# The Assurance Desk > News and plain-English guides for the data protection, AI governance and cyber security sector: the rules, the standards, and the firms that do the work. The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. Updated: 2026-10-13 - [About The Assurance Desk, for AI assistants](https://theassurancedesk.com/ai-instructions.md): Facts about The Assurance Desk at theassurancedesk.com: what it covers, who publishes it, how it checks providers, and what it is not. Every news piece, guide, list and provider profile is also served as markdown at the same path with a `.md` suffix, with each fact’s source and the date it was checked. Scores are per criterion; there is no overall score. ## News - [News](https://theassurancedesk.com/news.md): What has changed in data protection, AI governance and cyber security, in plain English. - [Which websites did AI cite on AI governance?](https://theassurancedesk.com/news/ai-answers-ai-governance-sources-october-2026.md): 13 October 2026. Our October snapshot shows which websites appeared in answers to selected UK questions about AI governance. - [The ICO led our data protection citation snapshot](https://theassurancedesk.com/news/ai-answers-data-protection-sources-october-2026.md): 13 October 2026. The regulator appeared most often in our October answers to selected UK questions about data protection help. - [Which websites did AI cite on ISO certification?](https://theassurancedesk.com/news/ai-answers-iso-certification-sources-october-2026.md): 13 October 2026. Our October snapshot shows which websites appeared in answers to selected UK questions about ISO certification. - [Expert views: less data, safer AI](https://theassurancedesk.com/news/experts-week-5-11-october-2026.md): 13 October 2026. Daniel Solove and Lisa Forte raise questions worth asking before you collect personal data or put AI to work. - [UK data protection: what changed in September 2026?](https://theassurancedesk.com/news/uk-data-protection-september-2026.md): 13 October 2026. A look back at the regulator’s new structure, TikTok’s withdrawn appeals and the debate about smart glasses. - [AI answers on the EU AI Act: 1 official source in 111](https://theassurancedesk.com/news/ai-answers-eu-ai-act-official-sources.md): 2 October 2026. AI answers can help you find names, and for what the EU AI Act asks of you, the official sources come first. - [The ICO became the Information Commission on 30 September 2026](https://theassurancedesk.com/news/ico-becomes-the-information-commission.md): 29 September 2026. A board replaced a single commissioner at the top of the UK regulator, and its powers, its work and the ICO name carried on. ## Sections - [Data protection](https://theassurancedesk.com/data-protection.md): If your organisation holds details about customers, staff or anyone else, these are the rules it works within. - [AI governance](https://theassurancedesk.com/ai-governance.md): The rules that reach your business depend on where you work and how you use AI. - [Cyber security](https://theassurancedesk.com/cyber-security.md): Customers and contracts often ask for proof of good security, and the right proof depends on who is asking. ## Guides - [Guides](https://theassurancedesk.com/guides.md): Plain answers to common questions about data protection, AI governance and cyber security. - [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md): Your organisation stays responsible for complying with UK GDPR whoever you hire, so it helps to know exactly what an adviser will do. - [Data protection consultants and indemnity insurance: who pays if advice is wrong?](https://theassurancedesk.com/guides/data-protection-consultants-indemnity-insurance.md): Knowing who pays, and what insurance covers, helps you ask the right questions before you sign. - [How do you check that a data protection consultant is qualified?](https://theassurancedesk.com/guides/check-a-data-protection-consultant-is-qualified.md): A job title says little, so it helps to know what to ask for and what each certificate shows. - [Is your GDPR consultant recommending their own