The Assurance Desk
The list
32 providers. Alphabetical inside each type.
| Provider | What it publishes | Source | Checked |
|---|---|---|---|
| Actica Consulting Limited | A day rate of £300 to £1,430 on its G-Cloud listing | G-Cloud | 19 September 2026 |
| Ametros Group | Price ranges, for example £900 to £3,500 a month for an outsourced role | ametrosgroup. | 17 July 2026 |
| AMSA InfoSec Ltd | A day rate of £850 to £1,450 for cloud security architecture, on G-Cloud | G-Cloud | 19 September 2026 |
| Arcanum Cyber Security (Arcanum Information Security Limited) | Day rates of £800, £950 and £1,200, excluding VAT | G-Cloud | 19 September 2026 |
| Athlex | Outsourced DPO packages at £350, £650 and £950 a month, plus VAT | athlex. | 16 July 2026 |
| BABL AI Inc. | $2,500 for its AI audit training programme; no figure for audits | babl. | 29 September 2026 |
| Bird & Bird LLP | Hourly rates of £275 to £815, for employment tribunal claims only | twobirds. | 19 September 2026 |
| Bright Defense, LLC | Compliance work from $1,000 a month | brightdefense. | 20 September 2026 |
| C3IA Solutions Limited | A day-rate card of £497 to £1,720 on its G-Cloud listing | G-Cloud | 19 September 2026 |
| CBIZ Pivot Point Security | A virtual CISO retainer of about $4,000 to $30,000 or more a month | pivotpointsecurity. | 20 September 2026 |
| Cyber Defense Group | $15,000 to $25,000 a month for a 12-month managed security programme, on a page for its sales partners, last updated in September 2025 | cdg. | 5 October 2026 |
| Data GRC Ltd | A 30-minute advice call for £175 plus VAT; no figure for DPO work | datagrc. | 17 July 2026 |
| IT Governance (now GRC Solutions) | Documentation toolkits from £195 to £495; no figure for its DPO service | uk. | 16 July 2026 |
| Kafico | ISO 27001 work from a £199 mini audit to about £10,000 for full support | kafico. | 16 July 2026 |
| Logiq Consulting Ltd | A day rate of £690 to £1,500 for audit and review, on G-Cloud | G-Cloud | 19 September 2026 |
| Mishcon de Reya LLP | An outsourced DPO service from £500 a month plus VAT | mishcon. | 19 September 2026 |
| Pembroke Privacy | CIPP/E training at €1,349; no figure for its DPO service | pembrokeprivacy. | 16 July 2026 |
| Rocket-Hire LLC | AI bias audits from $25,000 | rocket-hire. | 20 September 2026 |
| SideChannel, Inc. | A virtual CISO retainer of $3,000 to $12,000 a month | sidechannel. | 20 September 2026 |
| Winston Taylor UK LLP (formerly Taylor Wessing) | Hourly rates of £290 to £1,030 plus VAT, for regulated services only; none for data protection | winstontaylor. | 29 September 2026 |
| Provider | What it publishes | Source | Checked |
|---|---|---|---|
| Centre for Assessment | Initial ISO 9001 audits from £1,125 plus VAT | centreforassessment. | 13 October 2026 |
| ISOQAR (formerly Alcumus ISOQAR) | Training courses, for example £920 for an ISO 42001 auditor course; certification on request | isoqar. | 29 September 2026 |
| Linford & Company LLP | A SOC 2 audit range of $20,000 to $100,000 | linfordco. | 20 September 2026 |
| Responsible AI Institute (Responsible Artificial Intelligence Institute) | Membership from $10,000 a year to $100,000 or more | responsible. | 20 September 2026 |
| Provider | What it publishes | Source | Checked |
|---|---|---|---|
| Arthur AI | A free tier and a $60 a month tier; enterprise on request | arthur. | 20 September 2026 |
| CookieYes | A free plan and plans at $10, $25 and $55 a month per domain | cookieyes. | 19 September 2026 |
| Fiddler AI | A free tier and $0.002 per trace; enterprise on request | fiddler. | 20 September 2026 |
| Hicomply | Annual plans at £5,300 and £10,600; enterprise on request | hicomply. | 19 September 2026 |
| IBM watsonx.governance | Risk & Compliance Basic from US$3,500 a month, before taxes; prices vary by country | ibm. | 13 October 2026 |
| Microsoft Purview | $12 per user a month, paid yearly, on top of a Microsoft 365 E3 licence | microsoft. | 17 July 2026 |
| Osano | A free tier and a $199 a month tier; other tiers on request | osano. | 20 September 2026 |
| Strike Graph | A free tier, then plans from $10,000, $21,500 and $35,000 a year | strikegraph. | 20 September 2026 |
What counts
A provider is on this list if it puts a figure in public: a price, a day rate, a price range, a "from" price or a worked example, on its own website or its UK government G-Cloud listing. "Contact us for a quote" does not count. Nor does a fee that is only agreed in the engagement letter.
Does it differ by kind of provider?
Yes. 8 of the 27 software products publish a price. For advisory firms it is 20 of 80, and for certification bodies 4 of 33. A software price is usually a plan with a monthly or yearly fee.
Several of the advisory firms on the list price something other than their main work, such as training, a toolkit or legal work outside data protection. The row says so where that is the case.
Questions to ask about the fee
- Ask for the fee in writing.
- Ask what the fee covers, including help with a data breach.
- Ask how the fee changes if the work grows.
- Ask for the notice period, and whether leaving costs anything.
Common questions
Does publishing a price make a provider cheaper?
No. It means you can see a figure before you speak to the firm. A published price can still be high, and a firm that quotes for each job can still be good value.
Can I filter all the providers on this site this way?
Yes. The compare table has a filter for providers that publish a price.
What if a price has changed?
Each row shows the date the price was checked. Confirm the figure with the provider before you rely on it.
Sources
This is an independent editorial guide, not legal advice.