Cyber Essentials for solicitors and law firms
Client money, privileged communications, property transactions and case files. Law firms hold some of the most valuable data in the economy, and expectations around protecting it have hardened.
At a glance
- Help meeting Legal Aid Agency contract requirements
- Scoping support for hosted case and practice management
- A fast, structured route if you’re working to a deadline
Why law firms certify
A Legal Aid Agency requirement
Firms delivering criminal legal aid under the Crime Contract 2025 must hold a valid Cyber Essentials certificate. It’s a contractual condition, not just good practice.
Insurers and clients are asking
Professional indemnity insurers, lenders and corporate clients increasingly ask firms to evidence their cyber controls. Cyber Essentials is a widely recognised way to do it.
Protecting client money
Email compromise and payment diversion fraud target conveyancing and client account transactions. The controls behind Cyber Essentials, especially MFA, make those attacks much harder.
Where law firms commonly trip up
These are the issues we see most often when marking assessments, so you can deal with them before you submit.
- Hosted case and practice management. If your case management system or client portal is a cloud service, it’s in scope. Under v3.3 it must have MFA enabled for every user where the service offers it.
- Hybrid working on personal devices. Laptops and phones used to read client email from home are in scope and need to meet the same controls as office machines.
- Unclear patching responsibility. Where an IT provider manages your systems, make sure someone owns applying high and critical security updates within 14 days. Gaps here are a common reason for failure.
Two ways to get certified
Our Supported Service suits firms working to a Legal Aid Agency or client deadline: a structured gap analysis means your first submission is a clean one. If your systems are already well managed, Marking Only gets you certified efficiently.
For confident, well-prepared teams
Ideal if you have in-house expertise and have already checked your setup against the requirements.
- Your own secure assessment portal
- Independent marking with a feedback report
- Two working days to fix any non-compliances, then a complimentary re-mark
- Cyber Essentials report and certificate included
Cyber liability insurance is subject to IASME’s terms. Certifying more than one organisation? Define each additional organisation within your assessment and you’ll automatically be asked whether you’d like a duplicate certificate.
Buy Marking OnlyA senior assessor with you all the way
The right choice for most organisations, and for anyone working to a deadline.
- Your own assigned senior assessor
- Readiness check and gap analysis before anything is submitted
- Feedback within 24 working hours, with same-day assessments available subject to T&C’s
- Unlimited remote support for every question
- As many attempts as you need within the six-month assessment window
- Cyber Essentials report and certificate included
For our Supported Service: 100% of applicants who have followed our advice and who have submitted within the required deadlines have passed. Cyber liability insurance is subject to IASME’s terms. Certifying more than one organisation? Define each additional organisation within your assessment and you’ll automatically be asked whether you’d like a duplicate certificate.
Buy SupportedPrices are “from” prices, exclude VAT and depend on organisation size; your exact price is shown in our shop. Free cyber liability insurance is available to eligible organisations (IASME terms apply).
Guidance for law firms
Practical articles from our assessors in the Resource Hub.
“Thanks to the team for getting our certification completed in just a few days and before the Friday deadline. Tender submitted.”
Hannah · Google reviewCommon questions
Do we need Cyber Essentials if we don’t hold a legal aid contract?
It isn’t mandatory for every firm, but insurers, lenders and clients increasingly ask for it. We’re happy to talk through your position on a call.
Is our case management software in scope?
If it’s a cloud service your firm uses to store or access data, yes. Your scope covers how you access and secure it, including MFA, rather than the provider’s own infrastructure.
Should we consider Cyber Essentials Plus?
Plus adds an independent technical audit of your systems. It’s worth considering if a contract or client specifically asks for it. We deliver Cyber Essentials Plus with a trusted partner certification body.
More answers in our full FAQs.
Working to a legal aid or client deadline?
Talk to an assessor today and we’ll map out the quickest sensible route to certification.