# URM Consulting - **Type:** Advisory firm - **Website:** https://www.urmconsulting.com/ - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A UK information security and data protection consultancy offering an outsourced DPO alongside ISO 27001 certification support, penetration testing and its own risk-management software, Abriska. ## URM Consulting scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 3/5 Virtual DPO page states support for 'managing personal data breaches' and 'dealing with...the ICO' but names no staff or outcomes for specific cases (urmconsulting.com/data-protection/gdpr/virtual-dpo). ### Qualifications of the people who do the work: 3/5 About page names five consultants but attributes CISM/CISSP/CISA/lead-auditor qualifications to the team collectively rather than to each named person (urmconsulting.com/about). ### What it publishes about fees: 1/5 No prices, rate card or worked examples appear on the Virtual DPO page or About page checked; only a free consultation is offered (urmconsulting.com/data-protection/gdpr/virtual-dpo). ### Knowledge of your sector: 3/5 Only generic testimonials (an energy provider, a housing association) were found; no dedicated named sector-specialist staff or pages were located in the pages checked (urmconsulting.com/data-protection/gdpr/virtual-dpo). ### Independence from what it sells: 2/5 URM sells Abriska software used in 'every ISO 27001 certification project' while separately claiming the DPO service avoids conflicts of interest, with no disclosed policy reconciling the two (urmconsulting.com/products/abriska-27001). ### Who carries the risk if the advice is wrong: 1/5 No professional indemnity insurance or liability terms are disclosed on the About page or Virtual DPO service page checked (urmconsulting.com/about). ## Sources for URM Consulting Every line carries the page it was read on and the date it was checked. - Registered at Companies House as URM Consulting Services Ltd - Source: https://find-and-update.company-information.service.gov.uk/company/05488337 - Checked: 2026-07-17 - No firm-level ICO registration number found published - Source: https://www.urmconsulting.com/data-protection/gdpr/virtual-dpo - Checked: 2026-07-17 - Publishes a Virtual DPO service alongside a broad ISO/cyber security consultancy - Source: https://www.urmconsulting.com/data-protection/gdpr/virtual-dpo - Checked: 2026-07-17 - Does not publish pricing - Source: https://www.urmconsulting.com/data-protection/gdpr/virtual-dpo - Checked: 2026-07-17 - Publishes team size and named consultants with team-wide credential list - Source: https://www.urmconsulting.com/about - Checked: 2026-07-17 - Sells its own risk-management software alongside advisory services - Source: https://www.urmconsulting.com/products/abriska-27001 - Checked: 2026-07-17 - Recently joined a larger professional services group - Source: https://www.urmconsulting.com/about - Checked: 2026-07-17 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Published - Client results: Not published - How it uses AI: Not published ## Strengths - 20-year operating history (incorporated 2005 as Ultima Risk Management) with a stated 35+ strong consultancy team - Broad accreditation base: CREST-accredited, PCI DSS QSA company, BSI-certified for ISO 27001 and ISO 22301, Cyber Essentials Plus accredited - Virtual DPO service explicitly states there is no conflict of interest between the DPO role and other business activities - Joined the Cooper Parry professional services group in October 2025, adding wider audit/advisory backing ## Things to check Each one carries the factual basis it rests on. - Sells its own Abriska risk-management software as part of its consultancy engagements - Basis: URM states Abriska has been 'used in every ISO 27001 certification project URM's consultants have been involved in', a commercial product tied to its own advisory recommendations (urmconsulting.com/products/abriska-27001, checked 2026-07-17). - Does not publish pricing - Basis: The Virtual DPO service page offers a free consultation but states no fees or rate card (urmconsulting.com/data-protection/gdpr/virtual-dpo, checked 2026-07-17). - No professional indemnity insurance disclosure found on the public site - Basis: PI insurance was not mentioned on the About page or Virtual DPO service page as checked (urmconsulting.com/about, checked 2026-07-17). ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [After a cyber attack: what to report, and to whom](https://theassurancedesk.com/best/security-incident) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.