Cyber Essentials for Solicitors and Law Firms: What the SRA Expects in 2026

The legal sector handles some of the most sensitive data in the UK economy. Client funds, privileged communications, personal injury records, property transactions, criminal case files - all of it sitting in law firm systems that are increasingly targeted by threat actors.

The regulatory landscape has shifted. From October 2025, the Legal Aid Agency requires Cyber Essentials certification for all firms holding criminal legal aid contracts. The Solicitors Regulation Authority does not yet mandate a specific certification, but its position on cyber security has hardened considerably.

This article sets out what law firms need to know, what the regulators expect, and how to get certified.

The NCSC v3.3 requirements define the scheme controls. MDM can help demonstrate consistent controls, but Cyber Essentials does not mandate a particular product or an MDM subscription. Verify the required configuration, firewall, updates, access and malware controls on every in-scope device; documented manual management can also meet the requirements.

From 1 October 2025, any practice holding a Criminal Legal Aid contract must hold a valid Cyber Essentials certificate. This is not guidance - it is a contractual requirement. The 2025 criminal contract requires whole-organisation certification and annual renewal. Check the current Legal Aid Agency welcome-pack conditions; do not treat a limited subset as automatically sufficient.

The requirement applies to standard Cyber Essentials (not Plus), though firms handling particularly sensitive case data should consider whether Plus provides additional assurance.

If your firm holds a 2025 criminal legal aid contract, check its current certification and renewal obligations against the Legal Aid Agency conditions. Do not assume a practice-size estimate determines whether your contract is covered.

The Solicitors Regulation Authority takes a principles-based approach. It does not mandate a specific certification, but its expectations are clear.

Under SRA Principle 2 and the Code of Conduct for Firms, solicitors must act in a way that upholds public trust and confidence. The SRA interprets this to include maintaining appropriate systems and controls to protect client data and client money.

The SRA’s cyber security thematic review discusses firms’ duties to protect client funds and data. Review these practical controls; this list is not a quoted regulatory test or a guarantee of compliance:

• Not enforcing multi-factor authentication on email systems (particularly where client money is handled)
• Failing to maintain up-to-date software and security patches
• Not having documented procedures for handling cyber incidents
• Inadequate access controls around client files and accounts

A cyber incident can raise professional, client-money and data-protection obligations. Assess reporting and remedial duties against the actual incident and current rules; the presence or absence of a certificate does not determine the regulatory outcome.

Cyber Essentials certification does not guarantee SRA compliance, but it demonstrates that the five foundational technical controls are in place. In the event of a breach, a current certificate records the assessed baseline and scope; the adequacy of the firm’s safeguards still depends on the facts.

Law firms are attractive targets for three reasons:

The five controls map directly to the risks law firms face:

Enable MFA for every user account accessing in-scope cloud services, including administrator and third-party accounts. Implement MFA where available on non-cloud systems and apply the separate administrative-access and password controls; do not assume v3.3 mandates MFA on every local account regardless of availability. Document non-interactive service identities separately rather than treating them as human logins.

For law firms, this means MFA on:

• Microsoft 365 or Google Workspace (email and documents)
• Your practice management system (if cloud-hosted)
• Your accounts and client money system
• Any remote access tools (VPN, remote desktop)
• Any file sharing or collaboration platforms

If your firm has not yet rolled out MFA across all these services, address it before your Cyber Essentials assessment. Cloud-user MFA is a scheme requirement; assess the firm’s wider professional safeguards separately.

Cyber Essentials certification is increasingly relevant to professional indemnity insurance. Several PI insurers now ask whether firms hold Cyber Essentials as part of the renewal process. While it is not universally required, firms with certification may benefit from more favourable terms.

Separately, standalone cyber insurance policies almost universally ask about MFA, patching, and access controls - exactly the areas Cyber Essentials covers. Holding certification simplifies the application process and provides documented evidence of your security posture.

For solicitors and law firms, the certification process is straightforward:

1. Assess your position - Use Fig Group's free readiness tool to check your current compliance against the five controls

2. Address gaps - The most common gaps for law firms are MFA not being enforced on all cloud services, shared user accounts, and overdue software updates

3. Complete the assessment - The Cyber Essentials questionnaire asks about your technical controls across the five themes. Answer based on your actual configuration, not your intended configuration

Fig Group guarantees Basic assessment within six working hours for a complete, compliant submission received before midday on a UK Business Day, subject to the certification terms. Preparation, clarification and remediation are separate; certificate issuance requires a successful assessment.

For firms that need Plus certification (required by some larger clients and panel memberships), allow a prepared-assessment target of 2–3 working days, subject to scheduling, device access and remediation for the technical audit.

Cyber Essentials certificates are valid for 12 months. Set a calendar reminder to renew 4-6 weeks before expiry. Letting certification lapse creates a gap that could affect your legal aid contract, client relationships, or insurance coverage.

If your firm's IT environment changes significantly during the year (new practice management system, office move, shift to cloud services), review your controls against the Cyber Essentials requirements to ensure you remain compliant.

Get your law firm certified today