# Kuma (Kimble and Associates, LLC) - **Type:** Advisory firm - **Website:** https://kuma.pro - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A US privacy consultancy offering a part-time, outsourced chief privacy officer and advice on AI privacy, with named clients in state and local government. ## Kuma scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 2/5 Offers IR tabletop exercises and BC/DR drills but publishes no case study of defending a client through a regulatory investigation or enforcement action. ### Qualifications of the people who do the work: 4/5 EVP Jenn Johnson holds CIPP/US, CIPP/G, CIPM and IAPP FIP; CEO Ray Kimble runs the nonprofit Kuma Foundation and has 20 years in policy. ### What it publishes about fees: 2/5 No pricing, fee structure or engagement-cost information is published on any service page; all pricing is quote-only via enquiry. ### Knowledge of your sector: 4/5 Named case studies span state-government privacy programmes, healthcare, and CJIS/HIPAA control assessments across a decade of delivery. ### Independence from what it sells: 4/5 Positions itself as a vendor-neutral third-party advisor; no evidence found of reselling or bundling privacy/security software products. ### Who carries the risk if the advice is wrong: 2/5 No public disclosure of professional indemnity insurance, liability caps or a delivery guarantee found on the firm's website. ## Sources for Kuma Every line carries the page it was read on and the date it was checked. - Kimble and Associates, LLC is registered as an Active Virginia LLC (SCC ID S5229093), with the alternative/trading name Kuma, LLC recorded from 19 June 2023. - Source: https://opencorporates.com/companies/us_va/S5229093 - Checked: 2026-09-20 - Kuma's Partner & EVP of Privacy & Security, Jenn Johnson, holds CIPP/US, CIPP/G and CIPM certifications and is an IAPP Fellow of Information Privacy (FIP). - Source: https://kuma.pro/about/leadership/ - Checked: 2026-09-20 - Kuma lists the Washington State Office of Privacy and Data Protection as a named client, with a case study on automated decision systems (ADS) and AI privacy work. - Source: https://kuma.pro/clients/ - Checked: 2026-09-20 - Kuma offers a Fractional/Virtual Chief Privacy Officer (vCPO) service line covering privacy program governance, risk management and programme maturation. - Source: https://kuma.pro/services/privacy/cpo/ - Checked: 2026-09-20 - Kuma publishes AI-governance commentary under a named author, including a post on the gap between AI governance frameworks and implementation. - Source: https://kuma.pro/when-policy-races-ahead-closing-the-gap-between-ai-governance-frameworks-and-the-ground-they-stand-on/ - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Not published - Client results: Published - How it uses AI: Not published ## Strengths - Named, credentialed senior staff with public bios (CIPP/US, CIPP/G, CIPM, FIP; PhD in public policy) rather than anonymous consultants. - 10+ year track record with named state-government privacy-programme case studies (Washington State, South Carolina DMV, Santa Clara County). - Direct, named engagement in AI-governance/automated-decision-system privacy work for a state regulator, plus named-author AI-governance thought leadership. - Sector breadth across healthcare, K-12, government/CJIS and HIPAA-adjacent environments relevant to the US regime scope in this brief. ## Things to check Each one carries the factual basis it rests on. - No pricing or fee-structure information is published on any Kuma service page; every engagement requires a direct sales enquiry. - Basis: Checked kuma.pro homepage, /privacy/ and /services/privacy/cpo/, none display pricing or a rate card. - No published case study shows Kuma defending a client through an actual regulatory investigation, enforcement action or breach litigation. - Basis: kuma.pro/government/ lists only IR tabletop exercises and BC/DR drills, not an enforcement-defense case study. - No public disclosure of professional indemnity insurance or a service guarantee was found anywhere on the firm's website. - Basis: Checked kuma.pro/about/ and all service pages fetched, no PI insurance or warranty statement present. ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.