# Cyber security Customers and contracts often ask for proof of good security, and the right proof depends on who is asking. The Assurance Desk. Last checked 2 October 2026. ## Explore cyber security ### Prepare and respond - [Incident response plan: what to write down](https://theassurancedesk.com/guides/incident-response-plan-what-to-write-down.md): Give your team a plan they can find, read and use when something goes wrong. - [Ransomware: what to do in the first hour](https://theassurancedesk.com/guides/ransomware-what-to-do-in-the-first-hour.md): Get the right people working together while they limit damage, protect evidence and check reporting duties. ### Cyber Essentials - [How much is Cyber Essentials, and what does it ask?](https://theassurancedesk.com/guides/cyber-essentials-cost-and-requirements.md): Know what the fee buys before you book an assessment or pay for help. - [Cyber Essentials Plus: what does the technical test add?](https://theassurancedesk.com/guides/cyber-essentials-plus-technical-test.md): Plus checks whether the security controls in your answers work on your systems. ### ISO 27001 - [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md): Knowing the steps, and who may do each one, helps you plan the time and choose the right firms. - [How do you check an ISO certificate is genuine?](https://theassurancedesk.com/guides/check-iso-certificate-is-genuine.md): Check who issued the certificate, what it covers and whether the claimed accreditation is valid. - [How much does ISO 27001 certification cost in the UK?](https://theassurancedesk.com/guides/iso-27001-certification-cost-uk.md): Separate the audit from preparation costs before comparing an ISO 27001 quote. - [How to find UKAS accredited ISO 27001 certification bodies](https://theassurancedesk.com/guides/ukas-accredited-iso-27001-certification-bodies.md): Use the UKAS record to check the body and the standard before choosing who will audit you. - [How long does ISO 27001 take?](https://theassurancedesk.com/guides/how-long-does-iso-27001-take.md): Separate the work of getting ready from the audit before you promise a customer a date. - [ISO 27001 or SOC 2: which does your customer want?](https://theassurancedesk.com/guides/iso-27001-or-soc-2.md): Check the customer’s request before choosing the certificate or report to work towards. - [The ISO 27000 family: which standard does what?](https://theassurancedesk.com/guides/iso-27000-family-explained.md): The numbers describe different jobs, so choose the standard that answers your actual security or privacy question. ### SOC 2 - [SOC 2: what is it, and who asks for it?](https://theassurancedesk.com/guides/soc-2-what-it-is-and-who-asks-for-it.md): A customer wants your SOC 2 report, so start by checking what they need it to show. ### Customer checks - [Customer security questionnaires: what they ask and how to answer](https://theassurancedesk.com/guides/customer-security-questionnaires-what-they-ask-and-how-to-answer.md): A clear response connects each answer to the service, the evidence and any work still to do. - [How do you answer a security questionnaire without a certificate?](https://theassurancedesk.com/guides/security-questionnaire-without-certification.md): Show what is in place, explain any gaps and find out what the buyer needs before making promises. - [What is supplier assurance, and what do buyers check?](https://theassurancedesk.com/guides/supplier-assurance-what-buyers-check.md): A useful supplier review checks the service you will use, the evidence behind it and what happens when things change. ## Use an example questionnaire Prepare your response with a blank questionnaire, fictional example answers and an evidence checklist. [View the template and examples](https://theassurancedesk.com/resources/customer-security-questionnaire). [Download the Excel workbook](https://theassurancedesk.com/downloads/customer-security-questionnaire-v1.xlsx). ## The basics, explained Cyber Essentials, ISO/IEC 27001 and SOC 2 each show something different about your security. Cyber Essentials is a UK government-backed certificate for five basic security controls. ISO/IEC 27001 is the best-known international standard for managing information security. SOC 2 is a report by a US accountant on a supplier's controls, not a certificate ([the NCSC](https://www.ncsc.gov.uk/cyberessentials/overview), [ISO](https://www.iso.org/standard/27001) and the [AICPA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy), checked 29 September 2026). ### What is Cyber Essentials, and who runs it? *Cyber Essentials is the UK's baseline security certificate, and some public contracts require it.