Phishing is still the number one way businesses get hacked, because it targets people rather than technology. A convincing email tricks someone into clicking a link, entering a password or paying a fake invoice, and the damage is done. The good news is that most phishing emails give themselves away if you know what to look for. Here is how to spot them, with examples.
How to spot a phishing email
Learning how to spot a phishing email is one of the best defences a business has, because most scams give themselves away once you know the warning signs. The NCSC offers official guidance too.
What is phishing?
Phishing is a scam where criminals pose as a trusted person or company, usually by email, to trick you into handing over information, clicking a malicious link or making a payment. More targeted versions include spear phishing (aimed at a specific person) and CEO fraud (pretending to be your boss to authorise a payment).
The warning signs to look for
A sense of urgency: “Your account will be suspended in 24 hours” is designed to make you act before you think.
Unexpected requests: a sudden ask to pay an invoice, change bank details or buy gift cards.
A mismatched sender address: the display name looks right but the actual email address is odd or misspelt.
Dodgy links: hover over a link and the real destination does not match the text or the company.
Generic greetings: “Dear Customer” instead of your name.
Spelling and grammar errors: genuine companies rarely send sloppy emails.
Unexpected attachments: especially invoices, receipts or files you were not expecting.
Real-world examples
The fake invoice: an email that looks like it is from a supplier, asking you to pay to a “new” bank account. Always verify changes by phone using a known number.
The CEO request: a message that appears to be from your manager asking you to urgently buy gift cards or make a transfer. Real bosses do not do this by surprise email.
The password reset: a warning that your Microsoft 365 account is locked, with a link to a login page that steals your details.
The delivery scam: a “missed parcel” text or email with a link to pay a small fee, harvesting card details.
What to do if you spot a phishing email
Do not click any links or open attachments.
Do not reply or forward it to colleagues.
Report it to your IT provider and, in the UK, forward it to report@phishing.gov.uk.
Delete it, and if you did click, change your password and tell IT immediately.
How to protect your business
Technology and training work best together. Good email filtering stops most phishing before it lands, multi-factor authentication means a stolen password alone is not enough, and regular staff awareness turns your team into a strong last line of defence. A free cyber security audit will show where your gaps are, and Cyber Essentials puts the core controls in place.
How ATS Connection can help
We protect West Sussex businesses with layered email security, multi-factor authentication and staff awareness, all backed by proactive managed IT support. Get a quote or call 01903 255 159.
Frequently asked questions
What is a phishing email?
It is a scam email where criminals pose as a trusted person or company to trick you into clicking a malicious link, sharing information or making a payment.
How can I tell if an email is phishing?
Look for urgency, unexpected payment or login requests, a mismatched sender address, links that do not match their text, generic greetings, poor spelling, and unexpected attachments.
What should I do if I receive a phishing email?
Do not click links or open attachments. Report it to your IT provider and forward it to report@phishing.gov.uk, then delete it. If you clicked, change your password and tell IT at once.
What is the difference between phishing and spear phishing?
Phishing is sent widely to many people. Spear phishing is targeted at a specific person or business, often using real details to look more convincing.
How do I protect my business from phishing?
Combine email filtering, multi-factor authentication and regular staff awareness training, and put core security controls in place through a cyber audit or Cyber Essentials.
Microsoft 365 Business Premium is Microsoft’s most complete plan for small and medium businesses. It bundles the familiar Office apps and Teams with a serious layer of security and device management, which is why it is often the best value plan for a business that takes data protection seriously. This guide explains what is included, roughly what it costs, and who it suits.
In short, Microsoft 365 Business Premium is Microsoft’s most complete plan for small and medium businesses, combining the Office apps with advanced security and device management. You can compare it on the Microsoft 365 for business site.
What is Microsoft 365 Business Premium?
Business Premium is one of the Microsoft 365 plans aimed at organisations up to 300 users. It includes everything in the Business Standard plan, the productivity side, and adds advanced security and device management on top. In short, it is the productivity suite plus the tools to keep your accounts, devices and data safe.
What is included?
The Office apps: desktop and web versions of Word, Excel, PowerPoint and Outlook.
Email and calendars: business email hosted on Exchange with a 50GB mailbox.
Teams: chat, calls and video meetings for the whole organisation.
Cloud storage: 1TB of OneDrive per user, plus SharePoint for shared files.
Advanced security: Microsoft Defender for Office 365 to guard against phishing and malware, plus threat protection.
Device management: Microsoft Intune to secure and manage laptops and mobiles.
Data protection: tools to control access, encrypt information and wipe lost devices.
What does Microsoft 365 Business Premium cost?
Business Premium is priced per user per month, typically on an annual commitment, and at the time of writing sits at around £18 to £19 per user per month. Microsoft adjusts pricing periodically, so always check the current figure, but as a rule Premium costs a few pounds more per user than Business Standard while adding the whole security and management layer, which is where its value lies.
Business Premium versus Standard
Business Standard gives you the apps, email and Teams. Business Premium adds Defender, Intune and data protection on top. If your business handles sensitive data, has staff working on the move, or wants to meet standards like Cyber Essentials, the extra security in Premium usually justifies the small price difference. If you only need the productivity apps and have security covered elsewhere, Standard may be enough.
Who is it best for?
Businesses that want productivity and security in one plan.
Teams with laptops and mobiles that need managing and protecting.
Organisations handling customer or financial data.
Anyone working towards Cyber Essentials or similar standards.
Getting the most from it
Business Premium is powerful, but the security features only protect you if they are set up properly. Multi-factor authentication, Defender policies and Intune all need configuring for your business rather than left at their defaults. That is where a good IT partner adds real value, turning the licence you are paying for into genuine protection. A free cyber security audit is a good way to check yours is configured well.
How ATS Connection can help
We license, set up and manage Microsoft 365 for businesses across West Sussex, configuring the security properly and supporting your team day to day as part of our managed IT support. Get a quote or call 01903 255 159.
Frequently asked questions
What is included in Microsoft 365 Business Premium?
It includes the Office apps, business email, Teams, 1TB of OneDrive per user, plus advanced security through Microsoft Defender and device management through Intune, and data protection tools.
How much does Microsoft 365 Business Premium cost?
It is priced per user per month, usually on an annual plan, and at the time of writing is around £18 to £19 per user per month. Microsoft updates pricing periodically, so check the current figure.
What is the difference between Business Standard and Business Premium?
Standard gives you the apps, email and Teams. Premium adds advanced security (Defender), device management (Intune) and data protection, making it better for businesses handling sensitive data.
Is Microsoft 365 Business Premium worth it?
For most businesses handling important data or with staff working on the move, yes. The security and management tools usually justify the small price difference over Standard.
How many users can Business Premium support?
Microsoft 365 Business plans, including Business Premium, support up to 300 users. Larger organisations move to the Enterprise plans.
“How much does cyber security cost?” is one of the most common questions we get, and the honest answer is: less than you might fear, and far less than an attack. There is no single price, because it depends on your size and needs, but this guide breaks down the typical costs so you can budget sensibly.
How much does cyber security cost?
So how much does cyber security cost for a small business? There is no single price, but a solid layered package usually works out at a manageable per-user monthly fee. The NCSC small business guide sets out the essentials.
Why there is no single price
Cyber security is not one product, it is a set of layers. What you need depends on how many staff and devices you have, the kind of data you hold, your compliance requirements and your current setup. A five-person firm and a fifty-person firm have very different needs, so costs are best thought of as a per-user monthly figure rather than one big number.
The typical building blocks and costs
Email security and filtering: a few pounds per user per month to stop phishing and spam before it lands.
Endpoint protection (antivirus and more): a small monthly cost per device for modern threat detection.
Multi-factor authentication: often included with Microsoft 365 licences, so minimal extra cost for a big security win.
Backup and disaster recovery: priced by data volume, protecting you if the worst happens.
Security awareness training: a low per-user cost to turn staff into a strong last line of defence.
Cyber Essentials certification: a modest annual fee, plus any work to close gaps.
What it costs as a whole
For many small businesses, a solid layered security package works out at a manageable per-user monthly fee, often bundled into managed IT support. Rather than buying tools piecemeal, most SMEs are better served by a package that covers the essentials together, which is usually cheaper and leaves no gaps. Getting Cyber Essentials certified is an affordable way to prove the basics are in place.
The cost of getting it wrong
Set the cost of protection against the cost of an incident. A serious cyber attack can bring lost data, days of downtime, recovery bills, regulatory fines and lasting damage to your reputation, running into many thousands of pounds. Viewed that way, layered security is not an expense but insurance that also prevents the disruption in the first place.
How to budget for cyber security
Start with a review of what you have and where the gaps are.
Prioritise the high-impact, low-cost wins first, such as MFA and email filtering.
Bundle the essentials into a managed package for predictable monthly costs.
Include Cyber Essentials to give your spending a clear framework.
A free cyber security audit is the simplest way to see what you need and what it will cost, with no obligation.
How much does cyber security cost for a small business?
There is no single price, but for many SMEs a solid layered package works out at a manageable per-user monthly fee, often bundled into managed IT support. It depends on your size, data and needs.
What does cyber security spending typically include?
Email filtering, endpoint protection, multi-factor authentication, backup and disaster recovery, staff awareness training, and certification such as Cyber Essentials.
Is cyber security worth the cost?
Yes. The cost of protection is small compared with a serious attack, which can bring downtime, recovery bills, fines and reputational damage running into thousands of pounds.
What is the cheapest way to improve cyber security?
Start with high-impact, low-cost wins such as enabling multi-factor authentication (often free with Microsoft 365) and email filtering, then build from there.
Does Cyber Essentials cost much?
The certification itself is a modest annual fee. The main cost is usually any work needed to close gaps first, which a provider can handle for you.
SRA IT Requirements for Solicitors: Complete Compliance Checklist 2026
Understanding SRA IT requirements for solicitors isn’t optional, it’s a fundamental compliance obligation that protects your practice, your clients, and your career. Yet many solicitor practices across the UK struggle to interpret what the Solicitors Regulation Authority actually requires when it comes to technology, information security, and data protection.
The consequences of getting it wrong are severe. SRA interventions, client compensation claims, cyber insurance invalidation, and reputational damage can result from non-compliant IT systems. In 2025 alone, the SRA received over 2,300 reports of data breaches and cyber security incidents affecting solicitor practices, many of which could have been prevented with proper IT compliance.
This comprehensive guide explains exactly what the SRA expects from your IT systems in 2026, providing a detailed compliance checklist you can use to assess your practice immediately. Whether you’re a sole practitioner in Chichester or a 50-person firm in Worthing, these requirements apply to you.
What you’ll discover:
The 10 essential SRA IT requirements every solicitor must meet
A detailed compliance checklist to audit your current systems
Common IT compliance mistakes that trigger SRA intervention
How to achieve and maintain ongoing compliance
Cost-effective ways to implement compliant IT infrastructure
Where to get expert help with SRA technology requirements
The SRA IT requirements for solicitors aren’t contained in a single document titled “IT Requirements.” Instead, they’re woven throughout the SRA Standards and Regulations, the SRA Code of Conduct, and various guidance documents. This can make compliance feel complex, but the underlying principles are clear.
Where IT Compliance Sits in SRA Standards
The SRA Standards and Regulations 2019 (which came into force in November 2019 and have been updated since) set out the fundamental obligations that affect your IT systems:
Key relevant standards:
Principle 2: Acting with integrity
Your IT systems must maintain the integrity of client data
No unauthorised access or disclosure
Secure handling of confidential information
Principle 4: Acting in the best interests of each client
Technology that protects client confidentiality
Systems that safeguard client money and assets
Business continuity to serve clients even during disruption
Principle 5: Providing a proper standard of service
Competent use of technology
Systems that support effective case management
Technology that doesn’t compromise service delivery
Principle 7: Running the business effectively
Effective information governance
Business continuity planning
Risk management including cyber security
The SRA Code of Conduct IT Implications
Paragraph 6.3 states you must ensure that your systems and controls:
Keep client money and assets safe
Account for all client money
Maintain effective governance structures
Paragraph 8.1 requires you to:
Protect client information and confidentiality
Maintain proper systems for this protection
These aren’t suggestions, they’re mandatory obligations.
