Author: Jake Boase

Every fee earner in the building tries to open a matter file at nine o’clock and nothing loads.

That is the moment most firms discover what their continuity plan is actually worth. Not the document in the compliance folder. The real one, which is whatever happens in the next thirty minutes.

This is a practical guide to what goes wrong, what to do in the first hour, and what needs to be true in advance for a bad morning to stay a bad morning rather than becoming a bad quarter.

Why case management outages hurt more than ordinary IT problems

When email goes down, people are inconvenienced. When case management goes down, the firm stops.

Your practice management system is not one application. It is the diary, the matter files, the time recording, the client ledger, the precedents, the workflow, and increasingly the phone integration and the document store as well. Lose it and you lose the ability to answer a straightforward question from a client about their own matter.

Three things make it worse for a law firm than for most businesses.

Deadlines do not move. A court deadline, a limitation date or a completion date is not sympathetic to an outage. Everything else can wait a day. These cannot.

Money is in flight. Conveyancing and probate teams may be mid-transaction with funds committed. An outage during a completion window is not an IT problem, it is a client problem with a financial consequence attached.

You still have to know what happened. If the outage involves data, the clock on your reporting duties starts when you find out, not when you finish fixing it. A reportable personal data breach must reach the ICO within 72 hours, and a serious breach of the SRA’s Standards and Regulations must be reported under Rule 3.9 of the Code of Conduct. Both of those are far harder to judge when nobody can see the system. We cover the wider picture in our guide to SRA IT requirements for solicitors.

What actually takes these systems down

In our experience the cause is rarely exotic.

The hosting provider has an outage. If your system is vendor-hosted, you are dependent on their infrastructure and their communication. You cannot fix it. What you can control is how quickly you know, and what you do while you wait.

The server or its host has failed. For on-premise systems, this is hardware, storage, or the virtual host underneath. Recovery time depends almost entirely on whether someone has tested restoring it.

The database has become corrupted. Often after an interrupted update or a storage fault. This is the one that catches firms out, because backups may have been faithfully copying a corrupted database for some time.

Connectivity has gone. The system is fine. You cannot reach it. A single broadband line with no failover turns a supplier’s roadworks into your outage.

Ransomware. Less common than the headlines suggest, far more serious when it happens. This is not a restore, it is an incident, and it brings reporting duties with it.

An update went wrong. Applied without a rollback plan, usually at the least convenient moment.

Knowing which of these you are in changes what you do next, which is why the first job is never “fix it”.

The first hour

The order matters. Most firms get this wrong by starting at step four.

1. Establish scope, not cause. Is it one user, one office, or everyone? Can anyone reach the system from outside the building? Is it just case management, or is email affected too? Five minutes here saves an hour of chasing the wrong problem.
2. Decide who is running this. One person, named in advance, who makes the calls and owns communication. Not a committee, and not whoever happens to be least busy.
3. Tell people something. Fee earners will otherwise spend the morning individually rebooting laptops and ringing the same helpdesk. A single message saying what is known, what is not, and when the next update is coming buys you an enormous amount of calm.
4. Now fix it. Or escalate it to whoever can, with the scope information from step one.
5. Start the log. What time it started, what was seen, what was done. If this later turns into a reportable incident, this log is the difference between a defensible account and a guess.
6. Protect the deadlines. Someone should be working out what is due today and this week, independently of the system, while the technical work happens. This is the step most often forgotten and the one clients notice.

Worked example: a Monday morning that stayed manageable

The following is an illustrative scenario rather than a specific client. It is built from the pattern these incidents commonly follow, and the timings reflect what is achievable when the preparation described below is genuinely in place.

08:52. A conveyancing assistant cannot open a matter. She assumes it is her laptop and restarts it.

09:05. Four more people report the same thing. The practice manager, who is the named incident owner, checks whether the system is reachable from her phone on mobile data. It is not. That rules out the office network and points at the system or the host.

09:10. She sends one message to all staff: case management is unavailable, the cause is being investigated, next update at 09:40, do not restart machines. She contacts the IT provider with what she already knows, which means the engineer starts from a position rather than from scratch.

09:15. The IT provider confirms the vendor’s hosted platform is down and it is affecting multiple firms. Nothing can be fixed locally. Focus shifts entirely to working around it.

09:20. The continuity plan is opened. Three things happen at once. The head of conveyancing pulls today’s completions from the exported diary held outside the system. Time recording moves to paper, with a note that it must be entered retrospectively. The reception team is briefed on what to tell clients, in one agreed sentence rather than seven improvised ones.