* Cyber Essentials is a UK certification scheme that checks five basic technical controls. They are firewalls, secure configuration, security update management, user access control and malware protection. The NCSC, the UK's National Cyber Security Centre, developed the scheme. IASME runs certification for the NCSC, as its official delivery partner ([the NCSC](https://www.ncsc.gov.uk/cyberessentials/overview), checked 29 September 2026). There are two levels. For Cyber Essentials, you complete a self-assessment, a board member or equivalent signs off the answers, and an assessor marks them. Cyber Essentials Plus checks the same five controls and adds independent technical testing of your systems. Prices start at £320 plus VAT and depend on your size ([the NCSC](https://www.ncsc.gov.uk/cyberessentials/overview), checked 29 September 2026). You can apply through IASME yourself, or use a certification body that IASME licenses. That body can help you understand the questions. To see whether an organisation holds a current certificate, use IASME's [certificate search](https://iasme.co.uk/cyber-essentials/ncsc-certificate-search/) ([the NCSC](https://www.ncsc.gov.uk/cyberessentials/overview), checked 29 September 2026). UK central government departments, their agencies and NHS bodies ask for it on some contracts. An example is a contract where a supplier handles personal data about citizens or government staff. Instead of the certificate, a supplier can show the same controls another way. A supplier that holds the certificate renews it every year while the contract runs ([GOV.UK, PPN 014](https://www.gov.uk/government/publications/ppn-014-cyber-essentials-scheme/ppn-014-cyber-essentials-scheme-html), checked 29 September 2026). **The two levels of Cyber Essentials** - **Cyber Essentials** - The same five technical controls - A self-assessment, checked by an assessor - A board member or equivalent signs off the answers - Priced by size, from £320 plus VAT - **Cyber Essentials Plus** - The same five technical controls - Independent technical testing of your systems - Checks that the controls work in practice - Priced by the size and complexity of your network Both levels check the same five controls, and the Plus level adds technical testing. Source: National Cyber Security Centre, Cyber Essentials, https://www.ncsc.gov.uk/cyberessentials/overview (checked 29 September 2026) > "Cyber Essentials is the minimum standard of cyber security recommended by the Government for organisations of all sizes." > National Cyber Security Centre, https://www.ncsc.gov.uk/cyberessentials/overview (checked 29 September 2026) ### How many UK businesses hold Cyber Essentials? *A UK government survey shows how common the certificate is, and how that is changing.* In the UK government's latest survey, 5 per cent of businesses said they held Cyber Essentials. That was up from 3 per cent the year before. Among large businesses, 35 per cent held it and 12 per cent held Cyber Essentials Plus. The survey was published on 30 April 2026 ([Cyber security breaches survey 2025/2026, GOV.UK](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026), checked 29 September 2026). More businesses have the controls than hold the certificate. In the same survey, 24 per cent had all five controls in place, and 17 per cent were aware of the scheme. The report says some businesses, mainly medium and large ones, may already meet the standard without the certificate ([GOV.UK](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026), checked 29 September 2026). **UK businesses and Cyber Essentials, 2025/2026** - Have all five controls: 24% - Hold the certificate: 5% - Large businesses: have all five controls: 70% - Large businesses: hold the certificate: 35% More UK businesses have the five controls in place than hold the certificate. Source: GOV.UK, Cyber security breaches survey 2025/2026, https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026 (checked 29 September 2026) ### What is ISO 27001, and how does certification work? *A certificate is one way to show customers how you manage information security.* ISO/IEC 27001 is an international standard for an information security management system, the way an organisation manages risks to its information across people, policies and technology. A certification body audits your system and issues the certificate, but certification is a choice, and some organisations follow the standard without it ([ISO](https://www.iso.org/standard/27001) and [ISO](https://www.iso.org/certification.html), checked 29 September 2026). The current edition is ISO/IEC 27001:2022, with one amendment from 2024 ([ISO](https://www.iso.org/standard/27001), checked 29 September 2026). ISO writes the standard but does not certify anyone. An accredited certification body must not also offer consultancy on management systems, so help to prepare comes from a different firm. Accreditation is not compulsory, but it confirms independently that a body is competent ([ISO](https://www.iso.org/certification.html) and [European Accreditation](https://european-accreditation.org/sp_accordion_faqs/question-41-1-impartiality-cl-5-2-5-of-iso-iec-17021-12015/), checked 29 September 2026). In the UK, UKAS is the national body that accredits certification bodies for ISO/IEC 27001. UKAS describes its role as checking