software?](https://theassurancedesk.com/guides/is-your-gdpr-consultant-recommending-their-own-software.md): Ask who owns the product, how the adviser is paid and what happens if you choose a different tool. - [Law firm or consultancy for GDPR advice?](https://theassurancedesk.com/guides/law-firm-or-consultancy-for-gdpr-advice.md): Choose the people and work you need, with clear terms for legal advice, practical help and ongoing support. - [UK GDPR’s seven principles, in plain English](https://theassurancedesk.com/guides/uk-gdpr-seven-principles.md): Turn the rules into everyday checks on the information your organisation uses. - [Data protection training: what should staff learn?](https://theassurancedesk.com/guides/data-protection-training-for-staff.md): A useful course helps people handle real situations and shows where they still need help. - [Keeping personal data secure: what Article 32 requires](https://theassurancedesk.com/guides/keeping-personal-data-secure-article-32.md): Connect the risks to people with the safeguards and checks your organisation uses. - [A subject access request arrives: what should you do?](https://theassurancedesk.com/guides/subject-access-request-what-to-do.md): Recognise the request, work out the deadline and organise a clear, secure response. - [UK GDPR versus EU GDPR: which rules apply?](https://theassurancedesk.com/guides/uk-gdpr-vs-eu-gdpr.md): A UK address does not settle which data protection law covers every part of your business. - [What must your UK privacy notice say?](https://theassurancedesk.com/guides/what-your-privacy-notice-must-say.md): Explain what happens to people’s information at the point they need to know. - [SOC 2: what is it, and who asks for it?](https://theassurancedesk.com/guides/soc-2-what-it-is-and-who-asks-for-it.md): A customer wants your SOC 2 report, so start by checking what they need it to show. - [Incident response plan: what to write down](https://theassurancedesk.com/guides/incident-response-plan-what-to-write-down.md): Give your team a plan they can find, read and use when something goes wrong. - [Ransomware: what to do in the first hour](https://theassurancedesk.com/guides/ransomware-what-to-do-in-the-first-hour.md): Get the right people working together while they limit damage, protect evidence and check reporting duties. - [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md): Ask this before you hire anyone, because the answer changes what you need to buy. - [Can your IT manager be your DPO?](https://theassurancedesk.com/guides/can-your-it-manager-be-your-dpo.md): The job title is not the test, but the decisions that come with it matter. - [How do you find an outsourced DPO in the UK?](https://theassurancedesk.com/guides/how-to-find-an-outsourced-dpo.md): Start with the person doing the job, the cover you need and the way they will work with your team. - [Is a data protection officer a senior role?](https://theassurancedesk.com/guides/is-a-data-protection-officer-a-senior-role.md): Look at the person’s authority, access and independence as well as their job title. - [Schools and academies: who can be your DPO?](https://theassurancedesk.com/guides/schools-and-academies-who-can-be-your-dpo.md): Compare the appointment options for schools in England and the checks that help you choose someone who can do the job. - [How much does an outsourced DPO cost, and what does it cover?](https://theassurancedesk.com/guides/how-dpo-and-data-protection-services-are-priced.md): The lowest monthly fee we found published for an outsourced DPO is £350 plus VAT, for two hours a month. - [Day rate or retainer: how do consultants charge?](https://theassurancedesk.com/guides/data-protection-consultant-day-rate-or-retainer.md): Compare the work, access and limits in the proposal before comparing the headline fee. - [How much does data protection software cost per year?](https://theassurancedesk.com/guides/how-much-does-data-protection-software-cost-per-year.md): Check what the licence covers, how the bill grows and which costs sit outside the subscription. - [ICO has written to you: what to do in the first