Cyber Essentials for UK solicitors and law firms Certified by Fig Group.
Fig Group certifies UK law firms - from sole practitioners to 200-lawyer regional practices - for Cyber Essentials and Cyber Essentials Plus. IASME-licensed, from £299.99 + VAT, with a six-working-hour Basic guarantee for complete, compliant submissions before midday on a UK Business Day, subject to terms. Tailored to the hybrid working, practice-management, and SRA context that the standard scheme guidance does not address.
Sector-specific
Tailored to solicitors and law firms
The scheme requirements apply across sectors; implementation and contractual context differ. These are the scope, regulatory, and supplier-cascade points Fig Group assessors check first.
- 01SRA Code of Conduct expectations around client confidentiality and IT systems.
- 02LexisNexis, Clio, Leap, Actionstep, DPS and other practice-management platforms.
- 03Hybrid and remote working, including BYOD scope and v3.3 home-network boundary handling.
- 04Counsel chambers and counsel-facing practice management.
- 05AML supervision data handling.
- 06Legal-aid and SFA-framework supplier requirements.
Pricing at a glance
Below the standard IASME fee at every tier
Three free rounds of Basic assessor feedback included. Published pricing - no gated forms or consultancy add-ons. If gaps remain after the included rounds or assessment period, agree any further support or new purchase before incurring a charge. Read the assessment terms.
Turnaround
6 working hours
Complete, compliant Basic submissions before midday on a UK Business Day; terms apply.
Cyber Essentials
£299.99 - £549.99
+ VAT, by organisation size.
Cyber Essentials Plus
£1,499.99 - £4,499.99
+ VAT, third-party verified.
Common questions
Frequently asked questions
Is Cyber Essentials required for solicitors?
Check the client, insurer and tender requirements for the work you undertake. Cyber Essentials is not a universal SRA certification requirement. PPN 014 applies to specified procurements by in-scope public bodies; requirements and equivalent evidence depend on the contract.
What scope should a 25-person law firm use?
Include the devices and services used for organisational data: laptops, mobiles, cloud email and practice-management systems. Personal devices used for work are generally in scope; Conditional Access is not itself an exemption. Worker- or ISP-supplied home routers are excluded, but organisation-supplied routers are included. Agree any justified subset boundary with the assessor.
Which tier do we buy?
Pick by staff, including part-time staff and contractors. For a firm with 25 staff: Cyber Essentials Small at £399.99 + VAT, or CE Plus Small at £1,999.99 + VAT if an insurer or client requires third-party audit.
How fast can we certify?
Fig Group guarantees assessment within six working hours for complete, compliant Basic submissions received before midday on a UK Business Day, subject to the certification terms. Plus has a prepared-customer target of two to three working days, dependent on scheduling, access and remediation.
Do we need CE Plus or is CE enough?
Use the assurance level named by the buyer or insurer. Basic is a verified self-assessment; Plus adds independent technical testing. A public-sector or regulated client relationship alone does not establish a universal Plus requirement.
Sources: NCSC requirements v3.3, PPN 014, certification terms.
Deep-dive articles
Long-form guidance for solicitors and law firms
Technical guidance written by an IASME-licensed assessor - scope edge cases, supplier cascade, and regulatory overlap that the scheme guidance does not cover.
Next step
Ready to certify?
From £299.99 + VAT. IASME-licensed. Typically within 6 working hours. No consultancy add-ons.