09:40. Second update to staff, on time. Still down, still no cause, next update at 10:30. Being on time matters more than having news.

11:15. Service is restored by the vendor. The IT provider verifies that the data is intact and that the last transactions before the outage are present, rather than assuming.

11:30. Staff are told they are back, and told specifically what to check and what to re-enter.

Afternoon. The practice manager writes up the log while it is fresh. Because no client data was lost or exposed, no ICO notification is required, but the assessment is documented so the reasoning is recoverable if anyone asks later.

The following week. The firm asks the vendor for a written incident report and reviews two things: whether the diary export should run more frequently than weekly, and whether the reception script was actually good enough.

Two and a half hours down. No missed deadline. No client who felt uninformed.

Now consider the same outage at a firm with no named owner, no exported diary, no agreed message and no log. Same two and a half hours of downtime, an entirely different day.

What has to be true in advance

None of the above is possible to invent on the morning. Six things need to exist beforehand, and they belong in a written plan. If you do not have one yet, our free business continuity plan template walks you through most of them in a few minutes.

A named incident owner, and a deputy. Someone has to decide. If it is not agreed in advance it defaults to whoever is loudest, which is rarely the right person.

A way to reach today’s deadlines without the system. A regular export of the diary and key dates, stored somewhere that does not depend on the system being up. This is unglamorous and it is the single highest value item on this list.

Backups you have actually restored. Not backups that report success. A backup is a theory until someone has restored it. Test restores should happen on a schedule and the results should be written down.

A known recovery time, and a known recovery point. How long it takes to get back, and how much work you lose. Most firms have never asked and are surprised by both answers. If your system is vendor-hosted, these are the vendor’s numbers and you should have them in writing.

A second route to the internet. Failover connectivity is inexpensive relative to a day of lost trading, and it removes an entire category of outage.

An agreed message. One paragraph for staff, one for clients. Written when nobody is panicking.

The question to ask your provider

Whether your system is hosted by the vendor or running on your own server, one question separates a real answer from a comfortable one.

“If our case management system was unavailable at nine tomorrow morning, walk me through exactly what happens, who does what, and when we would expect to be working again.”

If the answer is confident, specific, and includes who calls whom, you are in reasonable shape. If it is a reassurance about the quality of the backups, you have found a gap.

The follow-up is just as useful: “When did we last test that?”

Where ATS fits

ATS supports law firms using both vendor-hosted and on-premise case management systems, including environments built around platforms such as LEAP, Clio and Actionstep. In practice, most of what determines how a bad morning goes is not the case management system itself but the environment around it, and that is where our role usually sits: Microsoft 365, user access, networking and connectivity, security, backups and day-to-day support.

The work that matters here is the boring work. Knowing your recovery time before you need it, testing restores rather than trusting reports, keeping deadlines reachable when the system is not, and having the plan agreed before the morning it is needed.

If you are not confident what would happen at nine tomorrow morning, our free IT and cyber benchmark is a straightforward place to find out. You can also read more about IT support for solicitors and backup and disaster recovery.

Frequently asked questions

What should a law firm do first when the case management system goes down?

Establish scope before cause. Find out whether it affects one user, one office or everyone, and whether the system is reachable from outside the building. Then confirm who is running the incident, send one clear message to staff, and only then begin fixing or escalating. Separately, someone should identify the deadlines falling due today while the technical work happens.

How long should it take to recover a case management system?

It depends entirely on the setup and on whether recovery has been tested. The important thing is that the firm knows its recovery time and recovery point in advance rather than discovering them during an incident. If the system is hosted by the software vendor, those figures should be obtained from the vendor in writing.

Do we have to report a case management outage to the SRA?

Not automatically. An outage alone is not necessarily reportable. A serious breach of the SRA’s Standards and Regulations must be reported under Rule 3.9 of the Code of Conduct, and separately a reportable personal data breach must reach the ICO within 72 hours of the firm becoming aware. Those are two different duties with two different thresholds, which is why keeping a log from the first minute matters.

Is a cloud-hosted case management system safer than an on-premise one?

Neither is inherently safer. Vendor hosting removes hardware failure and usually improves resilience, but it also removes your ability to fix the problem and makes you dependent on the vendor’s communication. On-premise gives you control and makes recovery your responsibility. Both need a tested plan.

How often should backups be tested?

