Cyber Essentials for law firms
Who asks law firms for the certificate, which level to choose, what to gather first, the scope problems the sector brings and the questions it commonly fails.
- Mandated by
- Legal Aid Agency; The Law Society
- Typical scope
- Case-management servers, Fee earners' personal devices, Client portals and external services, Legacy dictation and scanning software
- Cyber Essentials
- From £1,500, 1 to 2 weeks, IASME fee included
- Cyber Essentials Plus
- From £3,000, 2 to 5 weeks
Cyber Essentials is not an SRA rule, but the Legal Aid Agency makes it a mandatory data security requirement for legal aid providers, and the Law Society suggests it to firms. For a law firm the scope is the case-management platform, email, every fee earner's devices and any home-working setup.
Do law firms need Cyber Essentials?
Yes, where the work falls under one of these requirements. Legal Aid Agency and The Law Society require or expect Cyber Essentials; each source is listed below with the date it was checked.
Legal Aid Agency
Source checkedThe LAA Provider Data Security Requirements (v5, October 2025) make Cyber Essentials, or an equivalent standard, mandatory for the life of the contract, and recommend Cyber Essentials Plus (checked 3 November 2026).
Source: Legal Aid Agency, Provider Data Security Requirements v5
The Law Society
Source checkedIts cyber security guidance for solicitors suggests firms consider Cyber Essentials certification, Lexcel accreditation or ISO 27001, and notes that some insurers offer discounts for certified organisations (checked 3 November 2026).
Source: The Law Society, Cyber security guidance for solicitors
Whatever the source, the contract, grant or tender is what binds you. Read it for the level it names, the scope it expects and the date the certificate must be in place, and record the reason at A1.10 when you apply.
Do law firms need Cyber Essentials or Cyber Essentials Plus?
Legal aid work needs Cyber Essentials at minimum for the life of the contract, with Plus recommended by the LAA. Firms without legal aid contracts choose the level their clients' panel terms name.
Both levels use the same five controls and the same question set. Plus adds an independent audit of a sample of devices and cloud accounts, on the same scope as a valid Cyber Essentials certificate. Compare the two levels.
What should law firms gather before starting?
Most of the self-assessment is describing your estate accurately. Have these to hand before you open the question set and the answers take hours, not weeks.
- Your legal aid contract reference, if you have one, for A1.10.2 or A1.10.4.
- The version of the practice-management or case-management system, and whether it runs on your own server or the vendor's cloud (A2.7, A2.9).
- A list of fee earners and partners who read firm email on personal phones or home computers (A2.4.1, A2.8).
- Dictation, scanning and document-comparison software versions, since older desktop tools are a frequent A6.2 issue.
- The client portal or secure file-sharing service, and how it authenticates users (A5.4, A5.5).
What scope problems do law firms bring?
Scope must cover every device and cloud service that reaches organisational data, or a sub-set segregated by a firewall or VLAN that you can justify. These are the boundaries this sector tends to get wrong.
Case-management servers
On-premises practice-management systems often sit on Windows Server or SQL Server versions past end of support.
Fee earners' personal devices
Partners reading email on personal phones bring them into scope; the phones need a screen lock and a supported operating system.
Client portals and external services
A portal the firm hosts for clients is an external service and needs MFA or brute-force protection, plus a process for changing compromised passwords.
Which questions do law firms commonly fail?
Questions law firms commonly fail include A6.1, A7.6 and A5.9. This is a typical pattern from assessor experience, not a statistic, but it is worth planning around.
| Question | Why it fails | Fix |
|---|---|---|
| A6.1Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes? If you have included firewall or router devices in your scope, the firmware of these devices is considered to be an operating system and needs to meet this requirement. | Law firms often run practice-management servers past the vendor's support date because migration is disruptive. | Plan the migration to a supported server or the vendor's cloud edition. Until then the server cannot stay in scope with internet access. |
| A7.6How does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)? This applies to local administrator accounts, network/domain administrator accounts, and cloud service administrator accounts. | Small firms frequently have one IT contact who uses a single admin account for everything. | Issue a separate standard account for daily use and keep admin credentials for administration only. |
| A5.9When a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed? | Partners' phones without a screen lock are a recurring finding when personal devices are in scope. | Require a passcode of at least 6 characters or a biometric on every device that reads firm email, and record it per device. |
Frequently asked questions
No regulator requires it of chambers. Where it is asked for, the request usually comes from instructing solicitors or clients. Chambers is typically the applicant for its shared systems, and each member's own devices that reach chambers' data or services are in scope as user-owned devices.
No. The Legal Aid Agency's Provider Data Security Requirements (v5, October 2025) make Cyber Essentials, or an equivalent standard, mandatory and recommend Cyber Essentials Plus. Keep the certificate current for the life of the contract, and check the requirement in your own contract schedule.
Yes. If it runs on your own server, the server and its operating system are in scope and must be supported (A6.1, A2.7). If it is the vendor's cloud edition, it is a cloud service that cannot be excluded, and every user and administrator needs MFA where the service offers it (A7.16, A7.17).
It covers every device, network, user account and cloud service that accesses your organisation's data or services, including staff-owned phones and laptops under BYOD. You can certify part of the organisation if the excluded networks are segregated by a firewall or VLAN (A2.1, A2.2.2), but the certificate then reads 'Partial Organisation', which a buyer may question.
Twelve months from certification, and buyers under PPN 014 expect it renewed every year of the contract. Renewal is a fresh self-assessment against the question set current at the time, so a certificate first issued under an older version is reassessed against v3.3 and the Danzell question set when it renews.
Related pages
- Windows Server support statusWhich Windows Server versions still count as supported
- Windows Server 2012 R2Why it fails and what to do
- iOS and iPadOS setupPasscode and update settings for partners' phones
- Microsoft 365 and Entra ID setupMFA and admin separation
- Who needs Cyber Essentials?Government, MoD, NHS and other mandates.
- Scope: what is in and outBYOD, home working, cloud and sub-sets.
- How much does it cost?Fixed prices and IASME fee bands.
- Check your readinessFree check against the 2026 question set.
- Cyber Essentials for accountancy and financial advisers
- Cyber Essentials for healthcare and care providers
- Cyber Essentials for construction and contractors
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- GOV.UKLegal Aid Agency, Provider Data Security Requirements v5Read on assets.publishing.service.gov.uk (opens in a new tab)
- lawsociety.org.ukThe Law Society, Cyber security guidance for solicitorsRead on lawsociety.org.uk (opens in a new tab)
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh