Solicitors · Law firms · Legal aid providers
Cyber security for law firms: what the SRA, clients and the LAA expect
A practical guide for COLPs, COFAs, managing partners and practice managers. It covers your duties under the SRA Codes, Cyber Essentials for legal aid contracts, payment diversion fraud, what your indemnity insurance does and does not cover, and what to do when something goes wrong.
At a glance
Context
Why law firms are targeted
Law firms hold exactly what criminals want: client money moving in large sums on predictable dates, and confidential information about deals, disputes, families and finances. Most firms are small, run on outsourced IT, and depend on email for almost everything. That makes them attractive and, too often, easy.
In its thematic review, the SRA visited 40 firms that had reported cybercrime. Thirty had been attacked directly, and more than £4 million of client money was stolen, most of it recovered from insurers. The SRA’s later Risk Outlook found that over 80% of cybercrime reports involved email, with ransomware and attacks through IT suppliers growing. The 2025 attack on the Legal Aid Agency, in which data about legal aid applicants going back to 2010 was accessed, showed how far the consequences reach across the justice system.
Regulation
Your duties under the SRA Codes
The SRA does not set out a list of required controls. It says there is no one-size-fits-all model, and that firms must decide how to protect themselves and their clients. What it does require is that you meet the outcomes in the Codes of Conduct, and it will judge your decisions after the event.
Safeguarding client money and assets
Firms and individuals must safeguard money and assets entrusted to them. If client money goes to a fraudster because of a weakness in your processes, this is a regulatory matter as well as a financial one. Replacing the money promptly is expected.
Effective systems and controls
The Code for Firms requires effective governance structures, arrangements, systems and controls. For cyber, that means being able to show you assessed the risk, chose proportionate controls, trained people, and checked the controls work.
Confidentiality
You must keep clients’ affairs confidential. A data breach can be a breach of your professional obligations as well as of data protection law.
Reporting to the SRA
Firms, COLPs and COFAs must report promptly any facts or matters they reasonably believe could amount to a serious breach. Loss of client money through cybercrime, and significant loss of client data, are the kinds of incident the SRA expects to hear about. In the thematic review, seven significant incidents had gone unreported.
Supervision and outsourcing
Outsourcing IT does not outsource responsibility. You remain accountable for the services your IT provider runs for you, including remote access, backups and email security.
Legal aid
Legal aid and Cyber Essentials
The Legal Aid Agency requires every provider under the 2025 Standard Crime Contract to hold Cyber Essentials certification, or an agreed equivalent, from its Service Commencement Date and throughout the life of the contract. Applicants are not awarded a contract until they can show a valid certificate.
- It is Cyber Essentials, not Plus, for the crime contract. Plus is worth considering if you hold significant volumes of sensitive client data.
- It must be kept current. Certificates last a year. A lapse is a breach of contract, so diarise renewal well ahead.
- Scope matters. Certify the whole organisation, including home working and the devices fee earners actually use.
Check your civil and other LAA contracts, and any client or panel requirements, for similar conditions. Our Cyber Essentials guide explains the five controls.
The biggest risk
Payment diversion fraud
Also called email modification or “Friday afternoon” fraud. A criminal gets into your mailbox, your client’s or another firm’s, watches the matter, and at the moment money is due to move sends convincing new bank details. Conveyancing is the classic target, but probate, litigation settlements and corporate completions are all exposed.
Five controls that stop most of it
- Tell every client at the start of the matter, in writing and verbally, that you will never change your bank details by email.
- Verify any payee bank details by phone, using a number you already hold, never one from the email.
- Use multi-factor authentication on every mailbox, including partners’ and support staff’s.
- Alert on suspicious mailbox rules, such as auto-forwarding or hiding messages, which attackers set up to stay unseen.
- Consider confirmation of payee and a secure portal for exchanging bank details, rather than email.
Insurance
Indemnity insurance and cyber cover
Your professional indemnity insurance, under the SRA Minimum Terms and Conditions, responds to claims by clients and third parties, including claims that arise from a cyber incident. It does not cover your own losses: restoring systems, paying forensic investigators, business interruption, notifying clients, or regulatory costs. That is what a separate cyber policy is for.
Read the cyber policy’s conditions carefully. Many require MFA, tested backups, supported software and prompt notification, and may decline claims where those were missing. Our cyber insurance companion explains what insurers ask and why.
Priorities
The controls that matter most
| Control | Why it matters for a law firm |
|---|---|
| MFA on email and remote access | Stops most mailbox takeovers, the start of nearly every payment diversion fraud. |
| Payment verification process | The last line of defence when an email looks right. |
| Offline or immutable backups, tested | The difference between a bad week and losing the case management system. |
| Supported, patched systems | Out-of-date systems were a common weakness in the SRA’s review. |
| Encrypted laptops and phones | A quarter of firms in the review did not encrypt laptops. |
| Training that fee earners attend | One in five firms in the review had never trained staff. |
| IT supplier oversight | Attacks through IT providers can hit many firms at once. |
Response
When something goes wrong
The first hours decide the outcome. If money has been sent to a fraudster, call your bank and the receiving bank immediately; funds are sometimes recoverable if you move fast. Then work through:
- your cyber insurer’s incident line, before appointing anyone else if the policy requires it;
- Action Fraud (or Police Scotland, or the PSNI);
- the ICO within 72 hours, if personal data is involved and the breach is notifiable;
- the SRA, promptly, if the facts could amount to a serious breach;
- your PII broker, if a client may claim;
- the LAA, if legal aid work or data is affected.
Our first hour guide and operating runbooks set this out step by step.
Leadership
Questions for partners
- If a client’s completion money went to a fraudster tomorrow, could we replace it, and how quickly?
- Does every mailbox in the firm have MFA, with no exceptions for partners?
- When did we last restore our case management system from backup, and how long did it take?
- Is our Cyber Essentials certificate current, and does it cover how we actually work?
- What does our cyber policy require of us, and are we meeting it?
Working with us
How we can help
We work with high street firms, legal aid providers and larger practices. Every piece of work is priced in writing before it starts.
Firm cyber review
An independent review of your controls against SRA expectations, Cyber Essentials and your insurer’s conditions, with a prioritised action list partners can act on.
Fixed price, agreed before we start
Payment fraud exercise
A realistic rehearsal of a payment diversion or ransomware incident for partners, the COLP and COFA, and practice management.
From £2,650 + VAT
Partner briefing
A focused session on the risk, your regulatory duties and the questions to put to your IT provider.
Fixed price per session
Runbooks and virtual CISO
Incident, payment verification and backup testing runbooks, or a virtual CISO or DPO for firms without one.
Runbooks · Virtual CISO and DPO
Runbooks from £165 + VAT each
AI use review
An independent check on how the firm uses generative AI with client information, before it becomes a confidentiality problem.
Fixed price, agreed before we start
Exposure monitoring
Ongoing monitoring of what attackers can see of the firm from the internet, including look-alike domains used in fraud.
Monthly fee, agreed before we start
Our independence rule
We never assess work we have advised on, and we never sell the fix for anything we assess. We do not sell the technology that would close the gaps we find, so our advice is not a sales pitch.
FAQ
Questions we are asked
Does the SRA require Cyber Essentials?
No. The SRA does not prescribe specific controls, though it points firms to Cyber Essentials and NCSC guidance. The Legal Aid Agency does require Cyber Essentials under the 2025 Standard Crime Contract.
Do we have to report a cyber attack to the SRA?
You must report promptly any facts you reasonably believe could amount to a serious breach. Loss of client money or significant loss of client data will usually meet that threshold. Report personal data breaches to the ICO within 72 hours where they are notifiable.
Does our PII cover a cyber attack?
It covers civil liability to clients and third parties arising from a cyber incident. It does not cover your own costs, such as system recovery, forensic work or business interruption. A separate cyber policy covers those.
What is the single most effective control?
For most firms, multi-factor authentication on every mailbox combined with phone verification of any bank details before money moves.
Is this guide relevant to firms in Scotland and Northern Ireland?
The threats and controls are the same. Regulation differs: solicitors are regulated by the Law Society of Scotland and the Law Society of Northern Ireland, so check their rules on reporting and client money.
Sources
Primary sources
- Cyber security: a thematic review (SRA, September 2020)
- Risk Outlook report: information security and cybercrime (SRA)
- The impact of cybercrime and how to reduce the risk (SRA)
- 2025 Standard Crime Contract application guide (Legal Aid Agency)
- Legal Aid Agency data breach (Law Society)
- Report a personal data breach (ICO)
- Cyber Essentials (NCSC)