Regularly, and to a schedule with the results recorded. A backup that has never been restored is an assumption. Database corruption in particular can be copied into backups for a long time before anyone notices, which is why a test restore matters more than a successful backup report.

What is the most common cause of legal software downtime?

Rarely anything exotic. Hosting provider outages, server or storage failure, database corruption after an interrupted update, loss of connectivity where there is no failover, and updates applied without a rollback plan. Ransomware is less common than the coverage suggests but far more serious, and brings reporting duties with it.

A solicitor acting on a property sale was deceived into transferring more than £290,000 to fraudsters. Emails between the firm and its client had been intercepted somewhere between exchange and completion. A last-minute request arrived to change the destination bank account, followed by a reconfirmation email. The funds went the next working day.

The bank raised concerns nearly two weeks later. The solicitor reported it to the police and the SRA three months after that. The Solicitors Disciplinary Tribunal found the solicitor “should have known the circumstances were suspicious and worthy of proper investigation to prevent fraud”, and described the failure to insist on additional verification as particularly troubling. The penalty was a £10,000 fine plus £16,000 in costs.

That case is worth sitting with, because nothing exotic happened. No ransomware, no dramatic breach. Someone read the firm’s email and waited for the right moment.

What payment diversion fraud actually is

Payment diversion fraud, still widely known as Friday afternoon fraud, is when criminals impersonate a solicitor or a bank to persuade someone to send money to the wrong account. The Law Society’s guidance is blunt about the mechanism: emails can be intercepted or diverted, and fraudsters frequently work from a compromised mailbox.

The reason it works on conveyancing rather than other legal work is timing. Completion has a fixed date, large sums move on a deadline, and everyone involved is under pressure to get it done before the weekend. A fraudster reading the mailbox knows exactly when to send the account change, because they have been watching the thread.

The part most firms miss

The email account is usually compromised weeks before anything happens. Nobody notices, because the attacker does not send anything or change the password. They read.

The technical signature is almost always the same: once inside a mailbox, the attacker creates inbox rules that quietly move or delete replies containing words like “invoice”, “bank”, “account” or “payment”. That way the genuine client’s confused reply never reaches the fee-earner, and the fraudulent thread carries on undisturbed on both sides.

If nobody is monitoring for new forwarding or inbox rules on your Microsoft 365 tenant, that activity is invisible until the money has gone.

The warning signs in that case

• The request came from an email address that was slightly different from the genuine one
• The bank details changed at the last minute
• Nobody picked up the phone to the client to confirm it
• It landed under time pressure, ahead of a Monday completion

Each of those on its own is survivable. Together they are the pattern, and the pattern repeats.

What actually stops it

Process controls

The Law Society’s advice to clients is the same advice firms should be enforcing internally. Give bank details at the start of the matter, in person or over the phone. Make clear that your details will not change. As the guidance puts it, law firms rarely change their bank details, so any announcement that they have should be treated as suspicious until proven otherwise.

If a change request arrives, verify it by calling a number you already hold, never a number contained in the email asking for the change. Never release funds until you are satisfied. A small test payment first is a reasonable belt-and-braces step on a large transfer.

The single most effective rule is the simplest: bank details are never changed on the basis of an email. Write it into your file-opening letter, tell every client at the outset, and make it a disciplinary matter internally rather than a guideline.

Technical controls

Process fails when people are busy. These reduce the chance a mailbox is readable in the first place, and shorten the time it takes to spot one that is.

• Multi-factor authentication on every account, with no exceptions for partners. Compromise almost always starts with a password.
• Conditional Access policies so a login from an unexpected country or an unmanaged device is challenged or blocked.
• Alerting on new inbox and forwarding rules. This is the one most firms do not have, and it is the control that catches this specific attack.
• Email authentication (SPF, DKIM and DMARC) configured properly, so spoofing your domain is harder. You can check yours with our free DMARC checker.
• Impersonation protection that flags lookalike domains and display-name spoofing, which is what “an email address slightly different from the genuine one” means in practice.
• Audit logging retained and readable, so that if something does happen you can establish what was accessed and whose data was involved.

Most of these are already available in the Microsoft 365 licences firms are paying for. They are simply not switched on.

If it happens anyway

Speed matters more than anything else, and the case above shows what delay costs.