week](https://theassurancedesk.com/guides/ico-has-written-to-you.md): Most letters from the regulator have a clear next step, and a calm first week makes the rest easier. - [Does your UK business need an AI policy, and what goes in it?](https://theassurancedesk.com/guides/the-ai-governance-gap.md): If staff use AI tools at work, a policy is how your business decides what goes into them. - [Can staff paste client data into ChatGPT or Copilot?](https://theassurancedesk.com/guides/staff-client-data-chatgpt-copilot.md): Check the task, the account and the information before staff share it with an AI tool. - [Who can write your AI policy?](https://theassurancedesk.com/guides/who-can-write-your-ai-policy.md): Choose a writer who can turn the way your team works into rules people can use. - [A DPIA for an AI tool: when and how](https://theassurancedesk.com/guides/dpia-for-an-ai-tool.md): Work out the privacy risk before staff or customers rely on the tool. - [Do you need AI governance software, or is an adviser enough?](https://theassurancedesk.com/guides/ai-governance-software-or-adviser.md): Knowing what each one does helps you buy the help you need, and only that. - [What to ask an AI supplier before you buy](https://theassurancedesk.com/guides/what-to-ask-ai-supplier-before-you-buy.md): Take clear questions and evidence requests into your next AI buying meeting. - [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md): Knowing the steps, and who may do each one, helps you plan the time and choose the right firms. - [How do you check an ISO certificate is genuine?](https://theassurancedesk.com/guides/check-iso-certificate-is-genuine.md): Check who issued the certificate, what it covers and whether the claimed accreditation is valid. - [How much does ISO 27001 certification cost in the UK?](https://theassurancedesk.com/guides/iso-27001-certification-cost-uk.md): Separate the audit from preparation costs before comparing an ISO 27001 quote. - [How to find UKAS accredited ISO 27001 certification bodies](https://theassurancedesk.com/guides/ukas-accredited-iso-27001-certification-bodies.md): Use the UKAS record to check the body and the standard before choosing who will audit you. - [How long does ISO 27001 take?](https://theassurancedesk.com/guides/how-long-does-iso-27001-take.md): Separate the work of getting ready from the audit before you promise a customer a date. - [ISO 27001 or SOC 2: which does your customer want?](https://theassurancedesk.com/guides/iso-27001-or-soc-2.md): Check the customer’s request before choosing the certificate or report to work towards. - [The ISO 27000 family: which standard does what?](https://theassurancedesk.com/guides/iso-27000-family-explained.md): The numbers describe different jobs, so choose the standard that answers your actual security or privacy question. - [ISO 42001 in the UK: who certifies you, and what does it cost?](https://theassurancedesk.com/guides/iso-42001-certification-and-who-can-certify-you.md): A certificate is worth what the body behind it is accredited to do, so check the body before you choose. - [ISO 42001 or ISO 27001: which do you need, and which first?](https://theassurancedesk.com/guides/iso-42001-or-iso-27001.md): Picking the right order saves you doing the same work twice. - [What does the EU AI Act ask of a UK business?](https://theassurancedesk.com/guides/eu-ai-act-uk-business.md): Some of its rules already apply, and your role decides which ones reach your firm. - [EU AI Act timeline: the key dates after the July 2026 changes](https://theassurancedesk.com/guides/eu-ai-act-timeline.md): A change in July 2026 moved the high-risk dates, so a timeline written before then may be out of date. - [Who can help a UK firm with the EU AI Act?](https://theassurancedesk.com/guides/who-can-help-uk-firm-eu-ai-act.md): Choose help for the work your firm needs, from checking the rules to testing the tool. - [How does the UK regulate AI?](https://theassurancedesk.com/guides/uk-ai-regulation.md): AI is covered by laws your firm may already follow, and the UK rules on automated decisions changed in 2026. - [Customer security questionnaires: what