Recent SRA Guidance Updates (2024-2026)
The SRA has increasingly focused on technology and cyber security:
November 2024: Updated guidance on cyber security risk management March 2025: Enhanced requirements for cloud service providers September 2025: Specific guidance on AI use in legal practices January 2026: Current standards for remote working security
The trend is clear: The SRA expects solicitors to maintain robust, current technology security measures. “We’re a small firm” or “we don’t have the budget” aren’t accepted excuses for non-compliance.
Why IT Compliance is Non-Negotiable
Legal obligations:
SRA Standards and Regulations (mandatory)
Data Protection Act 2018 (criminal offences for breaches)
Before diving into specific requirements, understanding the real-world consequences of non-compliance provides essential context.
Real Consequences of IT Non-Compliance
SRA Interventions:
In 2024-2025, the SRA intervened in 47 practices specifically citing IT security failures as a primary or contributing factor. Common triggers included:
Client data breaches due to inadequate security
Ransomware attacks that compromised client files
Loss of client money due to email compromise
Inability to account for client funds after system failures
Inadequate backup leading to permanent data loss
Once the SRA intervenes:
Your practising certificate can be suspended immediately
An intervention agent takes control of your practice
All client files are frozen pending security audit
Costs typically £50,000-£200,000 paid from practice assets
Your reputation in the legal community is severely damaged
Clients move to other firms
Staff lose jobs
Years of building your practice can be destroyed in days
Client Claims and Compensation
Scenario: A conveyancing practice suffered a ransomware attack that encrypted all active case files three days before scheduled completions. Inadequate backups meant files were unrecoverable.
The IT failure that caused this? Not implementing the basic SRA requirement for secure, tested backups.
Cyber Insurance Implications
Most solicitor cyber insurance policies contain specific requirements around IT security. If you suffer a cyber attack and your IT systems don’t meet these standards, your claim can be denied.
Common policy requirements:
Multi-factor authentication on all systems
Regular software updates and patches
Encryption of sensitive data
Regular tested backups
Security awareness training for staff
Incident response plan
If you’ve been paying £3,000-£8,000/year for cyber insurance but aren’t compliant with these requirements, your coverage may be worthless when you need it most.
Reputational and Commercial Impact
Beyond regulatory consequences:
Client confidence: Once word spreads that your practice suffered a data breach, clients worry:
“Is my information safe?”
“Should I move to another firm?”
“Can I trust them with sensitive matters?”
Referral relationships: Other solicitors, accountants, and IFAs who refer work to you reconsider:
“I can’t risk my clients with a firm that has security issues”
Professional referral networks close
Recruitment and retention: Good solicitors and staff want to work for professionally run practices:
“If they can’t get IT security right, what else is wrong?”
Difficulty attracting quality team members
Personal Liability for Partners
Directors and partners can face personal consequences:
SRA disciplinary action:
Fines
Conditions on practising certificates
Suspension
Strike off (career ending)
Personal liability:
Data Protection Act criminal offences (up to £5,000 fine, unlimited for directors)
GDPR fines (whilst typically organisational, directors can face prosecution)
Professional negligence claims
Insurance doesn’t always cover these personal liabilities, particularly if deliberate non-compliance is proven.
The Bottom Line
Achieving SRA IT compliance isn’t about ticking boxes, it’s about:
Protecting your clients’ interests (your fundamental duty)
Safeguarding your practice from catastrophic failure
Ensuring business continuity
Maintaining your professional reputation
Meeting your legal and regulatory obligations
Sleeping soundly knowing your systems are secure
The investment in proper IT compliance (typically £5,000-£15,000/year for a small-medium practice) is trivial compared to the cost of getting it wrong (£50,000-£500,000+ plus potential practice closure).
The 10 Essential SRA IT Requirements for Solicitors
Let’s break down the SRA IT requirements for solicitors into 10 specific, actionable areas. Each requirement links directly to SRA obligations and includes practical implementation guidance.
1. Client Confidentiality & Data Protection
SRA Obligation: Code of Conduct Para 6.3, 6.4, 8.1 – Protect client information and maintain confidentiality
What the SRA expects:
Your IT systems must ensure client information remains confidential and is protected from unauthorised access, disclosure, or loss.
Specific requirements:
Encryption of sensitive data:
Client files stored on servers or cloud: Encrypted at rest (AES-256 minimum)
Data in transit: TLS 1.2 or higher for all client data transmission
Laptops and mobile devices: Full disk encryption enabled
USB drives containing client data: Hardware encrypted or BitLocker protected
Technical security controls that protect against current cyber threats, regularly updated to address emerging risks.
Specific requirements:
Firewall protection:
Enterprise-grade firewall (not consumer router)
Configured to block malicious traffic
Regular firmware updates
Logging enabled for security monitoring
Regular rule reviews
Antivirus and anti-malware:
Enterprise endpoint protection on all devices
Real-time scanning enabled
Automatic updates
Centrally managed (not individual installations)
Regular scans scheduled
Multi-factor authentication (MFA):
MFA required for all email access
MFA required for case management systems
MFA required for remote access
MFA required for financial systems
MFA required for administrative accounts
Email security:
Advanced spam filtering
Malware scanning
Phishing protection
Sender verification (SPF, DKIM, DMARC)
Email encryption capability
Patch management:
Operating system updates applied within 30 days
Critical security patches applied within 7 days
Application updates managed
Firmware updates for network devices
Testing process for updates
Vulnerability management:
Regular vulnerability scans
Penetration testing annually (for larger firms)
Remediation of identified vulnerabilities
Third-party security assessments
Implementation checklist:
Enterprise firewall installed and configured
Endpoint protection on all devices
MFA enabled for all systems
Email security advanced protection active
Patch management process documented
Updates applied within required timeframes
Last vulnerability assessment: [Date]
Common failure points:
❌ Consumer-grade router as only firewall
❌ Free antivirus on some machines, none on others
❌ No MFA (“it’s annoying”)
❌ Basic email filtering only
❌ Updates applied “when we remember”
❌ Never conducted security assessment
Cyber Essentials Certification:
Many cyber insurance policies and government contracts require Cyber Essentials certification. This certification demonstrates you meet baseline security standards and aligns closely with SRA expectations.
Communication encryption requirements in contracts
Implementation checklist:
Email encryption system available
Staff trained on when to use encryption
Secure client portal deployed
Video conferencing security configured
Mobile device policy documented
Third-party communication channels secure
Client guidance on secure communications provided
Common failure points:
❌ Sending unencrypted emails with client data
❌ No client portal (relying on email only)
❌ Using personal email accounts
❌ Unsecured video meetings
❌ Staff using personal phones/WhatsApp
❌ No verification of recipient before sending
SRA guidance is clear: Unencrypted email should not be used for highly sensitive information. If you’re emailing unredacted identity documents, financial information, or confidential legal advice, you need encryption or a secure portal.
7. GDPR Compliance for Client Data
SRA Obligation: Data Protection Act 2018, GDPR, SRA Standards (client information protection)
What the SRA expects:
Full compliance with data protection legislation, which overlaps significantly with SRA obligations on protecting client information.
Specific requirements:
Lawful basis for processing:
Document lawful basis for processing client data (typically contract or legitimate interests)
Privacy notices for clients
Consent mechanisms where required
Records of processing activities (ROPA)
Data retention and disposal:
Retention policy documented (typically 7 years+)
Secure disposal when retention expires
Shredding or secure digital deletion
Disposal records maintained
Client requests for deletion handled
Data subject rights:
Process for Subject Access Requests (SAR)
Response within 30 days
Verification of requestor identity
Redaction of third-party information
Exemptions understood (legal professional privilege)
Data Protection Impact Assessments:
DPIA for high-risk processing
New systems assessed for privacy impact
Third-party data sharing reviewed
Cloud service providers assessed
Breach notification:
Data breach detection procedures
Assessment of breach severity
ICO notification within 72 hours (if required)
Client notification (if high risk)
Breach register maintained
Third-party processors:
Data Processing Agreements with all processors
Due diligence on processor security
Regular reviews of processor compliance
Processor breach notification obligations
Data Protection Officer (if required):
Larger practices may need DPO
DPO responsibilities understood
Contact details published
Implementation checklist:
Privacy notice on website and provided to clients
Retention policy documented
SAR process documented and tested
Data Processing Agreements with all suppliers
Breach notification procedure documented
Staff trained on GDPR obligations
Records of Processing Activities maintained
Common failure points:
❌ No privacy notice
❌ Keeping client data indefinitely
❌ No process for SARs
❌ No Data Processing Agreements with IT suppliers
❌ Data breaches not reported
❌ Staff don’t understand GDPR
Important: The ICO (Information Commissioner’s Office) can fine organisations up to £17.5 million or 4% of turnover (whichever is higher) for serious GDPR breaches. Solicitor practices aren’t exempt.
8. Case Management System Security
SRA Obligation: Principle 7 – Effective business management with proper systems
What the SRA expects:
Your practice management software must be secure, reliable, and protect client confidentiality whilst enabling effective case management.
Specific requirements:
System selection:
Legal sector-specific software (not generic CRM)
Hosted by reputable provider OR secure self-hosted
Regular security updates from vendor
Vendor financial stability (won’t disappear)
ISO 27001 or equivalent certification
Access security:
Role-based access within system
Matter-level permissions (Chinese walls)
Audit trails of all access
Cannot disable logging
Regular access reviews
Data protection:
Encryption at rest
Encryption in transit
Backup included in service (if cloud)
UK/EU data storage (GDPR compliance)
Data Processing Agreement with vendor
Integration security:
Secure APIs for integrations
Accounting software integration secure
Document management integration
Email integration secure
Third-party plugin assessment
Business continuity:
Service Level Agreement (SLA) with uptime guarantees
Disaster recovery capabilities
Data export capabilities (not locked in)
Support availability and response times
Financial controls:
SRA Accounts Rules compliance
Client money protection
Reconciliation capabilities
Audit trail of all transactions
Cannot delete or alter historical transactions
Popular systems for UK solicitors:
Practice Evolve
Proclaim
Legal Suite
Osprey Approach
LEAP
ActionStep
(These systems, when properly configured and used within secure infrastructure, can meet SRA requirements)
Implementation checklist:
Case management system from reputable vendor
System configured with role-based access
Audit logging enabled and cannot be disabled
Data Processing Agreement with vendor
Regular backups confirmed
SLA in place with acceptable terms
Financial controls meet Accounts Rules
Staff trained on security features
Common failure points:
❌ Using unsupported legacy software
❌ Everyone has full system access
❌ Audit logs not enabled or not reviewed
❌ No DPA with case management provider
❌ No backups (relying entirely on cloud vendor)
❌ Inadequate financial controls
Cloud vs. On-Premise:
Both can be SRA-compliant when properly implemented:
Cloud (SaaS):
✅ Vendor handles infrastructure security
✅ Automatic updates
✅ Scalability
⚠️ Must verify vendor security (ISO 27001, SOC 2)
⚠️ Data Processing Agreement essential
⚠️ Data location matters (UK/EU preferred)
On-Premise:
✅ Full control over security
✅ Data stays in your premises
⚠️ You’re responsible for all security measures
⚠️ Requires expertise and resources
⚠️ Higher upfront cost
Most small-medium practices choose cloud for cost and simplicity, provided due diligence on vendor security is completed.
9. Mobile Device & Remote Working Security
SRA Obligation: Code of Conduct Para 6.3, 8.1 – Protecting client information regardless of location
What the SRA expects:
Secure remote working arrangements that maintain the same level of client confidentiality protection as office-based work.
❌ Staff working on trains/cafes with sensitive data visible
❌ No policy on home working security
❌ No procedure for lost/stolen devices
COVID-19 legacy:
The pandemic forced rapid remote working adoption. Many practices implemented temporary solutions that became permanent without proper security review. Now is the time to formalise and secure these arrangements.
Whilst not explicitly mandated by the SRA, cyber insurance is increasingly essential for prudent risk management. However, having a policy isn’t enough, you must meet the policy requirements.