the checkers. You can confirm a UKAS accredited certificate on its free [CertCheck](https://www.ukas.com/certcheck/) database ([UKAS on information security](https://www.ukas.com/accreditation/sectors/digital/info-sec/) and [UKAS on certification](https://www.ukas.com/accreditation/about/accreditation-vs-certification/), checked 29 September 2026). Holding ISO/IEC 27001 does not mean you meet Cyber Essentials. UK government guidance says an ISO 27001 scope does not usually include all five controls, and rarely tests them. So where a UK government contract asks for Cyber Essentials, ISO 27001 alone is usually not enough. Most businesses with it also need Cyber Essentials, or must show the same controls another way ([GOV.UK, PPN 014](https://www.gov.uk/government/publications/ppn-014-cyber-essentials-scheme/ppn-014-cyber-essentials-scheme-html), checked 29 September 2026). **How ISO/IEC 27001 certification works** 1. Stage 1 audit: The auditor checks that you are ready for the main audit. 2. Stage 2 audit: The main audit, of how well your system works in practice. 3. Certificate: Issued when the audit shows you meet the standard. 4. Surveillance audits: An audit in each of the next two years. 5. Recertification: An audit in the third year, before the certificate expires, leads to a new three-year cycle. An accredited certification body audits you in two stages, then once a year, and renews the certificate every three years. Source: European Accreditation, FAQ 32.6 on the two stages, https://european-accreditation.org/sp_accordion_faqs/question-32-6-2-stage/ (checked 29 September 2026); IAS, ISO/IEC 17021-1:2015 section 9, https://www.iasonline.org/wp-content/uploads/2021/02/17021-1-2015-Section-9.pdf (checked 29 September 2026); European Accreditation, FAQ 37.12 on surveillance, https://european-accreditation.org/sp_accordion_faqs/question-37-12-iso-17021-12015-clause-9-1-3/ (checked 29 September 2026); ANAB, ISO/IEC 17021-1, https://anab.ansi.org/standard/iso-iec-17021-1/ (checked 29 September 2026); ISO, Certification, https://www.iso.org/certification.html (checked 29 September 2026) ### What is SOC 2, and is it a certificate? *Customers ask suppliers for SOC 2 reports, and a report works differently from a certificate.* SOC 2 is not a certificate. It is a report by a US certified public accountant (CPA), who examines a supplier's controls under standards set by the AICPA, the US professional body for accountants. Suppliers such as cloud providers and payroll processors use it to show customers how they protect their data ([Journal of Accountancy](https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/), checked 29 September 2026). The report is not public, so you ask the supplier for a copy ([Journal of Accountancy](https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/), checked 29 September 2026). A SOC 2 report covers controls relevant to security, availability, processing integrity, confidentiality or privacy ([AICPA & CIMA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy), checked 29 September 2026). A type 1 report describes the controls on one date. In a type 2 report, the auditor also tests whether the controls worked in practice, and gives the results ([AICPA & CIMA](https://www.aicpa-cima.com/professional-insights/video/maintaining-high-standards-for-soc-engagements) and its [summary of an illustrative SOC 2 type 2 report](https://www.aicpa-cima.com/resources/download/illustrative-soc-2-r-report-with-description-and-assertion), checked 29 September 2026). **Who is involved in a SOC 2 report** - The AICPA: the US professional body for accountants (sets the standards for → A CPA firm) - A CPA firm: certified public accountants in the US (examines and reports on → The supplier) - The supplier: such as a cloud provider or a payroll processor (shares the report with → Its customers) - Its customers: who read it to judge the supplier's controls The AICPA sets the standards, a CPA firm examines the supplier, and the supplier shares the report with its customers. Source: AICPA & CIMA, SOC suite of services, https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services (checked 29 September 2026); Journal of Accountancy, https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/ (checked 29 September 2026) ### Who do you tell after a cyber attack in the UK? *Each body takes its own report, so telling one does not tell the others.