Remote Working for Solicitors: Security Risks and Safe Set-Up

Remote working for solicitors is no longer an exception handled by a short-term policy. Fee earners draft at the kitchen table, partners review files on trains and trainees join client calls from spare rooms. Each of those moments sits under the same duty of confidentiality as work done in the office.

This guide sets out what the SRA has said about home working, where the real risks lie in practice, and how to build a set-up that a practice manager can defend to a partner, an insurer or the regulator. It supports our legal sector page, which covers the wider technology picture for legal practices.

What the SRA and Law Society expect from remote and hybrid working

The SRA has no separate rulebook for remote working. The obligations are the ones that already apply in the office, and they travel with the client file wherever it is opened.

In its cyber security Q&A, first published on 31 March 2020 and updated on 9 April 2020, the SRA said firms should introduce and communicate "sensible and pragmatic security arrangements" for remote systems. Its examples included using a reputable VPN where possible, encrypting laptops, enabling remote wipe for lost devices and using two-factor authentication. It also noted that personal devices are less secure, so security controls need to apply to them as well. You can read the SRA cyber security Q&A in full.

The underlying duties come from the SRA Standards and Regulations. The Code of Conduct for Solicitors requires you to keep the affairs of current and former clients confidential (paragraph 6.3) and to remain accountable for work carried out through others (paragraph 3.5). The Code of Conduct for Firms places responsibility for compliance, systems and supervision on the firm itself.

Two practical points follow. First, the SRA said it would take a proportionate approach and expected firms to document their reasoning where compliance was difficult. A written remote working policy is your evidence. Second, incidents affecting client money or client information must be reported to the SRA and, where relevant, to Action Fraud or the ICO.

The Law Society publishes its own guidance and practice material for members on cyber security and working practices. Check the current version before updating your policy. For the regulator-focused picture, see our companion guide on cyber security and the SRA.

Remote working for solicitors: the main security risks

In 2023 the NCSC, part of GCHQ, circulated a Cyber Threat Report on the UK legal sector. Legal Cheek reported that it identified the shift to remote working as a challenge for firms trying to protect client confidentiality. The risks it points towards are familiar to anyone running a practice.

• Unmanaged devices: a personal laptop with no encryption, patching or screen lock that holds a downloaded matter file.
• Account takeover: a phished Microsoft 365 password used from an unfamiliar location, followed by mailbox rules that hide payment-redirection emails.
• Overheard or overlooked information: calls and screens visible to family, flatmates or fellow passengers.
• Uncontrolled copies: files saved to local folders, personal cloud storage or messaging apps outside the case management system.
• Lost or stolen kit: bags left in cars, laptops left on trains, phones with email left open.

Conveyancing teams face extra exposure, as completion-day pressure and client money make impersonation fraud attractive. Our guide to phishing types and prevention explains how those emails are built.

Protecting confidentiality at home, in public and on paper

The SRA Q&A asks staff to use their best efforts to stop family members overhearing sensitive work, to use screen protectors and to lock the screen whenever they step away.

At home

• Use a room with a door where possible, and take calls with headphones.
• Lock the screen every time you leave the desk. A short automatic lock timeout on managed devices removes reliance on memory.
• Keep work on the work device. Family members should not share a profile or login.

In public

• Avoid reviewing client files on trains, in cafes or in airports. If it cannot be avoided, use a privacy filter and sit with your back to a wall.
• Do not use public Wi-Fi without a VPN, and prefer a mobile hotspot for sensitive work.

Confidentiality also depends on where information is stored, not only who can see a screen. Our article on client confidentiality and data security in legal practices covers storage, access control and retention in more depth.

Printing and paper files at home

Paper is where good digital controls fall apart. A printed completion statement in a spare room or a bag of bundles in a car boot is outside every technical safeguard.

• Set a default of no printing at home. Where it is unavoidable, require approval and record what was taken.
• Provide a lockable bag or cabinet for any paper that leaves the office.
• Use a cross-cut shredder at home, or return paper to the office for secure disposal.

Device management with Intune and a BYOD policy

The firm cannot enforce a policy on a device it cannot see. Managed devices are the foundation of a safe remote working set-up, and for firms on Microsoft 365 the usual tool is Microsoft Intune.

Intune lets IT enrol laptops and phones, apply configuration and report on whether each device meets your standard. A sensible baseline for a legal practice includes:

• Full-disk encryption (BitLocker on Windows) with recovery keys held centrally.
• Operating system and application updates applied within a set timeframe.
• A screen lock and password or PIN policy.
• Endpoint protection switched on and reporting.
• Remote lock and remote wipe, so a lost device can be dealt with in minutes.

Windows 10 reached end of support on 14 October 2025, so any fee earner still using it needs a plan. Our Windows 10 end-of-life guide explains the options.

Device management sits naturally inside a wider Microsoft 365 support arrangement, because the same tenant holds identity, email, SharePoint and device policy.

Bring your own device: policy and risks

Personal devices appear in most firms whether or not the policy permits them. A trainee checks email on a personal phone; a partner opens a document on a family tablet. A written BYOD policy is better than silence, because it sets limits you can enforce.

The SRA Q&A is clear that own-device use is less secure and that controls must still apply. In practice, that means choosing one of two routes for each role: a managed firm device, or a personal device limited to app-level access under Intune app protection and conditional access.

