Cyber Essentials for Solicitors

The Code of Conduct requires that "You safeguard money and assets entrusted to you by clients and others." (Rule 4.2 for individuals; Rule 5.1 for firms)

The SRA has interpreted this as everyone should be alive to the threat of cybercrime and all firms should take steps to eliminate or mitigate this risk.

Eliminating such a risk is prohibitively expensive and practically impossible. Fortunately, Cyber Essentials has been shown to reduce cyber insurance claims by 92%. That's a 12-fold reduction in risk by putting in place simple and effective measures. We can help you to identify what changes you need, and provide guidance and support to further improve your cybersecurity. We can also assist you with applying for certification after all the requirements have been met, so you can be confident you're safeguarding your clients money and information.

The Lexcel standard v6.1 says practices "should be accredited against Cyber Essentials" (Requirement 3.2). We can help you gain this certification by identifying where you do not currently meet the standard and advising you how to put in place any changes prior to applying for certification.

Additionally the Lexcel requirements says practices must have policies on handling personal data, information management and security, use of email, website management, internet access and the use of social media. We can assist you in formulating and refining such policies to ensure they are appropriate to your organisation, technically coherent and legally compliant.

The Law Society CQS requirements state practices "should be accredited against Cyber Essentials" (Requirement 3.2). Whilst this is currently optional, the guidance indicates practices may be required to explain why they have chosen not to implement a requirement.

Additionally the CQS states you must have a business continuity plan and policies covering managing personal data, and information management and security. We can help you put in place these policies and plans to ensure they meet the needs of your organisation and are technically appropriate.

The guidance for the Specialist Quality Mark (v3 Oct 2022) states:
"As part of meeting F6.1, it is recommended that you have in place some form of certification under the Cyber Essentials Scheme. Cyber Essentials is a Government backed scheme that will help you to protect your organisation, whatever its size, against a whole range of the most common cyber-attacks."

We can help you to identify what changes are required for you to meet the standards of this scheme and assist you with the process of applying for certification, including formulating responses to the self-assessment questionnaire.

Under requirement F6.1, you also need to have in place an information handling policy. We can assist you in formulating and refining such a policy to ensure you have in place appropriate technical and organisational measures to protect information.