing guidance to UK SMEs (stated on ncsc.gov.uk, checked 2026-09-19) CREST-accredited for penetration testing since 2023 (stated on rightcue.com) ISO 27001 certified since 2020 (stated on rightcue.com) IASME Consortium-approved Cyber Essentials certification body since 2014 (stated on rightcue.com/about/; not independently verified against IASME's own certification-body register) DCC certification-body status since 2025 (stated on rightcue.com)

Seeking ISO 42001 certificationRegulated sectorsFirst DPO or AI policyAfter a ransomware or security incident

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.