Specific requirements:
Policy coverage understanding:
Data breach response costs
Business interruption coverage
Cyber extortion (ransomware)
Forensic investigation costs
Legal fees and client notification
Regulatory fines (where insurable)
Reputational damage mitigation
Policy compliance requirements:
MFA implementation
Regular backups
Security patch management
Security awareness training
Incident response plan
Vendor due diligence
Due diligence at renewal:
Accurate declaration of security measures
Update insurers on changes
Disclose any incidents
Review coverage limits
Understand exclusions
Claims procedures:
Know how to report incidents
Preserve evidence
Follow insurer procedures
Breach coach/legal support
Documentation requirements
Continuous compliance:
Maintain required security measures
Document compliance for claims
Regular security attestations
Don’t let standards slip after purchase
Implementation checklist:
Cyber insurance policy in place
Policy requirements fully understood
All policy requirements currently met
Compliance evidence documented
Claims procedure documented
Key contacts identified
Policy reviewed annually
Coverage adequate for practice size
Common failure points:
❌ No cyber insurance
❌ Policy purchased but requirements not met
❌ Requirements met at purchase but not maintained
❌ Inaccurate declarations at renewal
❌ Inadequate coverage limits
❌ Not understanding what’s covered/excluded
Important: If you suffer a cyber attack and your claim is denied because you didn’t meet policy requirements (e.g., no MFA despite policy requiring it), you’ll face the full financial impact with no insurance support. This can be practice-ending.
Typical cyber insurance costs for solicitors:
5-10 users: £1,500-£3,000/year
11-25 users: £3,000-£6,000/year
26-50 users: £6,000-£12,000/year
(Costs vary significantly based on practice area, claims history, and security measures)
SRA IT Compliance Checklist
Use this comprehensive checklist to audit your practice’s current compliance status. Rate each item as:
70-89% GREEN: Good compliance, address amber/red items within 3 months
50-69% GREEN: Moderate compliance, significant improvement needed within 6 months
Below 50% GREEN: Poor compliance, immediate action required, consider professional help
Any RED items are urgent priorities requiring immediate attention.
Download the Complete Checklist
Get the printable PDF version of this checklist plus detailed remediation guidance for common issues.
Common SRA IT Compliance Mistakes Solicitors Make
Understanding where other practices fail helps you avoid the same pitfalls. These are the most common SRA IT requirements mistakes we see when assessing solicitor practices.
Mistake 1: “We’re Too Small to Be Targeted”
The assumption: “Cyber criminals target large firms, not 5-person practices.”
The reality: Small practices are specifically targeted because:
Easier to breach (less sophisticated security)
Less likely to have cyber insurance
More likely to pay ransoms quickly (can’t afford downtime)
Gateway to larger firms and clients
Handle valuable data (property, financial, commercial)
2025 statistics: 67% of cyber attacks on legal practices targeted firms with fewer than 20 employees.
What to do: Implement the same security standards regardless of size. The SRA makes no exemptions for small practices.
Mistake 2: Relying Solely on Your Case Management Provider’s Security
The assumption: “Our case management system is cloud-based and secure, so we’re compliant.”
The reality: Your case management provider handles their infrastructure security, but you’re responsible for:
User access management
Password policies
MFA implementation
Staff training
Endpoint security (laptops, phones)
Email security
Physical security
Business continuity planning
Your vendor’s security doesn’t absolve your SRA obligations.
What to do: Understand the shared responsibility model. Vendor secures their infrastructure; you secure access, usage, and integration points.
Mistake 3: Using Consumer-Grade IT Products
The assumption: “Microsoft 365 Business Basic is enough for our practice.”
The reality: Consumer and basic business products lack essential security features:
Basic M365: No conditional access, limited security tools
Consumer routers: Inadequate firewall for business use
Personal Dropbox: No enterprise controls or encryption
Free antivirus: Limited protection and no central management
Personal devices: No management or security controls
What to do: Invest in business/enterprise-grade security tools with proper management and monitoring.
Mistake 4: No Testing of Backups or Disaster Recovery
The assumption: “We have backups configured, so we’re protected.”
The reality: Many practices discover their backups don’t work when disaster strikes:
Backup job configured but failing silently for months
Backup files corrupted and unrestorable
Backup encryption key lost
Restore process never tested, doesn’t work under pressure
Backup doesn’t include all critical systems
SRA interventions: Multiple cases where practices couldn’t restore client files after ransomware, leading to intervention.
What to do:
Monthly: Test restore of sample files
Quarterly: Full restore test to alternative location
Annually: Disaster recovery simulation
Document all tests and results
Mistake 5: Everyone Has Admin Rights
The assumption: “It’s easier if everyone can install software and make changes.”
The reality: Giving all users administrator rights:
Allows ransomware to spread system-wide
Enables accidental deletion of critical data
Permits unauthorised software installation
Makes forensic investigation difficult after incidents
Violates principle of least privilege
What to do: Standard users for day-to-day work. Admin rights only for IT staff and specific tasks.
Mistake 6: Unencrypted Email for Client Communications
The assumption: “Email is fine for client communications, everyone uses it.”
The reality: Standard email is not secure:
Transmitted unencrypted across the internet
Readable by email providers and intermediaries
Vulnerable to interception
Doesn’t meet confidentiality obligations for sensitive data
SRA position: Unencrypted email inappropriate for highly confidential information.
Use secure client portals for sensitive document exchange
Train staff on when encryption is required
Client guidance on secure communications
Mistake 7: Former Staff Still Have System Access
The assumption: “We’ll disable their account when we remember.”
The reality: Delayed access removal creates serious risks:
Disgruntled ex-staff accessing confidential data
Accounts compromised after staff leave
Data exfiltration by former employees
Violation of access control requirements
What to do:
Immediate account deactivation (same day as departure)
Automated leaver process with checklist
Regular access audits to catch missed accounts
Alert system for dormant accounts
Mistake 8: No Security Training for Staff
The assumption: “Our staff know not to click suspicious emails.”
The reality: Staff are the weakest link in security:
Phishing attacks increasingly sophisticated
Social engineering targets legal practices
Staff unaware of security policies
Poor password practices common
Physical security breaches (tailgating, etc.)
Statistics: 88% of data breaches involve human error.
What to do:
Mandatory annual security awareness training
Quarterly phishing simulation exercises
Regular security reminders and updates
Incident reporting culture (no blame for honest mistakes)
Role-specific training (accounts staff, IT admins)
Mistake 9: Treating Compliance as One-Time Exercise
The assumption: “We did a security review in 2020, so we’re compliant.”
The reality: IT security requires continuous attention:
New threats emerge constantly
Software requires regular updates
Staff turnover changes access requirements
Business changes affect security needs
Compliance standards evolve
What to do:
Annual comprehensive security review
Quarterly access audits
Monthly backup testing
Continuous monitoring and patching
Regular policy reviews and updates
Mistake 10: No Incident Response Plan
The assumption: “We’ll figure out what to do if something happens.”