* After a UK cyber attack, you usually tell the police, and possibly the ICO if personal data was involved. The UK government's signposting service on GOV.UK shows you where to report. The NCSC runs it, and responds itself to the most critical incidents in the UK. What you tell this service is not shared with the ICO ([GOV.UK](https://www.gov.uk/report-cyber), checked 29 September 2026). A cyber attack is also a crime. In England, Wales and Northern Ireland, you report it to the police through Report Fraud, and in Scotland by calling 101 ([Report Fraud](https://www.reportfraud.police.uk/), checked 29 September 2026). If personal data was involved, you may also need to report a breach to the ICO, the UK data protection regulator. UK GDPR says to report without undue delay and, where feasible, within 72 hours of becoming aware of it. The duty does not apply to a breach that is unlikely to put people's rights and freedoms at risk ([UK GDPR Article 33](https://www.legislation.gov.uk/eur/2016/679/article/33), checked 29 September 2026). If ransomware locks personal data, the ICO says that is a personal data breach, because you have lost timely access to the data ([the ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ransomware-and-data-protection-compliance/), checked 29 September 2026). See [the first days after an attack](/best/security-incident). **Who takes which report** - **The NCSC**: Responds to the most critical incidents in the UK (Its signposting service at gov.uk/report-cyber shows where to report) - **The police**: Take reports of cyber crime (Report Fraud in England, Wales and Northern Ireland; 101 in Scotland) - **The ICO**: Takes reports of personal data breaches under UK GDPR (Without undue delay and, where feasible, within 72 hours) - **The people affected**: Must be told directly if the risk to them is high (Without undue delay, under UK GDPR) After an attack in the UK, each of these may need to hear from you separately. Source: GOV.UK, Where to report a cyber incident, https://www.gov.uk/report-cyber (checked 29 September 2026); Report Fraud, https://www.reportfraud.police.uk/ (checked 29 September 2026); UK GDPR Article 33, legislation.gov.uk, https://www.legislation.gov.uk/eur/2016/679/article/33 (checked 29 September 2026); ICO guide to personal data breaches, https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 29 September 2026) ## Key dates for cyber security - 2011, US: The AICPA's SOC reports began. - 2014, UK: The UK government started asking suppliers on certain public contracts for Cyber Essentials. - October 2022, Global: ISO/IEC 27001:2022, the current edition, was published. - 17 February 2025, UK: UK government guidance, PPN 014, set out when its contracts ask for Cyber Essentials. - 30 September 2026, UK: The [Information Commission](/news/ico-becomes-the-information-commission) took over from the Information Commissioner, and kept the name ICO. The dates behind today's certificates and reports, in the UK and the US. Source: Journal of Accountancy, https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/ (checked 29 September 2026); GOV.UK, PPN 014: Cyber Essentials scheme, https://www.gov.uk/government/publications/ppn-014-cyber-essentials-scheme/ppn-014-cyber-essentials-scheme-html (checked 29 September 2026); ISO, ISO/IEC 27001:2022, https://www.iso.org/standard/27001 (checked 29 September 2026); UK, S.I. 2026/1015, legislation.gov.uk, https://www.legislation.gov.uk/uksi/2026/1015/made (checked 29 September 2026); ICO, governance changes confirmed for 30 September 2026, https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-governance-changes-confirmed-for-30-september-2026/ (checked 29 September 2026); The ICO: ICO welcomes transition to new Information Commission, 30 September 2026, https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/ (checked 2 October 2026) ## Cyber Essentials, ISO/IEC 27001 and SOC 2, side by side | Name | What it is | Who issues it | Where it is asked for | | --- | --- | --- | --- | | Cyber Essentials | A UK certificate for five basic technical controls, at two levels | A certification body licensed by IASME, the NCSC's delivery partner | Some UK government and NHS contracts | | ISO/IEC 27001 | An international standard for managing information security, with a certificate if you choose | A certification body. In the UK, UKAS accredits these bodies, but accreditation is not compulsory | Customers in the UK and in other countries | | SOC 2 | A US accountant's report on a supplier's controls, not a certificate | A firm of US certified public accountants, under AICPA standards | Customers of suppliers such as cloud providers and payroll processors | Source: National Cyber Security Centre, Cyber Essentials, https://www.ncsc.gov.uk/cyberessentials/overview (checked 29 September 2026); GOV.UK, PPN 014: Cyber Essentials scheme, https://www.gov.uk/government/publications/ppn-014-cyber-essentials-scheme/ppn-014-cyber-essentials-scheme-html (checked 29 September 2026); ISO, ISO/IEC 27001:2022, https://www.iso.org/standard/27001 (checked 29 September 2026); ISO, Certification, https://www.iso.org/certification.html (checked 29 September 2026); UKAS, information security accreditation, https://www.ukas.com/accreditation/sectors/digital/info-sec/ (checked 29 September 2026); Journal of Accountancy, https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/ (checked 29 September 2026) ## Your situation and provider lists - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking.md): For an accredited ISO certificate, preparing you and certifying