they ask and how to answer](https://theassurancedesk.com/guides/customer-security-questionnaires-what-they-ask-and-how-to-answer.md): A clear response connects each answer to the service, the evidence and any work still to do. - [How do you answer a security questionnaire without a certificate?](https://theassurancedesk.com/guides/security-questionnaire-without-certification.md): Show what is in place, explain any gaps and find out what the buyer needs before making promises. - [What is supplier assurance, and what do buyers check?](https://theassurancedesk.com/guides/supplier-assurance-what-buyers-check.md): A useful supplier review checks the service you will use, the evidence behind it and what happens when things change. - [How much is Cyber Essentials, and what does it ask?](https://theassurancedesk.com/guides/cyber-essentials-cost-and-requirements.md): Know what the fee buys before you book an assessment or pay for help. - [Cyber Essentials Plus: what does the technical test add?](https://theassurancedesk.com/guides/cyber-essentials-plus-technical-test.md): Plus checks whether the security controls in your answers work on your systems. - [Is UK GDPR changing in 2026?](https://theassurancedesk.com/guides/uk-gdpr-changes-data-use-and-access-act.md): The law has changed, but your old data protection duties have not disappeared. - [Automated decisions: what UK GDPR now requires](https://theassurancedesk.com/guides/automated-decisions-uk-gdpr.md): Check what a system decides, who reviews it and how someone can challenge the result. - [Do you have to pay the ICO fee?](https://theassurancedesk.com/guides/ico-data-protection-fee.md): Check the exemption first, then the right fee band, before paying a letter or invoice. - [How much can the ICO fine you under UK GDPR?](https://theassurancedesk.com/guides/uk-gdpr-fines.md): The legal maximum is a ceiling, not a prediction of what a business will pay. - [A data breach has happened: who do you call?](https://theassurancedesk.com/guides/data-breach-who-to-call.md): Get the right people involved, contain the breach and keep the reporting decisions clear. - [A data breach compensation claim: what should businesses know?](https://theassurancedesk.com/guides/data-breach-compensation-claim.md): Separate the complaint, the request for payment and any court action before deciding what help you need. - [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report.md): Check the risk to people, then use the right reporting route and deadline. - [Is there a qualification or certification for AI governance?](https://theassurancedesk.com/guides/ai-governance-qualifications-and-certification.md): A qualification for a person and a certificate for an organisation answer different questions. - [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md): Follow the decisions about the data, rather than the label on the contract. - [Article 28: what must a processor contract say?](https://theassurancedesk.com/guides/article-28-processor-contract.md): Use this checklist to see what the supplier will do with personal data, including when the work ends. - [What is AI governance, in plain words?](https://theassurancedesk.com/guides/what-is-ai-governance.md): Give people a clear way to choose, use and check AI at work. - [AI agents: what to check before they act](https://theassurancedesk.com/guides/ai-agents-permissions-and-approvals.md): Before an agent takes action, make its limits and approval points clear. - [Does GDPR apply to small businesses and sole traders?](https://theassurancedesk.com/guides/gdpr-small-business-sole-trader.md): Start with the personal data you hold, then check your duties, fee and need for a DPO separately. ## Lists - [Which data protection, AI governance and cyber security providers publish a price?](https://theassurancedesk.com/lists/providers-that-publish-a-price.md): A published price lets you see a figure before you speak to a firm, and this list gives every one we found. ## By your situation - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment.md): The answer tells you whether the role is a legal duty or your