Tag: Security

The short answer: The Cyber Security and Resilience Bill updates the UK’s cyber security law for essential services and, for the first time, brings medium and large managed IT providers into scope. In-scope providers will have to register with the Information Commission, put proportionate security measures in place, report significant incidents within 24 hours and tell affected customers. Most small businesses will not be regulated directly, but the Bill will change what you can expect from your IT provider, and from larger customers you supply. It is not law yet: it has passed the Commons and its Lords Committee stage, and Lords Report stage is scheduled for 26 October 2026.

In this guide:

• What is the Cyber Security and Resilience Bill?
• Where has the Bill got to?
• Who does it apply to?
• Why IT providers are being brought in
• What in-scope IT providers will have to do
• Does it affect my business?
• Eight questions to ask your IT provider
• What to do now
• Frequently asked questions
• Sources

What is the Cyber Security and Resilience Bill?

The Cyber Security and Resilience (Network and Information Systems) Bill reforms the Network and Information Systems Regulations 2018, known as the NIS Regulations. These are the UK’s only cross-sector cyber security law, and they cover essential services such as energy, transport, health, drinking water and digital infrastructure, plus some digital services like cloud computing and online marketplaces. The government describes the 2018 rules as out of date and insufficient.

The Bill has three pillars: widen the scope to cover more of the organisations essential services depend on, give regulators stronger tools, and let the government update the rules quickly as threats change. It also requires more incidents to be reported. The government’s summary of the Bill sets out why:

• Cyber attacks are estimated to cost UK businesses £14.7 billion a year, about 0.5% of GDP.
• Over 40% of UK businesses experienced a cyber attack, equivalent to more than 600,000 organisations.
• The National Cyber Security Centre (NCSC) handled 429 incidents in the year to September 2025, of which 204 were nationally significant, more than double the previous year.

Where has the Bill got to?

The Bill was introduced in the House of Commons in November 2025 and has completed its Commons stages. In the House of Lords it has finished Committee stage, and Report stage is scheduled for 26 October 2026, with Third Reading to follow. The latest version, as amended in Grand Committee, was published on 7 September 2026.

Royal Assent is only the start. A few measures take effect on Royal Assent or two months after, but most of the new duties, including those for managed service providers, critical suppliers and incident reporting, will be switched on later through secondary legislation. The government plans to consult on the detail during 2026 and has said affected organisations will get an adjustment period before new duties apply. We will update this guide as that detail is published.

Who does it apply to?

Who	Covered now (NIS 2018)	Covered under the Bill
Operators of essential services (energy, transport, health, water, digital infrastructure)	Yes	Yes
Some digital services (cloud computing, online marketplaces, search engines)	Yes, medium and large only	Yes, medium and large only
Managed service providers (IT providers)	No	Yes, medium and large
Data centres	No	Yes, above set thresholds
Large load controllers	No	Yes, above set thresholds
Critical suppliers designated by a regulator	No	Yes, of any size

Source: government factsheets on the Bill, updated 30 June 2026.

Why IT providers are being brought in

Managed service providers usually have broad, trusted access to their customers’ systems. That makes them an attractive target: one successful attack on a provider can reach many businesses at once. The government’s factsheet on managed service providers points to an incident in May 2024 involving an MSP that put the personal data of around 270,000 serving military personnel, reservists and veterans at risk. Its 2025 policy statement estimated that this measure would bring a further 900 to 1,100 MSPs into scope.

A provider is in scope if it provides managed services in the UK, meaning the ongoing management of a customer’s IT systems with access to those systems, and is not a small or micro enterprise. The government gives examples:

In scope	Out of scope
An IT company managing a business’s systems, on site or remotely, including backups, monitoring and firewall management	A company that installs IT systems but does not manage them afterwards
An IT security company providing ongoing firewall management and incident response through a connection to the customer’s systems	A software company selling software as a product, including ad hoc remote patch updates
An IT company providing ongoing management of a cloud service, including configuration and monitoring	An accountancy, tax or legal firm advising by email, phone or in person

The small business exemption

Small and micro providers are exempt from the managed service provider duties. The Bill defines size using the EU test in Commission Recommendation 2003/361/EC, the same test the current rules use for digital services:

Size	Staff	Turnover or balance sheet total
Micro	Fewer than 10	Up to €2 million
Small	Fewer than 50	Up to €10 million
Medium	Fewer than 250	Turnover up to €50 million or balance sheet up to €43 million

So many local IT providers, including the smaller firms most small businesses use, will fall outside the managed service provider rules. Two caveats: a provider that is part of a larger group may have to count the whole group, and any provider, however small, can be designated as a critical supplier.

What in-scope IT providers will have to do

• Register with the Information Commission, the body formerly known as the ICO, which will regulate managed service providers.
• Manage risk by taking appropriate and proportionate measures to protect the systems their managed services rely on, and to prevent and limit the impact of incidents.
• Report significant incidents with a short initial notification within 24 hours and a full report within 72 hours, sent to the regulator with the NCSC informed at the same time. (Incident reporting factsheet.)
• Tell affected customers. After reporting, providers will have to identify customers likely to have been affected and notify them with details of the incident.
• Appoint a UK representative if they are based overseas.

