Cyber Security for Solicitors: What the SRA Expects and How to Meet It

Cyber security for solicitors is not a separate regulatory topic. It sits inside obligations every SRA-regulated firm already carries: keep client affairs confidential, run effective systems and controls, protect client money and report serious problems. A phishing email that diverts a completion payment engages all of them at once.

This guide explains what the SRA expects, where the ICO fits in, which attacks hit legal practices most often and the controls we put in place for firms of different sizes. It supports our legal sector page, which covers how we work with solicitors more broadly.

What the SRA expects of your firm

The SRA has not issued a prescriptive technical standard. Instead, cyber security is judged against the rules that already apply. The SRA Code of Conduct for Firms is the main reference, and three themes matter most.

• Systems and controls. Paragraph 2.1 requires effective governance structures, arrangements, systems and controls so that the firm, its managers and its staff comply with SRA obligations. A firm with no multi-factor authentication on email, or no tested backups, will struggle to show that its controls are effective.
• Confidentiality. Paragraph 6.3 requires you to keep the affairs of current and former clients confidential, unless disclosure is required or permitted by law or the client consents. A breach caused by weak security is a confidentiality failure, not simply a technical fault.
• Records and co-operation. Paragraph 2.2 requires records that demonstrate compliance, and paragraphs 3.2 to 3.4 require prompt, full and accurate responses to the SRA, including remedial action it requests.

Compliance officers (COLP and COFA) are accountable for making these controls work in practice. In our experience, the strongest firms treat cyber risk as a standing agenda item for partners rather than something delegated entirely to an IT contact.

Reporting duties: the SRA, the ICO and clients

A single incident can trigger several separate reporting duties. Mixing them up is a common mistake in the first hours.

The ICO guidance on personal data breaches says the 72 hours runs from when you become aware of the breach, and that you can report in phases if the investigation is incomplete. It also expects you to record every personal data breach, including those you decide not to report, with your reasoning.

Client notification also matters professionally. Whether to tell a client about a breach affecting their matter should be a documented decision taken by a partner, with advice from your compliance officers.

SRA and Law Society guidance worth reading

Beyond the rules themselves, three sources give practical direction.

• The SRA publishes cyber security material and scam alerts for the profession, and its warnings about payment fraud and impersonation are worth circulating to fee earners and accounts staff.
• The Law Society cyber security guidance gives solicitors practical guidance on recognising and responding to hacks, scams and attacks, and signposts help after a breach.
• The NCSC guidance for small and medium-sized organisations sets out how to protect, prepare for, respond to and recover from incidents, and points towards Cyber Essentials certification.

Treat these as evidence of what a reasonable firm is expected to know. If an incident occurs, you will want to show that your controls reflected published guidance at the time.

The attacks that most often reach legal practices

Solicitors hold sensitive personal data and move large sums on short deadlines, which makes them a worthwhile target. Three attack types dominate.

Phishing and credential theft

Fake Microsoft 365 sign-in pages and urgent document-share requests are routinely aimed at fee earners and secretaries. Stolen credentials then give an attacker access to client email. Our guide to phishing types, examples and prevention explains what staff should look for.

Payment-diversion and business email compromise

An attacker, often watching a mailbox, sends altered bank details just before a completion or settlement. Conveyancing is particularly exposed because the sums are large and the timetable is fixed. Report fraud to Action Fraud and your bank immediately, and tell the SRA where the incident engages your duties.

Ransomware

Ransomware encrypts case files and often involves data theft as well. For a practice with court deadlines and limitation dates, the operational harm of losing access can exceed the ransom demand. Supplier compromise is a related route, which we cover in supply chain risks from recent high-profile breaches.

A practical control baseline for cyber security for solicitors

The controls below are the ones we implement first, because each addresses an attack path described above.

Much of this depends on how Microsoft 365 is configured, so our Microsoft 365 support work begins with identity and email settings. Firms still running older Windows devices should read our Windows 10 end-of-life guide, as unsupported systems undermine every other control.

Payment verification needs a process as well as technology. A callback to a known number before any change of bank details, agreed by partners and followed by accounts staff, stops a large share of payment-diversion attempts.

Training works best when it reflects the work people actually do. A conveyancing team needs examples of fake change-of-account emails, while a private client team needs to spot impersonation of executors or trustees. Keep sessions short, repeat them through the year and record attendance, because those records help demonstrate the controls described in paragraph 2.2 of the Code.

Who is responsible inside a legal practice

Cyber risk is shared, and the split of duties should be written down rather than assumed.

• Partners and managers own the risk, approve the budget and decide on client and regulator notifications.
• COLP and COFA make sure incidents are assessed against reporting duties and that records exist to show what was decided and why.
• Practice managers usually coordinate suppliers, insurance renewals and training schedules.
• Fee earners and support staff are the first line of detection. They need a simple route to report a suspicious email without fear of blame.
• Accounts teams handle client money, so they need the strictest payment-verification rules and the clearest authority to pause a transaction.

We often see firms where partners assume the IT provider covers all of this. A provider supplies the technical controls, but the regulatory accountability stays with the firm. Our managed IT support arrangements make that division explicit in the service documentation.

Suppliers, cloud platforms and shared systems

Legal practices rely on case management software, document platforms, banking portals and outsourced services. Each one holds client information or can reach it, so supplier risk is part of your own risk.

• Ask suppliers how they protect data, whether they hold Cyber Essentials or an equivalent certification and how quickly they would tell you about an incident.
• Keep a register of systems that hold client data, with the owner of each.
• Review who has access to shared document areas. Our comparison of Microsoft Teams and SharePoint explains how permissions differ.
• Where systems are hosted in the cloud, understand the shared-responsibility split. Our managed cloud services and Azure cloud services pages describe how we approach this.

For wider reading on keeping client information protected, see our sibling guide on client confidentiality and data security for legal practices, and on recovery planning, disaster recovery and business continuity for legal practices.

Cyber Essentials as a baseline for cyber security for solicitors

Cyber Essentials is a UK government-backed scheme run by the NCSC. It focuses on five technical control areas: firewalls, secure configuration, user access control, malware protection and security update management. Cyber Essentials Plus adds independent technical testing.

For a practice, certification does three useful things. It gives partners a defined scope to work to, it provides evidence for clients and insurers who ask about your security and it forces a review of devices and accounts you may have lost track of. It does not replace a wider risk assessment, but it is a sensible first milestone.

Our articles cover the Cyber Essentials certification process, the requirements checklist and typical costs in the UK. We also deliver Cyber Essentials certification support directly.

Cyber insurance considerations

Solicitors must hold professional indemnity insurance under the SRA's requirements, but that policy is a separate matter from cyber cover, and the extent to which a given policy responds to a cyber event depends on its wording. Ask your broker directly rather than assume.

• Which losses are covered: incident response costs, data restoration, business interruption, regulatory defence and third-party claims.
• Whether fraudulent payment instructions are included, and any sub-limits.
• What security controls the insurer requires, such as MFA and tested backups, as proposal forms often ask.
• When and how you must notify, and whether you must use the insurer's approved responders.

Answer proposal forms accurately. An inaccurate answer about controls can put a claim at risk, so involve whoever manages your technology when completing them.

Incident response basics

A written plan, rehearsed once a year, saves hours when it matters. It should be short enough that a partner can follow it under pressure.

Round-the-clock monitoring shortens step one considerably. Our 24/7 helpdesk and cyber security audit services help firms prepare for this. Where records and evidence are needed afterwards, keep a log of every action and time.

Where does your practice sit? A maturity table

Use this table for an honest conversation at partner level. Most small and mid-sized firms we meet sit between the first two stages.

An independent review can place you accurately, and our managed IT support model builds these stages into a monthly service for practices that prefer not to manage them in-house.

Next steps for cyber security for solicitors

Cyber security for solicitors comes down to showing that controls are effective, confidentiality is protected and incidents are reported on time. The baseline is achievable: enforce MFA, patch, test backups, filter email, train staff and work towards Cyber Essentials.

If you want a clear view of where your practice stands, see how we support solicitors or speak to our team about a review.

Frequently asked questions