own choice. - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking.md): For an accredited ISO certificate, preparing you and certifying you are two separate jobs, and the rules keep them apart. - [After a data breach: what UK law asks of you](https://theassurancedesk.com/best/post-breach.md): The clock starts when you find out, so it helps to know the steps before you need them. - [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed.md): It can, even with no EU office, and what applies depends on your role and the date. - [How do you change your data protection provider?](https://theassurancedesk.com/best/switching-provider.md): Most of the work is paperwork: getting your records back and keeping breach cover in place. - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated.md): Your sector regulator and the data protection regulator can both ask about the same data. - [After a cyber attack: what to report, and to whom](https://theassurancedesk.com/best/security-incident.md): An attack can be a security incident and a data breach at once, and each has its own reporting route. ## Resources - [Customer security questionnaire: template and example answers](https://theassurancedesk.com/resources/customer-security-questionnaire.md): Use a blank questionnaire and worked examples to prepare your next customer response. ## Reference - [The Assurance Desk](https://theassurancedesk.com/index.md): The Assurance Desk is a news provider for the whole data protection, AI governance and cyber security sector. It explains the rules, the standards and the firms in plain terms. - [How the industry works](https://theassurancedesk.com/the-market.md): who does what, how certification and credentials work, and the checks anyone can make. - [What the industry's words mean, in plain English](https://theassurancedesk.com/glossary.md): When a contract, a standard or a guide uses a term you do not know, this page says what it means. - [Cookies and visit statistics](https://theassurancedesk.com/cookies.md): We count which pages people read, so that we can write more of what helps. ## Providers - [Who does data protection, AI governance and cyber security work?](https://theassurancedesk.com/advisers.md): Advisory firms, certification bodies and software products are scored on the same six questions. Each group is listed A to Z, not by score. - [Compare providers side by side](https://theassurancedesk.com/compare.md): Tick the kind of provider, your situation and what each one publishes, then sort by any column. No sign-up, no sales call. - [360 Advanced, Inc.](https://theassurancedesk.com/advisers/360-advanced.md): Certification body - [A-LIGN Compliance and Security, Inc. (dba A-LIGN)](https://theassurancedesk.com/advisers/a-lign.md): Certification body - [AARC-360](https://theassurancedesk.com/advisers/aarc-360.md): Advisory firm - [Accorian (Esha Corporation dba Accorian; Accorian Assurance)](https://theassurancedesk.com/advisers/accorian.md): Advisory firm - [Actica Consulting Limited](https://theassurancedesk.com/advisers/actica-consulting-limited.md): Advisory firm - [Advai](https://theassurancedesk.com/advisers/advai.md): Software product - [Aleada Consulting](https://theassurancedesk.com/advisers/aleada-consulting.md): Advisory firm - [Amethyst Risk Management Limited](https://theassurancedesk.com/advisers/amethyst-risk-management.md): Advisory firm - [Ametros Group](https://theassurancedesk.com/advisers/ametros-group.md): Advisory firm - [AMSA InfoSec Ltd](https://theassurancedesk.com/advisers/amsa-infosec.md): Advisory firm - [Amtivo](https://theassurancedesk.com/advisers/amtivo.md): Certification body - [Anekanta Consulting](https://theassurancedesk.com/advisers/anekanta-consulting.md): Advisory firm - [Apache Consulting (Apache Consults / Vadasz Ventures)](https://theassurancedesk.com/advisers/apache-consulting.md): Advisory firm - [Approachable Certification Ltd](https://theassurancedesk.com/advisers/approachable-certification.md): Certification body - [Aprio, LLP](https://theassurancedesk.com/advisers/aprio-llp.md): Certification body - [Arcanum Cyber Security (Arcanum