Regulators will be able to inspect, issue enforcement notices and fine. Under the Bill, maximum penalties rise to £17 million or 4% of worldwide turnover, whichever is higher, for the more serious breaches, and £10 million or 2% for less serious ones. What counts as a “significant” incident will be set out in secondary legislation after consultation.

Does it affect my business?

If you run a small business that is not an essential service and not an IT, cloud or data centre provider, the Bill is unlikely to regulate you directly. It can still reach you in three ways.

1. Through your IT provider

If your IT provider is medium or large, it will be regulated. You should see clearer incident notifications, more scrutiny of how it secures remote access to your systems, and possibly new contract terms. If your provider is small, the law will not require any of this, but nothing stops you asking for the same standards.

2. If you supply essential services

Regulators will be able to designate a supplier as critical if it directly supplies an operator of essential services, or a regulated digital or managed service provider, relies on IT to do so, and a disruption to it would have a significant impact on the economy or daily life in the UK. Size is no barrier: small and micro businesses can be designated. Designation follows a set process, including consultation, and can be appealed. We expect it to be uncommon, but it is worth knowing about if you supply the NHS, energy, water or transport.

3. Through larger customers

We expect regulated organisations, and the larger businesses that supply them, to look harder at the security of the suppliers they depend on. In practice that means more security questionnaires and more requests for evidence such as Cyber Essentials when you tender for work. Our analysis of government data shows Cyber Essentials uptake is already rising fast, with contracts among the main reasons firms certify.

Eight questions to ask your IT provider

Whether or not your provider is in scope, these questions tell you a lot about how seriously it takes the access it has to your business:

1. Are you in scope of the Cyber Security and Resilience Bill as a managed service provider, and if not, why not?
2. If you have a security incident that could affect us, how quickly will you tell us, and is that written into our contract?
3. How is your remote access to our systems secured? Does every engineer account use multi-factor authentication?
4. Who in your team has administrator access to our systems, and how is that access removed when someone leaves?
5. Do you hold Cyber Essentials, or Cyber Essentials Plus? When was it last renewed?
6. Where are our backups held, how often are they tested, and could an attacker who got into our network delete them?
7. Do you have an incident response plan for your own business, and have you tested it?
8. Which other companies do you rely on to support us, such as remote monitoring tools or cloud platforms, and how do you check their security?

If you are weighing up a change of provider, our guide to how managed service providers work explains what a good one should cover.

What to do now

This Bill does not require small businesses to do anything yet, although existing data protection law already does, including reporting serious personal data breaches. The measures behind the Bill are simply good practice, and most are cheap or free:

• Get the basics certified. Cyber Essentials covers the five controls that stop most common attacks, and it is increasingly what customers ask for.
• Turn on multi-factor authentication for every cloud service and every admin account, including your IT provider’s.
• Check your backups are separate from your main network and that someone has actually tested a restore.
• Write a one-page incident plan: who to call, how to reach your IT provider out of hours, and when to contact your insurer and the Information Commission (formerly the ICO).
• Use the free NCSC tools. The Cyber Action Toolkit gives small businesses a tailored set of actions, and Early Warning is a free NCSC service that alerts you to potential attacks on your network.
• Check your email domain. Our free DMARC checker shows in seconds whether criminals can send email that looks like it came from you.

If you would like a second opinion on where your business stands, our cyber security services team in Arundel and Chichester can review your setup and your current provider’s access. We are Cyber Essentials certified ourselves and have supported businesses since 2015.

Frequently asked questions

Is the Cyber Security and Resilience Bill law yet?

Not yet. It has passed the House of Commons and its Lords Committee stage, and Lords Report stage is scheduled for 26 October 2026, with Third Reading to follow. Even after Royal Assent, most of the new duties, including those for managed service providers, will only start once secondary legislation is made, and the government has said affected organisations will get time to adjust.

Does the Cyber Security and Resilience Bill apply to small businesses?

Most small businesses are not directly regulated. The Bill covers operators of essential services, data centres, large load controllers, and medium and large managed and digital service providers. A small business can still be designated as a critical supplier if it supplies a regulated organisation and a disruption would have a significant impact on the UK.

Which IT providers are covered by the Bill?

Managed service providers that provide ongoing management of IT systems for UK customers, such as remote monitoring, backups or firewall management, unless they are a small or micro enterprise. The Bill uses the EU definition, under which a small enterprise has fewer than 50 staff and turnover or balance sheet of no more than 10 million euros.

How quickly will incidents have to be reported?

In-scope organisations will have to send a short initial notification within 24 hours of becoming aware of a significant incident, and a full report within 72 hours. Managed service providers will also have to identify customers likely to have been affected and tell them.

Who will regulate managed service providers?

The Information Commission, the body formerly known as the ICO. In-scope providers will have to register with it, and it will be able to inspect, enforce and fine.