you are two separate jobs, and the rules keep them apart. - [After a cyber attack: what to report, and to whom](https://theassurancedesk.com/best/security-incident.md): An attack can be a security incident and a data breach at once, and each has its own reporting route. - [After a data breach: what UK law asks of you](https://theassurancedesk.com/best/post-breach.md): The clock starts when you find out, so it helps to know the steps before you need them. [Browse the provider directory](https://theassurancedesk.com/advisers.md) ## Words you will meet - [Cyber Essentials](https://theassurancedesk.com/glossary#cyber-essentials) - [Cyber Essentials Plus](https://theassurancedesk.com/glossary#cyber-essentials-plus) - [ISO/IEC 27001](https://theassurancedesk.com/glossary#iso-iec-27001) - [UKAS](https://theassurancedesk.com/glossary#ukas) - [Certification body](https://theassurancedesk.com/glossary#certification-body) - [SOC 2](https://theassurancedesk.com/glossary#soc-2) - [NCSC](https://theassurancedesk.com/glossary#ncsc) - [Ransomware](https://theassurancedesk.com/glossary#ransomware) - [Personal data breach](https://theassurancedesk.com/glossary#personal-data-breach) - [72-hour rule](https://theassurancedesk.com/glossary#72-hour-rule) - [Supplier assurance questionnaire](https://theassurancedesk.com/glossary#supplier-assurance-questionnaire) ## Sources - National Cyber Security Centre, Cyber Essentials: https://www.ncsc.gov.uk/cyberessentials/overview (checked 29 September 2026) - GOV.UK, PPN 014: Cyber Essentials scheme: https://www.gov.uk/government/publications/ppn-014-cyber-essentials-scheme/ppn-014-cyber-essentials-scheme-html (checked 29 September 2026) - GOV.UK, Cyber security breaches survey 2025/2026: https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026 (checked 29 September 2026) - ISO, ISO/IEC 27001:2022: https://www.iso.org/standard/27001 (checked 29 September 2026) - ISO, Certification: https://www.iso.org/certification.html (checked 29 September 2026) - European Accreditation, FAQ 41.1 on impartiality: https://european-accreditation.org/sp_accordion_faqs/question-41-1-impartiality-cl-5-2-5-of-iso-iec-17021-12015/ (checked 29 September 2026) - UKAS, information security accreditation: https://www.ukas.com/accreditation/sectors/digital/info-sec/ (checked 29 September 2026) - UKAS, accreditation vs certification: https://www.ukas.com/accreditation/about/accreditation-vs-certification/ (checked 29 September 2026) - UKAS, CertCheck: https://www.ukas.com/certcheck/ (checked 29 September 2026) - European Accreditation, FAQ 32.6 on the two stages: https://european-accreditation.org/sp_accordion_faqs/question-32-6-2-stage/ (checked 29 September 2026) - IAS, ISO/IEC 17021-1:2015 section 9: https://www.iasonline.org/wp-content/uploads/2021/02/17021-1-2015-Section-9.pdf (checked 29 September 2026) - European Accreditation, FAQ 37.12 on surveillance: https://european-accreditation.org/sp_accordion_faqs/question-37-12-iso-17021-12015-clause-9-1-3/ (checked 29 September 2026) - ANAB, ISO/IEC 17021-1: https://anab.ansi.org/standard/iso-iec-17021-1/ (checked 29 September 2026) - Journal of Accountancy, AICPA & CIMA: https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/ (checked 29 September 2026) - AICPA & CIMA, SOC 2 guide: https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy (checked 29 September 2026) - AICPA & CIMA, SOC suite of services: https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services (checked 29 September 2026) - AICPA & CIMA, maintaining high standards for SOC engagements: https://www.aicpa-cima.com/professional-insights/video/maintaining-high-standards-for-soc-engagements (checked 29 September 2026) - AICPA & CIMA, summary of an illustrative SOC 2 type 2 report: https://www.aicpa-cima.com/resources/download/illustrative-soc-2-r-report-with-description-and-assertion (checked 29 September 2026) - GOV.UK, Where to report a cyber incident: https://www.gov.uk/report-cyber (checked 29 September 2026) - Report Fraud: https://www.reportfraud.police.uk/ (checked 29 September 2026) - UK GDPR Article 33, legislation.gov.uk: https://www.legislation.gov.uk/eur/2016/679/article/33 (checked 29 September 2026) - ICO guide to personal data breaches: https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 29 September 2026) - ICO, ransomware and data protection compliance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ransomware-and-data-protection-compliance/ (checked 29 September 2026) - UK, S.I. 2026/1015, legislation.gov.uk: https://www.legislation.gov.uk/uksi/2026/1015/made (checked 29 September 2026) - ICO, governance changes confirmed for 30 September 2026: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-governance-changes-confirmed-for-30-september-2026/ (checked 29 September 2026) - The ICO: ICO welcomes transition to new Information Commission, 30 September 2026: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/ (checked 2 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.