Information Security Limited)](https://theassurancedesk.com/advisers/arcanum-cyber-security.md): Advisory firm - [Arthur AI](https://theassurancedesk.com/advisers/arthur-ai.md): Software product - [Athlex](https://theassurancedesk.com/advisers/athlex.md): Advisory firm - [AvISO Consultancy](https://theassurancedesk.com/advisers/aviso-consultancy.md): Advisory firm - [BABL AI Inc.](https://theassurancedesk.com/advisers/babl-ai.md): Advisory firm - [BARR Certifications, LLC](https://theassurancedesk.com/advisers/barr-certifications.md): Certification body - [BD Emerson LLC](https://theassurancedesk.com/advisers/bd-emerson.md): Advisory firm - [BigID](https://theassurancedesk.com/advisers/bigid.md): Software product - [Bird & Bird LLP](https://theassurancedesk.com/advisers/bird-and-bird-llp-uk.md): Advisory firm - [Boulay Certifications, LLC](https://theassurancedesk.com/advisers/boulay-certifications.md): Certification body - [Bratby Law](https://theassurancedesk.com/advisers/bratby-law.md): Advisory firm - [Bridewell](https://theassurancedesk.com/advisers/bridewell.md): Advisory firm - [Bright Defense, LLC](https://theassurancedesk.com/advisers/bright-defense.md): Advisory firm - [BSI (The British Standards Institution)](https://theassurancedesk.com/advisers/bsi.md): Certification body - [Bureau Veritas](https://theassurancedesk.com/advisers/bureau-veritas.md): Certification body - [C3IA Solutions Limited](https://theassurancedesk.com/advisers/c3ia-solutions.md): Advisory firm - [CBIZ Pivot Point Security](https://theassurancedesk.com/advisers/cbiz-pivot-point-security.md): Advisory firm - [Centre for Assessment](https://theassurancedesk.com/advisers/centre-for-assessment.md): Certification body - [Coalfire Certification, Inc.](https://theassurancedesk.com/advisers/coalfire-certification.md): Certification body - [Compass IT Compliance, LLC](https://theassurancedesk.com/advisers/compass-it-compliance.md): Advisory firm - [ControlCase Assessments LLC](https://theassurancedesk.com/advisers/controlcase-assessments.md): Certification body - [CookieYes](https://theassurancedesk.com/advisers/cookieyes.md): Software product - [Core Business Solutions](https://theassurancedesk.com/advisers/core-business-solutions.md): Advisory firm - [Credo AI](https://theassurancedesk.com/advisers/credo-ai.md): Software product - [Cyber Defense Group](https://theassurancedesk.com/advisers/cyber-defense-group.md): Advisory firm - [CyPro](https://theassurancedesk.com/advisers/cypro.md): Advisory firm - [Data GRC Ltd](https://theassurancedesk.com/advisers/data-grc.md): Advisory firm - [Data Privacy & Security Advisors, LLC (The DPSA)](https://theassurancedesk.com/advisers/data-privacy-security-advisors-dpsa.md): Advisory firm - [Data Protection People](https://theassurancedesk.com/advisers/data-protection-people.md): Advisory firm - [DataGuard](https://theassurancedesk.com/advisers/dataguard.md): Advisory firm - [DCI Consulting Group, Inc.](https://theassurancedesk.com/advisers/dci-consulting-group.md): Advisory firm - [Debbie Reynolds Consulting LLC](https://theassurancedesk.com/advisers/debbie-reynolds-consulting-llc.md): Advisory firm - [Deloitte LLP](https://theassurancedesk.com/advisers/deloitte-llp-uk.md): Advisory firm - [DNV](https://theassurancedesk.com/advisers/dnv.md): Certification body - [DPO-Service](https://theassurancedesk.com/advisers/dpo-service.md): Advisory firm - [Drata](https://theassurancedesk.com/advisers/drata.md): Software product - [EAGLE Registrations Inc.](https://theassurancedesk.com/advisers/eagle-registrations.md): Certification body - [Elevate Consult](https://theassurancedesk.com/advisers/elevate-consult.md): Advisory firm - [Enterprivacy Consulting Group](https://theassurancedesk.com/advisers/enterprivacy-consulting-group.md): Advisory firm - [Enzai](https://theassurancedesk.com/advisers/enzai.md): Software product - [Eticas.ai (Algorithmic Auditing Inc., US entity of Eticas Research and Consulting S.L.)](https://theassurancedesk.com/advisers/eticas-ai.md): Advisory firm - [Evalian](https://theassurancedesk.com/advisers/evalian.md): Advisory firm - [EY (UK), Ernst & Young LLP](https://theassurancedesk.com/advisers/ey-llp-uk.md): Advisory firm - [Fast Data Science](https://theassurancedesk.com/advisers/fast-data-science.md): Advisory firm - [Fiddler AI](https://theassurancedesk.com/advisers/fiddler-ai.md): Software product - [Fieldfisher LLP](https://theassurancedesk.com/advisers/fieldfisher-llp-uk.md): Advisory firm - [Forefront Certification Limited (FFC)](https://theassurancedesk.com/advisers/forefront-certification-limited.md): Certification body - [Forvis Mazars](https://theassurancedesk.com/advisers/forvis-mazars.md): Advisory firm - [Fractional CISO, LLC](https://theassurancedesk.com/advisers/fractional-ciso.md): Advisory firm - [GDPR Advisor (PSA Professional Solutions)](https://theassurancedesk.com/advisers/gdpr-advisor.md): Advisory firm - [Gowling WLG (UK) LLP](https://theassurancedesk.com/advisers/gowling-wlg-uk-llp.md): Advisory firm - [GRCI Law](https://theassurancedesk.com/advisers/grci-law.md): Advisory firm - [Handley Gill](https://theassurancedesk.com/advisers/handley-gill.md): Advisory firm - [HewardMills](https://theassurancedesk.com/advisers/hewardmills.md): Advisory firm - [Hicomply](https://theassurancedesk.com/advisers/hicomply.md): Software product - [Holistic AI](https://theassurancedesk.com/advisers/holistic-ai.md): Software product - [Hope & May](https://theassurancedesk.com/advisers/hope-and-may.md): Advisory firm - [Hyperproof](https://theassurancedesk.com/advisers/hyperproof.md): Software product - [IBM watsonx.governance](https://theassurancedesk.com/advisers/ibm-watsonx-governance.md): Software product - [Intertek](https://theassurancedesk.com/advisers/intertek.md): Certification body - [IS Partners, LLC](https://theassurancedesk.com/advisers/is-partners.md): Certification body - [ISMS.online](https://theassurancedesk.com/advisers/isms-online.md): Software product - [ISOQAR (formerly Alcumus ISOQAR)](https://theassurancedesk.com/advisers/isoqar.md): Certification body - [IT Governance (now GRC Solutions)](https://theassurancedesk.com/advisers/it-governance.md): Advisory firm - [JBW Group International, LLC](https://theassurancedesk.com/advisers/jbw-group-international-llc.md): Advisory firm - [JVR Consultancy](https://theassurancedesk.com/advisers/jvr-consultancy.md): Advisory firm - [Kafico](https://theassurancedesk.com/advisers/kafico.md): Advisory firm - [Kemp IT Law LLP](https://theassurancedesk.com/advisers/kemp-it-law-llp.md): Advisory firm - [Kompleye Attestation, LLC](https://theassurancedesk.com/advisers/kompleye-attestation.md): Certification body - [KPMG LLP (UK)](https://theassurancedesk.com/advisers/kpmg-llp-uk.md): Advisory firm - [Kuma (Kimble and Associates, LLC)](https://theassurancedesk.com/advisers/kuma.md): Advisory firm - [Linford & Company LLP](https://theassurancedesk.com/advisers/linford-and-company-llp.md): Certification body - [LogicGate](https://theassurancedesk.com/advisers/logicgate.md): Software product - [Logiq Consulting Ltd](https://theassurancedesk.com/advisers/logiq-consulting.md): Advisory firm - [LRQA](https://theassurancedesk.com/advisers/lrqa.md): Certification body - [Meditology Services, LLC](https://theassurancedesk.com/advisers/meditology-services.md): Advisory firm - [Metomic](https://theassurancedesk.com/advisers/metomic.md): Software product - [Microsoft Purview](https://theassurancedesk.com/advisers/microsoft-purview.md): Software product - [Mishcon de Reya LLP](https://theassurancedesk.com/advisers/mishcon-de-reya-llp.md): Advisory firm - [Monitaur](https://theassurancedesk.com/advisers/monitaur.md): Software product - [NQA](https://theassurancedesk.com/advisers/nqa.md): Certification body - [OneTrust AI Governance](https://theassurancedesk.com/advisers/onetrust-ai-governance.md): Software product - [ORCAA (O'Neil Risk Consulting and Algorithmic Auditing, Inc.)](https://theassurancedesk.com/advisers/orcaa.md): Advisory firm - [Osano](https://theassurancedesk.com/advisers/osano.md): Software product - [Osborne Clarke LLP](https://theassurancedesk.com/advisers/osborne-clarke-llp.md): Advisory firm - [Palindrome