We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Kuma (Kimble and Associates, LLC) review

Advisory firm

A US privacy consultancy offering a part-time, outsourced chief privacy officer and advice on AI privacy, with named clients in state and local government.

Relevant if you run a US public body and want a named, qualified part-time privacy officer

Price Not published
Indemnity cover Not published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

Kuma scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 2/5
Qualifications of the people who do the work 4/5
What it publishes about fees 2/5
Knowledge of your sector 4/5
Independence from what it sells 4/5
Who carries the risk if the advice is wrong 2/5

What Kuma offers, and what it publishes

You get named, qualified people and public-sector case studies. Partner Jenn Johnson lists CIPP/US, CIPP/G and CIPM, and is an IAPP Fellow of Information Privacy. Kuma names Washington State's Office of Privacy and Data Protection as a client, with a case study on automated decision systems and AI privacy. It also names South Carolina DMV and Santa Clara County.

Kuma does not publish a price. Every engagement starts with a direct enquiry, and no rate card appears on its service pages. It publishes nothing on professional indemnity insurance or a service guarantee. It publishes no case of defending a client through a regulator's investigation or a breach lawsuit.

For incidents, it lists tabletop exercises and business continuity drills. Kuma describes itself as a vendor-neutral adviser, and we found no software it resells. The company behind it is Kimble and Associates, LLC, in Virginia. Its chief executive, Ray Kimble, also runs the nonprofit Kuma Foundation. Its Trustpilot page has no reviews.

Strengths

  • Named, credentialed senior staff with public bios (CIPP/US, CIPP/G, CIPM, FIP; PhD in public policy) rather than anonymous consultants.
  • 10+ year track record with named state-government privacy-programme case studies (Washington State, South Carolina DMV, Santa Clara County).
  • Direct, named engagement in AI-governance/automated-decision-system privacy work for a state regulator, plus named-author AI-governance thought leadership.
  • Sector breadth across healthcare, K-12, government/CJIS and HIPAA-adjacent environments relevant to the US regime scope in this brief.

Things to check

  • No pricing or fee-structure information is published on any Kuma service page; every engagement requires a direct sales enquiry.
  • No published case study shows Kuma defending a client through an actual regulatory investigation, enforcement action or breach litigation.
  • No public disclosure of professional indemnity insurance or a service guarantee was found anywhere on the firm's website.

Common questions

Does Kuma publish its prices?

No. Its homepage, privacy pages and outsourced privacy officer page show no prices or fee structure. Every engagement is quoted on enquiry.

Does Kuma work on AI privacy?

Yes. It names Washington State's Office of Privacy and Data Protection as a client, with a case study on automated decision systems and AI privacy. It does not list a separate AI-governance service.

Has Kuma helped a client through a regulator's investigation?

It does not say so. Its government page lists incident tabletop exercises and business continuity drills, not a case of defending a client in an investigation, enforcement action or breach lawsuit.

Who is the company behind Kuma?

Kimble and Associates, LLC, an active Virginia company. The Virginia record shown on OpenCorporates lists Kuma, LLC as its trading name from 19 June 2023.

Evidence for each Kuma score

Show our working

Notes behind each thing to check

  • No pricing or fee-structure information is published on any Kuma service page; every engagement requires a direct sales enquiry. (Checked kuma.pro homepage, /privacy/ and /services/privacy/cpo/, none display pricing or a rate card.)
  • No published case study shows Kuma defending a client through an actual regulatory investigation, enforcement action or breach litigation. (kuma.pro/government/ lists only IR tabletop exercises and BC/DR drills, not an enforcement-defense case study.)
  • No public disclosure of professional indemnity insurance or a service guarantee was found anywhere on the firm's website. (Checked kuma.pro/about/ and all service pages fetched, no PI insurance or warranty statement present.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 2/5 Offers IR tabletop exercises and BC/DR drills but publishes no case study of defending a client through a regulatory investigation or enforcement action.
Qualifications of the people who do the work 4/5 EVP Jenn Johnson holds CIPP/US, CIPP/G, CIPM and IAPP FIP; CEO Ray Kimble runs the nonprofit Kuma Foundation and has 20 years in policy.
What it publishes about fees 2/5 No pricing, fee structure or engagement-cost information is published on any service page; all pricing is quote-only via enquiry.
Knowledge of your sector 4/5 Named case studies span state-government privacy programmes, healthcare, and CJIS/HIPAA control assessments across a decade of delivery.
Independence from what it sells 4/5 Positions itself as a vendor-neutral third-party advisor; no evidence found of reselling or bundling privacy/security software products.
Who carries the risk if the advice is wrong 2/5 No public disclosure of professional indemnity insurance, liability caps or a delivery guarantee found on the firm's website.

Sources for Kuma

  • Kimble and Associates, LLC is registered as an Active Virginia LLC (SCC ID S5229093), with the alternative/trading name Kuma, LLC recorded from 19 June 2023. (Status: Active; SCC ID S5229093) (opencorporates.com, checked 20 September 2026)
  • Kuma's Partner & EVP of Privacy & Security, Jenn Johnson, holds CIPP/US, CIPP/G and CIPM certifications and is an IAPP Fellow of Information Privacy (FIP). (CIPP/US, CIPP/G, CIPM, FIP) (kuma.pro, checked 20 September 2026)
  • Kuma lists the Washington State Office of Privacy and Data Protection as a named client, with a case study on automated decision systems (ADS) and AI privacy work. (Named case study: 'Washington's Office of Privacy and Data Protection Leading the Way in Prioritizing ADS/AI Privacy') (kuma.pro, checked 20 September 2026)
  • Kuma offers a Fractional/Virtual Chief Privacy Officer (vCPO) service line covering privacy program governance, risk management and programme maturation. (vCPO service page live) (kuma.pro, checked 20 September 2026)
  • Kuma publishes AI-governance commentary under a named author, including a post on the gap between AI governance frameworks and implementation. (Author: Meghan Costello, 'When Policy Races Ahead') (kuma.pro, checked 20 September 2026)
  • Trustpilot: Kuma has a Trustpilot profile listed under kuma.pro (United States). The profile is unclaimed and has received zero reviews to date, so there is no review content to summarise. (Trustpilot, checked 20 September 2026)

Partner & EVP of Privacy & Security Jenn Johnson holds CIPP/US, CIPP/G and CIPM certifications and is an IAPP Fellow of Information Privacy (FIP) (kuma.pro/about/leadership/, 2026-09-20)

First DPO or AI policyRegulated sectors

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.