The reality: During a cyber attack:
Panic prevents clear thinking
Delayed response worsens impact
Evidence gets destroyed
SRA reporting obligations missed
Costly mistakes made
What to do:
Document incident response plan
Assign clear roles and responsibilities
Include external support contacts (IT, legal, insurers)
Practice with tabletop exercises
Update plan regularly
Technology Standards for Different Practice Areas
Whilst core SRA IT requirements for solicitors apply universally, different practice areas have specific technology considerations.
Conveyancing Practices
Additional IT considerations:
Case management integration:
Land Registry portal integration
Search provider integrations
Lender panel management systems
Anti-money laundering checks
ID verification systems
High-risk transactions:
Wire transfer fraud prevention (APP fraud)
Payment verification procedures
Dual authorisation for payments
Client bank detail verification
Secure communication of account details
Volume and speed:
High transaction volumes
Quick turnarounds required
Automated workflows
Template management
Completion day pressures
Specific security measures:
Payment verification protocols
Client education on APP fraud
Secure channels for bank details
Dual sign-off on account changes
Real-time transaction monitoring
Litigation Practices
Additional IT considerations:
Document volume:
Large disclosure exercises
Document management systems
Version control critical
Privileged document protection
E-discovery capabilities
Deadlines and court requirements:
Court portal access
Electronic filing requirements
Serve document systems
Deadline management
Audit trails for service
Expert and counsel collaboration:
Secure file sharing
External collaboration tools
Privileged communication protection
Large file transfer capabilities
Specific security measures:
Chinese walls between matters
Privilege protection in systems
Disclosure audit trails
Secure external collaboration
Chronology and timeline tools
Family Law
Additional IT considerations:
Highly sensitive information:
Financial disclosures
Domestic abuse documentation
Child welfare concerns
Mental health information
Extra confidentiality requirements
Client vulnerability:
Often emotionally distressed clients
Protection from abusive parties
Secure client communications
Address confidentiality
Court and CAFCASS interaction:
Family court portals
CAFCASS documentation
Financial disclosure systems
Specific security measures:
Enhanced client confidentiality
Restricted access to sensitive files
Secure client communication methods
Address protection measures
Staff training on vulnerability
Corporate/Commercial
Additional IT considerations:
Commercial confidentiality:
M&A transaction security
Due diligence data rooms
Commercial sensitive information
Intellectual property protection
Large transaction values:
High-value deals
International parties
Complex structures
Multiple advisors
Data room management:
Virtual data room services
Access controls and permissions
Audit trails of access
Time-limited access
Specific security measures:
Virtual data room due diligence
Chinese walls for conflicted matters
Deal team access restrictions
Confidentiality ring protocols
International data transfer controls
Private Client
Additional IT considerations:
Wills and probate:
Will storage security
Executor access management
Asset information protection
Lasting Power of Attorney documents
Estate planning:
Tax-sensitive information
Financial planning details
Family circumstances
Long-term document retention
Trusts and tax:
Complex financial structures
HMRC interactions
Long-term client relationships
Multi-generational records
Specific security measures:
Long-term secure document storage
Will register access controls
Succession planning for file access
Extended retention periods
Bereaved client sensitivity
How to Achieve and Maintain SRA IT Compliance
Knowing the requirements is one thing; implementing them systematically is another. Here’s a practical roadmap to achieving SRA IT requirements for solicitors compliance.
Step 1: Conduct a Compliance Gap Analysis
Objective: Understand your current state vs. required state
Process:
Use the compliance checklist (provided earlier in this guide)
Rate each requirement (Green/Amber/Red)
Document specific gaps (what’s missing or inadequate)
Assess risk level (which gaps pose greatest risk)
Estimate remediation effort (time and cost for each item)
Output: Prioritised list of compliance gaps requiring remediation
Time required: 4-8 hours for thorough self-assessment, or engage professional IT security audit (more objective)
Step 2: Create a Remediation Plan
Objective: Structured plan to address all compliance gaps
Approach:
Immediate priorities (0-30 days):
Critical security gaps (no MFA, no backups, etc.)
Active non-compliance with SRA standards
High-risk vulnerabilities
Items required for cyber insurance
Short-term priorities (1-3 months):
Important security improvements
Policy and procedure documentation
Staff training programmes
Access control improvements
Medium-term priorities (3-6 months):
System replacements or upgrades
Advanced security measures
Process improvements
Comprehensive testing
Long-term priorities (6-12 months):
Strategic technology improvements
Advanced capabilities
Continuous improvement initiatives
Document the plan:
Specific actions for each gap
Responsible person assigned
Target completion date
Budget required
Success criteria
Step 3: Implement Priority Fixes
Critical actions that most practices need:
Week 1: Emergency security basics
Enable MFA on all email accounts
Enforce strong password policy
Verify backups are running and tested
Review and disable former staff accounts
Update all critical security patches
Week 2: Documentation essentials 6. Write basic information security policy 7. Document incident response procedure 8. Create user access management process 9. Establish backup testing schedule 10. Document business continuity basics
Week 3: Training and awareness 11. Conduct security awareness training for all staff 12. Distribute security policies 13. Test incident response procedure 14. Run phishing simulation 15. Document training completion
Week 4: Technical improvements 16. Deploy endpoint protection on all devices 17. Configure email encryption 18. Implement secure client portal 19. Set up access logging and monitoring 20. Schedule regular security reviews
Step 4: Document Everything
Why documentation matters:
For SRA compliance:
Demonstrates systematic approach
Evidences governance and oversight
Shows policies communicated to staff
Proves compliance during investigations
For cyber insurance:
Required for policy compliance
Needed for claims
Demonstrates due diligence
For business operations:
Staff know what’s expected
Consistency in procedures
Training reference
Continuity when staff leave
Essential documents:
Information Security Policy (10-15 pages)
Scope and objectives
Roles and responsibilities
Technical security standards
User responsibilities
Incident response
Review process
Acceptable Use Policy (3-5 pages)
Email and internet use
Device usage
Password requirements
Remote working
Prohibited activities
Data Protection and Retention Policy (8-12 pages)
Legal basis for processing
Retention periods
Disposal procedures
Subject rights
Breach response
Business Continuity Plan (15-20 pages)
Risk assessment
Recovery strategies
Contact details
Step-by-step procedures
Test schedule
Incident Response Plan (8-10 pages)
Incident classification
Response team roles
Step-by-step procedures
Communication protocols
SRA reporting obligations
Access Control Policy (5-7 pages)
User provisioning
Access levels
Review procedures
Leavers process
Remote Working Policy (5-7 pages)
Device security requirements
VPN usage
Home environment standards
Public working restrictions
Template documents available: Many legal IT providers offer template policies that can be customised for your practice.