Technologies, Inc.](https://theassurancedesk.com/advisers/palindrome-technologies.md): Certification body - [Peers Quality Assurance Limited (PQAL)](https://theassurancedesk.com/advisers/peers-quality-assurance-pqal.md): Certification body - [Pembroke Privacy](https://theassurancedesk.com/advisers/pembroke-privacy.md): Advisory firm - [Perry Johnson Registrars, Inc.](https://theassurancedesk.com/advisers/perry-johnson-registrars.md): Certification body - [PricewaterhouseCoopers LLP (PwC UK)](https://theassurancedesk.com/advisers/pricewaterhousecoopers-llp-uk.md): Advisory firm - [Privacy Ref, Inc.](https://theassurancedesk.com/advisers/privacy-ref.md): Advisory firm - [RA Cert Ltd](https://theassurancedesk.com/advisers/ra-cert-ltd.md): Certification body - [Red Clover Advisors, LLC](https://theassurancedesk.com/advisers/red-clover-advisors.md): Advisory firm - [Resolution Economics LLC](https://theassurancedesk.com/advisers/resolution-economics.md): Advisory firm - [Responsible AI Institute (Responsible Artificial Intelligence Institute)](https://theassurancedesk.com/advisers/responsible-ai-institute.md): Certification body - [Responsible Artificial Intelligence LLC (RAI LLC)](https://theassurancedesk.com/advisers/rai-llc.md): Advisory firm - [Rhymetec LLC](https://theassurancedesk.com/advisers/rhymetec.md): Advisory firm - [RightCue Consulting Services Ltd](https://theassurancedesk.com/advisers/rightcue.md): Advisory firm - [Rocket-Hire LLC](https://theassurancedesk.com/advisers/rocket-hire.md): Advisory firm - [RPC (Reynolds Porter Chamberlain LLP)](https://theassurancedesk.com/advisers/rpc-reynolds-porter-chamberlain.md): Advisory firm - [Saidot](https://theassurancedesk.com/advisers/saidot.md): Software product - [Samurai Digital Security Limited](https://theassurancedesk.com/advisers/samurai-digital-security-limited.md): Advisory firm - [Schellman Compliance, LLC](https://theassurancedesk.com/advisers/schellman-compliance.md): Certification body - [Secureframe](https://theassurancedesk.com/advisers/secureframe.md): Software product - [Securys](https://theassurancedesk.com/advisers/securys.md): Advisory firm - [Sensiba LLP](https://theassurancedesk.com/advisers/sensiba-llp.md): Certification body - [SGS North America Inc.](https://theassurancedesk.com/advisers/sgs-north-america.md): Certification body - [SGS United Kingdom Limited](https://theassurancedesk.com/advisers/sgs.md): Certification body - [SideChannel, Inc.](https://theassurancedesk.com/advisers/sidechannel.md): Advisory firm - [SME Comply](https://theassurancedesk.com/advisers/sme-comply.md): Advisory firm - [Socotec Certification United Kingdom Limited](https://theassurancedesk.com/advisers/socotec-certification-uk.md): Certification body - [Strategic Management Services, LLC](https://theassurancedesk.com/advisers/strategic-management-services.md): Advisory firm - [Strike Graph](https://theassurancedesk.com/advisers/strike-graph.md): Software product - [SureCloud](https://theassurancedesk.com/advisers/surecloud.md): Software product - [The DPO Centre](https://theassurancedesk.com/advisers/dpo-centre.md): Advisory firm - [Thoropass](https://theassurancedesk.com/advisers/thoropass.md): Software product - [Trilateral Research](https://theassurancedesk.com/advisers/trilateral-research.md): Software product - [Trustible](https://theassurancedesk.com/advisers/trustible.md): Software product - [TÜV UK Limited (TÜV NORD Group)](https://theassurancedesk.com/advisers/tuv-uk.md): Certification body - [URM Consulting](https://theassurancedesk.com/advisers/urm-consulting.md): Advisory firm - [Vanta](https://theassurancedesk.com/advisers/vanta.md): Software product - [vCISO Services, LLC](https://theassurancedesk.com/advisers/vciso-services.md): Advisory firm - [VeraSafe, LLC](https://theassurancedesk.com/advisers/verasafe.md): Advisory firm - [Winston Taylor UK LLP (formerly Taylor Wessing)](https://theassurancedesk.com/advisers/winston-taylor-uk.md): Advisory firm - [Zaviant (WJS Cyber Consulting, LLC d/b/a Zaviant)](https://theassurancedesk.com/advisers/zaviant.md): Advisory firm ## Disclosure The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in.