CJSM, Common Platform, and Criminal Chambers: The Digital Security Baseline for 2026

A criminal chambers in London, Manchester, or Birmingham in 2026 operates across three distinct digital layers. The first is the chambers’ own infrastructure - email, document management, case management, the clerks’ systems. The second is the government-provided digital tooling that connects chambers to the prosecuting authorities and the courts - CJSM, the CPS Digital Case System, the HMCTS Common Platform. The third is the barristers’ own personal digital estate, which varies massively across a set and which is often the weakest link in the chain from a security perspective.

Cyber Essentials is primarily concerned with the first layer. But the second layer - the CJSM and Common Platform tooling - interacts with the first in ways that matter, and in ways that are often misunderstood in chambers. This guide clarifies what CJSM and Common Platform actually provide, where their security guarantees end, and how a chambers’ CE posture needs to account for them.

The NCSC v3.3 requirements define the scheme controls. MDM can help demonstrate consistent controls, but Cyber Essentials does not mandate a particular product or an MDM subscription. Verify the required configuration, firewall, updates, access and malware controls on every in-scope device; documented manual management can also meet the requirements.

CJSM - the Criminal Justice Secure Mail service - is an email service provided by the Ministry of Justice for communication between authorised criminal justice system participants: police forces, CPS, HMCTS, prisons, probation, defence solicitors and barristers, and selected other government and public-sector organisations.

What CJSM provides:

• A private network environment where messages between CJSM accounts pass through the gov.uk infrastructure, not the public internet
• Strict membership controls - only approved criminal justice participants can hold CJSM addresses
• Transport-layer security between CJSM servers
• A shared trust model that allows bulk case communications to move through a single controlled channel

What CJSM does not provide:

This is not a criticism of CJSM. CJSM is doing what it was designed to do - provide a restricted transport channel for CJS participants. The mistake chambers sometimes make is treating CJSM as equivalent to cryptographic end-to-end encryption, when it is not.

The practical implication: the security of CJSM-delivered material depends almost entirely on the security of the recipient chambers’ infrastructure and endpoint security - which is exactly what Cyber Essentials covers.

Common Platform is HMCTS’s digital case system for criminal cases. It has been rolled out progressively across magistrates’ and Crown courts over the last several years. For chambers and barristers, Common Platform provides:

• Access to case information in a unified digital interface
• Digital service of documents
• Case listing, hearing information, and court diary visibility
• Integration with CPS and defence systems where authorised

Access to Common Platform is gated by Common Platform Professional User accounts. Each user logs in individually. For chambers:

• Every barrister and delegated staff member with Common Platform access has their own credentials
• These accounts need MFA-level protection under v3.3
• Leaver processes need to reach Common Platform when someone moves chambers or retires
• The devices used to access Common Platform are in scope for CE if they access chambers case data through that channel

The HMCTS Digital Case System (DCS) is a separate but related system for prosecution case materials. Defence access to CPS DCS is granted on a case-by-case basis. The same access control principles apply - individual accounts, MFA, proper deprovisioning.

Several specific points where chambers' CE controls directly affect the security of CJSM, Common Platform, and DCS material:

Most criminal chambers use a case management system: LEX Chambers, Advocate Chambers, Athena, MeridianLaw, or bespoke setups. Many of these integrate with CJSM - ingesting CJSM messages into the case management system, linking documents to matter records, and allowing clerks and barristers to work within a unified interface rather than across separate email and case management screens.

For Cyber Essentials purposes, the case management system itself is in scope. It holds organisational data (case matters, client information, document indices). Applicable scheme controls and additional recommended safeguards to distinguish in preparation:

• MFA on every user account - barristers, clerks, administrators
• Integration with chambers identity (SSO where available)
• Audit logging of access to sensitive matters
• Role-based access - not every clerk needs access to every case
• Proper leaver deprovisioning
• Desktop vulnerability fixes. Apply vendor-approved vulnerability fixes within 14 days of release when the vendor rates the vulnerability critical or high, its CVSS v3 score is 7 or higher, or the vendor provides no severity details. This includes supported in-scope operating systems, applications, extensions and firmware; it is not a deadline for every routine update.

For cloud-hosted case management systems, the vendor handles the infrastructure. For on-premise or self-hosted systems, the chambers handles the infrastructure, and the underlying servers, databases, and network components are all in CE scope.

Self-employed barristers often work across multiple devices: a chambers-issued laptop for chambers work, a personal laptop for wider legal practice, a personal iPad for brief-reading, a personal phone for CJSM email, a home desktop for paperwork. From a chambers CE perspective, this is a scoping question.

The options:

Most London criminal chambers operate at some point along a continuum between A and B. The key is consistency between the scope declared and the reality of how work is done.

Criminal practice still involves significant paper. Briefs are sometimes delivered in hard copy. CPS bundles are often printed for court use. Judges still refer to paper bundles at the Old Bailey and Crown Courts. Cyber Essentials does not directly cover paper - it is a cybersecurity scheme, not an information security management system - but the transition between digital and physical forms a boundary where material leaves the controlled environment.

For CE purposes, the relevant controls are around the digital side: the chambers printer, the document management system’s print history, and the devices that generate the printed output. All of those are in scope.

A practical preparation checklist is:

• A managed print environment where the printer itself is managed (firmware patched, default credentials changed, access controlled)
• An explicit policy on printing sensitive material - retrieve immediately, no leaving documents on the shared printer
• Secure disposal - shredding bins, cross-cut shredding of sensitive material

These are more information governance than CE, but they arise during Plus technical audits when the assessor looks at the printer network configuration and sees a multi-function device with a WAN-accessible admin page and default credentials.

At annual renewal, verify the current controls and scope instead of reusing last year’s answers unchanged. Review changes such as:

• New members joining chambers - accounts provisioned, devices brought into management
• Members leaving chambers - accounts deprovisioned across all in-scope systems
• Cloud service changes - new case management system, new document platform, new video conferencing tool
• Chambers-level infrastructure changes - office move, new wifi, new firewall
• Personnel changes in the clerking team

Each of these needs to be reflected in the updated CE submission. Chambers that run a living document of their CE scope and controls, updated quarterly rather than annually, find renewal much easier than chambers that treat it as a once-a-year scramble.

CJSM and the HMCTS Common Platform are important components of the criminal chambers digital environment, but they are not substitutes for the baseline cybersecurity controls that Cyber Essentials asks for. CJSM’s transport security does not encrypt messages at rest. Common Platform’s access controls do not manage the device a barrister uses to log in. Both systems rely on the recipient chambers’ CE-level posture to actually protect the material.

For a London criminal chambers in 2026, the realistic posture is Cyber Essentials (or Plus) as the baseline, with CJSM and Common Platform used on top of that baseline rather than as a replacement for it. Keep the certificate scope and the separate justice-system controls clear when answering instructing solicitors, clients and insurers; neither transport security nor certification guarantees a security outcome.

Check your readiness | View pricing | Talk to an assessor