Step 5: Staff Training and Awareness
Why training is critical:
Staff are your first line of defense (and your biggest vulnerability):
Most breaches involve human error
Phishing targets staff, not systems
Policy compliance requires understanding
Security culture starts with awareness
Training programme structure:
New starter induction (Day 1):
Information security overview
Acceptable use policy
Password requirements
Confidentiality obligations
Who to contact for IT issues
Annual mandatory training (All staff):
Current threat landscape
Phishing awareness
Password security
Physical security
Incident reporting
Policy updates
Role-specific training:
Accounts staff: Payment fraud prevention
Fee earners: Client confidentiality
IT admins: Security best practices
Partners: Governance and oversight
Ongoing awareness:
Monthly security tips
Quarterly phishing simulations
Incident lessons learned
News about legal sector breaches
Training documentation:
Attendance records
Quiz/assessment results
Training materials provided
Annual refresh completion
Step 6: Implement Monitoring and Review
Ongoing compliance requires continuous attention:
Monthly activities:
Review backup success/failures
Test restore of sample files
Review access logs for anomalies
Check for system updates
Security incident review
Quarterly activities:
Full restore test
Access rights review and recertification
Security policy review
Phishing simulation
Report to partners/board
Annual activities:
Comprehensive security audit
Risk assessment update
Policy review and update
Penetration testing (larger firms)
Business continuity plan test
Staff training refresh
Cyber insurance renewal review
Assign responsibilities:
Don’t assume “someone” will do it
Named partners/directors responsible
IT team or provider accountable
Regular reporting to management
Step 7: Engage Professional Support
When to get expert help:
Immediate professional help needed if:
✓ Current state is seriously non-compliant (50%+ red on checklist)
✓ You’ve suffered a security incident
✓ SRA has raised concerns
✓ Cyber insurance application rejected due to security
Cost of Non-Compliance vs Investment in Compliance
Understanding the financial implications helps justify proper investment in SRA IT requirements compliance.
The True Cost of Non-Compliance
Direct costs of a serious IT security incident:
SRA intervention:
Intervention agent fees: £50,000-£200,000
Legal costs: £20,000-£100,000
Lost practice value: £100,000-£1,000,000+
Partner personal liability: Variable
Total: £170,000-£1,300,000+
Data breach response:
Forensic investigation: £15,000-£50,000
Legal advice: £10,000-£30,000
Client notification: £5,000-£20,000
Credit monitoring for affected clients: £50-£100 per person
PR/reputation management: £10,000-£50,000
Total: £40,000-£150,000+
Ransomware attack:
Ransom payment (if paid): £5,000-£500,000
Recovery costs: £20,000-£100,000
Lost revenue during downtime: £10,000-£50,000 per week
Data restoration: £15,000-£75,000
System rebuild: £10,000-£50,000
Total: £60,000-£775,000+
ICO fines:
GDPR fines: Up to £17.5M or 4% turnover
Realistic for solicitors: £10,000-£500,000
DPA criminal fines: Up to £5,000 (summary), unlimited (indictment)
Client compensation claims:
Professional indemnity claims: £50,000-£500,000+ per incident
Excess payments: £5,000-£25,000 per claim
Premium increases: 50-200% for 3-5 years
Business impact:
Revenue loss during incident: £5,000-£50,000 per week
Client attrition: 20-40% over following year
Staff departures: Key staff leave
Reputational damage: Difficult to quantify, potentially practice-ending
Total potential cost of serious non-compliance incident: £500,000-£3,000,000+
This doesn’t include the stress, anxiety, sleepless nights, and career impact on partners.
Investment in Compliance
Annual cost of proper IT compliance for solicitor practices:
5-10 person practice:
Managed IT support: £850-£1,100 per user = £5,100-£11,000/year
Cyber Essentials certification: £300-£500/year
Cyber insurance: £1,500-£3,000/year
Security training: £500-£1,000/year
Annual security audit: £1,000-£2,000/year
Total: £8,400-£17,500/year
11-25 person practice:
Managed IT support: £850-£1,100 per user = £11,220-£27,500/year
Cyber Essentials Plus: £1,000-£2,000/year
Cyber insurance: £3,000-£6,000/year
Security training: £1,000-£2,000/year
Annual security audit: £2,000-£3,500/year
Total: £18,220-£41,000/year
26-50 person practice:
Managed IT support: £850-£1,100 per user = £26,520-£55,000/year
ISO 27001 or advanced certification: £3,000-£8,000/year
Cyber insurance: £6,000-£12,000/year
Security training: £2,000-£4,000/year
Penetration testing: £3,000-£8,000/year
Total: £40,520-£87,000/year
Return on Investment Calculation
Example: 15-person litigation practice
Annual compliance investment: £25,000
Risk mitigation value:
Without compliance, 10-year probability:
Serious cyber incident: 60% chance
Average cost: £400,000
Expected cost: £240,000
With compliance:
Serious cyber incident: 5% chance (12x reduction)
Average cost: £100,000 (better response, insurance covers more)
Expected cost: £5,000
10-year comparison:
Without compliance: £240,000 expected incident cost
With compliance: £250,000 investment + £5,000 incident cost = £255,000
Difference: £15,000 more spent BUT…
Additional value of compliance:
✓ Practice continues operating (priceless)
✓ Professional reputation intact
✓ Partners sleep soundly
✓ Cyber insurance actually pays claims
✓ Client confidence maintained
✓ SRA intervention avoided
✓ Business value preserved
The “£15,000 more” buys £1,000,000+ in protection and peace of mind.
Cost Per Transaction Perspective
Putting IT security cost in context:
15-person conveyancing practice:
500 completions per year
IT security cost: £25,000/year
Cost per completion: £50
Question: Would clients happily pay £50 per transaction for proper data protection and security?
Answer: Absolutely. It’s a trivial cost vs. the value and sensitivity of the transaction.