A workable BYOD policy states:

• Which roles may use personal devices, and for which services (email and Teams, for example, but not full matter downloads).
• The minimum operating system version, screen lock and encryption requirement.
• That the firm can remove corporate data from the device on loss or departure, and what it will not touch.
• That client files are not saved locally, printed at home or forwarded to personal accounts.
• How and when a lost or compromised device must be reported.

The comparison below shows why most practices keep full file access for managed devices only.

MFA, conditional access, home networks and VPNs

Passwords alone are not enough for a mailbox that holds client instructions and bank details. The SRA Q&A lists two-factor authentication among its examples of sensible remote security, and for Microsoft 365 users it is the single most effective control against stolen credentials.

Conditional access in Microsoft Entra ID goes further. It makes a decision at each sign-in based on who is signing in, from which device, from where and with what level of risk. Typical rules for a legal practice:

• Require MFA for every user, with stronger methods such as an authenticator app preferred over text messages.
• Allow access to client data only from compliant managed devices, or from browsers with restricted download rights on personal ones.
• Block legacy authentication protocols that bypass MFA.
• Require a fresh sign-in for administrator accounts and separate admin identities from day-to-day accounts.

These controls also line up with the technical requirements of Cyber Essentials, which many firms need for tenders and insurance. Our Cyber Essentials requirements checklist shows how MFA, patching and device settings are assessed.

Home network security and when a VPN is needed

• Change the default router admin password and keep router firmware updated.
• Use WPA2 or WPA3 on home Wi-Fi with a strong passphrase, and keep smart home gadgets on a guest network where the router allows it.
• Use a mobile hotspot rather than public Wi-Fi.

A VPN encrypts traffic between the device and the firm. The SRA Q&A recommends one from a reputable provider where possible. It is most useful for firms that still run on-premises servers or legacy case management software. For firms working mainly in Microsoft 365 and cloud-hosted systems, identity-based controls such as MFA and device compliance often matter more than a blanket VPN, since traffic to cloud services is already encrypted. A VPN also does nothing for a phished password, so it should sit alongside the controls above, not replace them.

Secure video calls and client meetings

Video meetings now carry privileged advice, witness discussions and settlement negotiations. The SRA Q&A suggests setting meeting passwords, sending links only to intended attendees, limiting screen sharing to the host and keeping meetings off public listings. The NCSC adds that you should check your surroundings and use background blur before joining, and know where recordings, transcripts and chat logs are stored. See the NCSC advice on video conferencing.

• Use a single approved platform, such as Microsoft Teams, rather than a mix of personal accounts.
• Use a lobby so the host admits each participant, and confirm who has joined before discussing the matter.
• Switch off recording and automatic transcription unless there is a reason to keep them, and agree where they are stored.
• Do not share your whole screen. Share the single document or window needed.

If Teams and SharePoint are both in play, our comparison of Teams and SharePoint explains where files should live. For matter-centred workflows, see case management software and Microsoft 365.

Lost or stolen device: what to do in the first hour

The SRA expects staff to know how to report problems, supported by a blame-free culture. A lost laptop reported in ten minutes is manageable. One hidden for two days is not.

1. Report immediately to the helpdesk and the firm's compliance officer. Do not wait to see whether the device turns up.
2. Lock or wipe remotely through Intune, and revoke active sessions and tokens in Microsoft Entra ID.
3. Reset the user's password and review sign-in logs for activity after the loss.
4. Establish what was on the device: encrypted, locally stored files, cached mail, saved passwords.
5. Assess the notification duties: the SRA for incidents involving client money or information, the ICO where personal data is at risk, and clients where appropriate.
6. Record the incident, the decisions taken and the reasoning.

An encrypted, managed laptop with remote wipe usually changes the assessment significantly, which is one more reason to avoid unmanaged devices. The ICO sets out what it expects of organisations on security under UK GDPR. Our guide to disaster recovery and business continuity for legal practices covers the wider incident planning.

Supervising trainees and junior staff remotely

Under the Code of Conduct for Solicitors you remain accountable for work carried out through others, and the Code for Firms requires effective supervision. Remote working does not change that, but it removes the informal checks that happen in an open-plan office.

• Schedule regular check-ins with a fixed agenda: live matters, deadlines, queries and wellbeing.
• Use shared matter workspaces so supervisors can see progress without asking for files by email.
• Define which tasks need sign-off before anything goes to a client, particularly payment instructions and undertakings.
• Give new starters a short remote working induction covering the policy, MFA enrolment, reporting and phishing awareness.

Keep a dated record of supervision arrangements.

Remote working policy checklist and safe set-up steps

Use this table as the skeleton for a written policy. Give each row an owner and a review date.

Putting a safe set-up in place: five steps

Remote working for solicitors: a practical close

Remote working for solicitors is manageable when the firm controls the device, the identity and the evidence. Managed devices, MFA with conditional access, a firm BYOD line, sensible rules for meetings and paper, and a rehearsed lost-device response cover most of what the SRA has said about remote working. The remainder is supervision and culture.

If you want an independent view of your current position, our cyber security audit reviews devices, identity and policy against what your regulator and insurer expect. For day-to-day delivery, our managed IT support and 24/7 helpdesk teams look after the devices and incidents. You can see how we support solicitors or contact us to talk it through.

Frequently asked questions