1. Contact the bank immediately and ask them to request that the receiving bank freezes the funds.
2. Report to Report Fraud, which replaced Action Fraud in December 2025.
3. Report to the SRA. A serious breach of the SRA’s Standards and Regulations must be reported under Rule 3.9 of the Code of Conduct.
4. Assess whether personal data was involved. A reportable personal data breach must reach the ICO within 72 hours of you becoming aware of it.
5. Check whether other matters are affected. If a mailbox was compromised, this transaction is unlikely to be the only one the attacker was reading.

That last point is the one firms forget in the panic. The question is not only “how do we recover this payment”, it is “what else did they see”.

ATS Connection provides IT support for solicitors and law firms, including Microsoft 365 hardening and monitoring for the mailbox activity behind this kind of fraud. If you are working out where you stand more broadly, our guide to SRA IT requirements and our explanation of whether the SRA requires Cyber Essentials are the sensible next reads. For the same scam aimed at any business paying suppliers, see our guide to invoice fraud and business email compromise.

Frequently asked questions

What is Friday afternoon fraud?

Friday afternoon fraud is a form of payment diversion fraud targeting conveyancing. Criminals intercept or monitor email between a firm and its client, then send a last-minute request to change the bank account funds should be sent to, timed to land under deadline pressure before a weekend or a Monday completion.

How do fraudsters get into a law firm’s email?

Most commonly through a stolen or guessed password on an account without multi-factor authentication. Once inside, attackers typically read quietly for weeks and create inbox rules that hide replies mentioning payments or bank details, so neither side notices the conversation has been hijacked.

Can a solicitor be fined for falling victim to this?

Yes. In a case reported by the Law Society, a solicitor who transferred more than £290,000 to fraudsters after a last-minute bank change was fined £10,000 with £16,000 in costs. The tribunal found the circumstances were suspicious enough that they warranted proper investigation before the funds moved.

What is the single most effective control?

A firm-wide rule that bank details are never changed on the basis of an email, verified by a phone call to a number already on file rather than one supplied in the message. Technically, multi-factor authentication on every account combined with alerting on new inbox and forwarding rules catches the underlying compromise.

Who do we report payment diversion fraud to?

Contact your bank immediately to try to freeze the funds, report it to Report Fraud (which replaced Action Fraud), report a serious breach to the SRA under Rule 3.9 of the Code of Conduct, and notify the ICO within 72 hours if personal data was involved.

No. The SRA does not require law firms to hold Cyber Essentials certification, and there is no rule that says you must.

What the SRA does require is that you take appropriate steps to protect client data against loss, damage or unauthorised access. That obligation is outcome-based rather than prescriptive: the regulator tells you what must be true, not which certificate to buy. Cyber Essentials is simply the most common way UK firms demonstrate they have met it.

The Law Society recommends Cyber Essentials as one of three routes to demonstrating cyber competence, alongside Lexcel and ISO 27001. It is government-backed and overseen by the National Cyber Security Centre, which is why it carries weight with clients, insurers and panel managers even though no regulator mandates it.

So the honest position is this: not required, widely expected.

What the SRA actually asks of you

Three obligations matter here, and none of them mentions a certificate. We cover these in more detail in our guide to SRA IT requirements for solicitors.

Protect client data. You must take appropriate steps to protect client information against loss, damage or unauthorised access. “Appropriate” scales with your firm. A three-partner practice handling conveyancing is not held to the same technical standard as a 200-fee-earner commercial firm, but both are expected to have thought about it and be able to show their reasoning.

Report serious breaches. A serious breach of the SRA’s Standards and Regulations must be reported to the SRA under Rule 3.9 of the Code of Conduct. Firms sometimes assume this only applies to money. It does not.

Report personal data breaches within 72 hours. Under UK GDPR, a reportable personal data breach must reach the ICO within 72 hours of you first finding out. Seventy-two hours is not long if nobody has agreed in advance who makes that call, who gathers the facts, and who writes the notification.

Where firms get caught out is not usually the technology. It is that nobody can answer “what happened, when, and to whose data” quickly enough to make a decision inside the window.

Where Cyber Essentials fits

Cyber Essentials is a certification against five technical controls. It is deliberately narrow: it does not cover policies, training, or governance. It checks that the basics are actually in place. Our Cyber Essentials certification guide walks through the process in full.

The five controls are:

1. Boundary firewalls and internet gateways. What sits between your network and the internet, and how it is configured.
2. Secure configuration. Devices and software set up deliberately, with defaults changed and anything unnecessary removed.
3. Access control. Who can reach what, administrator rights kept to those who genuinely need them, and accounts removed when people leave.
4. Malware protection. Endpoint protection in place and actually running everywhere, not just on the machines someone remembered.
5. Patch management. Operating systems and applications kept up to date within defined timescales.