The cost of SRA IT compliance is a small fraction of 1% of most practices’ turnover, it’s a fundamental cost of professional practice, like indemnity insurance.
Choosing SRA-Compliant IT Support for Your Practice
Not all IT support providers understand SRA IT requirements for solicitors. Here’s how to select one that does.
What to Look For
Legal sector experience:
✓ Current solicitor clients (ask for references)
✓ Understanding of SRA standards
✓ Knowledge of legal practice management systems
✓ Experience with law society requirements
✓ Familiarity with conveyancing/litigation-specific needs
Security credentials:
✓ Cyber Essentials certified (minimum)
✓ ISO 27001 (desirable for larger practices)
✓ Microsoft Partner status
✓ Security-focused rather than general IT
✓ Incident response capabilities
Service delivery:
✓ Local presence for on-site support
✓ Defined response times (SLA)
✓ 24/7 emergency support available
✓ Proactive monitoring (not just reactive)
✓ Regular security reviews and reporting
Compliance support:
✓ Help with SRA compliance requirements
✓ Policy and procedure documentation
✓ Staff training provision
✓ Audit support
✓ Incident response planning
Transparent pricing:
✓ Clear, predictable monthly costs
✓ What’s included vs. extra
✓ No hidden fees
✓ Scalable as practice grows
Essential Questions to Ask
About their legal sector experience:
“How many solicitor practices do you currently support?”
Look for: 5+ current solicitor clients
“Can you provide references from practices similar to ours?”
Insist on speaking with actual clients
“What specific SRA requirements do you help practices meet?”
Should demonstrate knowledge of SRA standards
“Which legal practice management systems have you supported?”
Experience with your specific system beneficial
About security and compliance:
“Are you Cyber Essentials certified?”
Minimum credential to look for
“How do you ensure our systems meet SRA IT requirements?”
Should have systematic approach
“What’s your process for security incident response?”
Detailed procedure, not vague promises
“How often do you conduct security reviews?”
Quarterly minimum
About service delivery:
“What are your guaranteed response times?”
4-hour response for critical issues reasonable
“How quickly can you get someone on-site to our office?”
Same-day for local provider
“Is 24/7 emergency support available?”
Essential for serious incidents
“What’s included in your monthly fee vs. what costs extra?”
Transparency critical
About practical support:
“Do you provide staff security training?”
Should offer or facilitate
“Can you help us with SRA compliance documentation?”
You’ve read the guide. You understand the SRA IT requirements for solicitors. Now it’s time to take action.
Your Immediate Next Steps (This Week)
Day 1: Assess Your Current State
Download the compliance checklist (provided earlier)
Block 2 hours in your diary
Complete the self-assessment honestly
Count your Red/Amber/Green scores
Identify your critical gaps
Day 2: Secure Quick Wins
Enable MFA on all email accounts (30 minutes)
Enforce password complexity (15 minutes)
Test your last backup restore (1 hour)
Review user access and disable ex-staff (30 minutes)
Schedule security updates (15 minutes)
Day 3: Documentation Basics
Write basic security policy (2 hours, or use template)
Document incident response procedure (1 hour)
Create leavers checklist (30 minutes)
Start compliance evidence folder
Schedule partner discussion about IT security
Day 4: Training and Awareness
Brief staff on security importance (15 minutes)
Share password requirements
Explain incident reporting process
Schedule formal training session
Send phishing awareness reminder
Day 5: Plan Next Steps
Review your assessment results
Create 90-day action plan
Assign responsibilities
Schedule follow-up reviews
Consider professional support if needed
30-Day Compliance Sprint
Week 1: Critical security
MFA everywhere
Backup testing
Access reviews
Emergency patching
Week 2: Documentation
Security policy
Incident response
Business continuity basics
Retention policy
Week 3: Training
All-staff security awareness
Role-specific training
Phishing simulation
Policy distribution
Week 4: Technical improvements
Endpoint protection
Email encryption
Client portal
Monitoring setup
90-Day Full Compliance Programme
Month 1: Foundation
Complete gap analysis
Implement critical fixes
Essential documentation
Staff training programme
Month 2: Technical improvements
Security tool deployment
System hardening
Integration security
Testing and validation
Month 3: Process and governance
Advanced documentation
Continuous monitoring
Review procedures
Ongoing improvement plan
When to Get Professional Help
DIY is realistic if:
✓ Under 10 staff
✓ Someone has IT knowledge
✓ Modest compliance gaps
✓ Time to invest
✓ Comfortable with technology
Get professional help if:
✓ Over 15 staff
✓ Significant non-compliance
✓ Previous security incident
✓ No internal IT expertise
✓ SRA concerns raised
✓ Complex technology environment
✓ Want it done properly first time
Take Action Now
The SRA is clear: You must protect client information with appropriate systems and controls.
Every day of non-compliance increases your risk.
Every week without proper backups is a gamble with your practice’s future.
Every month without MFA is an open invitation to cyber criminals.
Don’t wait for an incident to force action. Don’t wait for an SRA investigation. Don’t gamble with your professional reputation and your clients’ confidentiality.
Start today.
Conclusion: SRA IT Compliance is Non-Negotiable
SRA IT requirements for solicitors aren’t optional extras or aspirational goals, they’re fundamental professional obligations that protect your clients, your practice, and your career.
The key messages from this guide:
✅ SRA compliance affects every solicitor – Size doesn’t exempt you ✅ IT security is integral to professional obligations – Not separate ✅ Consequences of non-compliance are severe – Practice-ending potential ✅ Compliance is achievable – Systematic approach works ✅ Investment is justified – Tiny vs. cost of failure ✅ Professional help available – Don’t struggle alone
The 10 essential requirements:
Client confidentiality & data protection
Information security management
Cyber security measures
Data backup & business continuity
Access control & user management
Secure communications
GDPR compliance
Case management system security
Mobile device & remote working security
Cyber insurance
Your practice likely has some compliance gaps. Every practice does. The question is: What are you going to do about it?
Get Expert Help with SRA IT Compliance in West Sussex
ATS Connection specialises in IT support for solicitors across West Sussex, helping practices achieve and maintain SRA compliance.
Request your free cyber security audit and find out how safe your business is from cyber related crime. Simply fill in the form and one of our cyber security experts will be in touch.