None of that is exotic. That is rather the point. Cyber Essentials exists because the majority of successful attacks exploit failures in these five areas rather than anything sophisticated.

Cyber Essentials or Cyber Essentials Plus?

Cyber Essentials is a self-assessment. You complete an online questionnaire, it is reviewed, and you certify. There is no independent testing of your systems.

Cyber Essentials Plus covers the same five controls, but an accredited assessor independently tests your systems to verify the answers.

For most law firms, standard Cyber Essentials is the sensible starting point. Move to Plus when a client, insurer or panel requires it, or when you want assurance that what you believe is in place actually is. Both need renewing annually.

Certification is priced in bands based on organisation size, so a small practice pays considerably less than a large one. We break the current figures down in our guide to Cyber Essentials cost. The larger cost for most firms is not the certificate itself. It is the remediation work needed to pass it.

Why law firms fail their first assessment

Across the practices we take through this, the same handful of issues come up.

Unsupported software still in use. A legacy application that only runs on an old operating system, kept alive because replacing it is disruptive. This fails the assessment outright and is a genuine risk regardless.

Administrator rights handed out too widely. Often historical, often to people who no longer need them, sometimes to accounts belonging to people who have left.

Leavers not fully removed. The Windows account is disabled but the Microsoft 365 licence, the case management login and the shared mailbox access are still live.

Patching that is assumed rather than verified. Nobody can produce evidence that updates are being applied within the required timescales, because nothing is reporting on it.

Personal devices in scope and nobody realised. Fee-earners reading matter email on their own phones brings those devices into scope. If they are not managed, that is a problem for the assessment and for the firm.

Most of these are fixable in weeks rather than months, but they are much easier to fix before you start the assessment than during it.

The insurance angle

Cyber insurance can supplement your professional indemnity cover rather than replace it, and insurers may offer reduced PII premiums where a firm can demonstrate its security measures.

This is worth raising with your broker before renewal rather than after. Firms often discover at renewal that they could have evidenced controls they already had, had anyone asked them for it in time.

What to do next

If you are starting from nothing, the order that works is:

1. Find out what is actually in scope. Devices, cloud services, personal phones with work email, home working setups. Most firms are surprised by the answer.
2. Fix the five controls properly before you fill in any assessment. Certifying a poorly configured environment is a paperwork exercise, not a security improvement.
3. Certify, then treat the annual renewal as a genuine review rather than a form-filling job.
4. Write down who does what if something goes wrong, because the 72-hour clock does not care how good your firewall is. Our guide to what happens when your case management system goes down sets out the first hour in practical terms.

Cyber Essentials will not make your firm secure on its own. What it does is force the basics to be true and give you something defensible to show a client, an insurer or the SRA.

ATS Connection is Cyber Essentials certified and provides IT support for solicitors and law firms, including readiness work and supported Cyber Essentials certification for firms going through it for the first time.

Frequently asked questions

Does the SRA require law firms to have Cyber Essentials?

No. The SRA does not mandate Cyber Essentials. It requires firms to take appropriate steps to protect client data against loss, damage or unauthorised access. Cyber Essentials is one recognised way of demonstrating that, and is recommended by the Law Society alongside Lexcel and ISO 27001.

Is Cyber Essentials worth it for a small law firm?

For most firms, yes. Certification is banded by organisation size so smaller practices pay less, and it forces the five basic technical controls to be genuinely in place rather than assumed. It also gives you something concrete to show clients, panel managers and insurers.

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Cyber Essentials is a self-assessment reviewed by a certification body. Cyber Essentials Plus covers the same five controls but adds independent technical testing by an accredited assessor. Plus is usually driven by a client or insurer requirement.

How long does Cyber Essentials certification last?

Certification is renewed annually. Firms that treat renewal as a genuine review rather than a form-filling exercise tend to find problems before an assessor or an attacker does.

Do we have to report a cyber incident to the SRA?

A serious breach of the SRA’s Standards and Regulations must be reported under Rule 3.9 of the Code of Conduct. Separately, a reportable personal data breach must be notified to the ICO within 72 hours of the firm becoming aware of it. Those are two different duties with two different thresholds.

Will Cyber Essentials reduce our professional indemnity premium?

It may help. Cyber insurance supplements PII rather than replacing it, and insurers may offer reduced premiums where a firm can evidence its security measures. Raise it with your broker before renewal rather than after.