What are the fines under the Bill?

Up to 17 million pounds or 4% of worldwide turnover, whichever is higher, for the more serious breaches, and up to 10 million pounds or 2% of worldwide turnover for less serious ones. Regulators decide the actual amount within those limits.

Sources

• UK Parliament: Cyber Security and Resilience (Network and Information Systems) Bill, bill page and current version (as amended in Grand Committee, 7 September 2026)
• GOV.UK: Summary of the Bill, factsheet updated 30 June 2026
• GOV.UK: Relevant managed service providers, factsheet updated 30 June 2026
• GOV.UK: Incident reporting, factsheet updated 30 June 2026
• GOV.UK: Enforcement, factsheet updated 30 June 2026
• GOV.UK: Designating critical suppliers
• DSIT: Cyber Security and Resilience Policy Statement, April 2025
• The Network and Information Systems Regulations 2018, regulation 1
• NCSC: Cyber Action Toolkit announcement
• NCSC: Early Warning

This guide explains the Bill as it stood in October 2026. It is general information, not legal advice.

Every fee earner in the building tries to open a matter file at nine o’clock and nothing loads.

That is the moment most firms discover what their continuity plan is actually worth. Not the document in the compliance folder. The real one, which is whatever happens in the next thirty minutes.

This is a practical guide to what goes wrong, what to do in the first hour, and what needs to be true in advance for a bad morning to stay a bad morning rather than becoming a bad quarter.

Why case management outages hurt more than ordinary IT problems

When email goes down, people are inconvenienced. When case management goes down, the firm stops.

Your practice management system is not one application. It is the diary, the matter files, the time recording, the client ledger, the precedents, the workflow, and increasingly the phone integration and the document store as well. Lose it and you lose the ability to answer a straightforward question from a client about their own matter.

Three things make it worse for a law firm than for most businesses.

Deadlines do not move. A court deadline, a limitation date or a completion date is not sympathetic to an outage. Everything else can wait a day. These cannot.

Money is in flight. Conveyancing and probate teams may be mid-transaction with funds committed. An outage during a completion window is not an IT problem, it is a client problem with a financial consequence attached.

You still have to know what happened. If the outage involves data, the clock on your reporting duties starts when you find out, not when you finish fixing it. A reportable personal data breach must reach the ICO within 72 hours, and a serious breach of the SRA’s Standards and Regulations must be reported under Rule 3.9 of the Code of Conduct. Both of those are far harder to judge when nobody can see the system. We cover the wider picture in our guide to SRA IT requirements for solicitors.

What actually takes these systems down

In our experience the cause is rarely exotic.

The hosting provider has an outage. If your system is vendor-hosted, you are dependent on their infrastructure and their communication. You cannot fix it. What you can control is how quickly you know, and what you do while you wait.

The server or its host has failed. For on-premise systems, this is hardware, storage, or the virtual host underneath. Recovery time depends almost entirely on whether someone has tested restoring it.

The database has become corrupted. Often after an interrupted update or a storage fault. This is the one that catches firms out, because backups may have been faithfully copying a corrupted database for some time.

Connectivity has gone. The system is fine. You cannot reach it. A single broadband line with no failover turns a supplier’s roadworks into your outage.

Ransomware. Less common than the headlines suggest, far more serious when it happens. This is not a restore, it is an incident, and it brings reporting duties with it.

An update went wrong. Applied without a rollback plan, usually at the least convenient moment.

Knowing which of these you are in changes what you do next, which is why the first job is never “fix it”.

The first hour

The order matters. Most firms get this wrong by starting at step four.

1. Establish scope, not cause. Is it one user, one office, or everyone? Can anyone reach the system from outside the building? Is it just case management, or is email affected too? Five minutes here saves an hour of chasing the wrong problem.
2. Decide who is running this. One person, named in advance, who makes the calls and owns communication. Not a committee, and not whoever happens to be least busy.
3. Tell people something. Fee earners will otherwise spend the morning individually rebooting laptops and ringing the same helpdesk. A single message saying what is known, what is not, and when the next update is coming buys you an enormous amount of calm.
4. Now fix it. Or escalate it to whoever can, with the scope information from step one.
5. Start the log. What time it started, what was seen, what was done. If this later turns into a reportable incident, this log is the difference between a defensible account and a guess.
6. Protect the deadlines. Someone should be working out what is due today and this week, independently of the system, while the technical work happens. This is the step most often forgotten and the one clients notice.

Worked example: a Monday morning that stayed manageable

The following is an illustrative scenario rather than a specific client. It is built from the pattern these incidents commonly follow, and the timings reflect what is achievable when the preparation described below is genuinely in place.

08:52. A conveyancing assistant cannot open a matter. She assumes it is her laptop and restarts it.

09:05. Four more people report the same thing. The practice manager, who is the named incident owner, checks whether the system is reachable from her phone on mobile data. It is not. That rules out the office network and points at the system or the host.

09:10. She sends one message to all staff: case management is unavailable, the cause is being investigated, next update at 09:40, do not restart machines. She contacts the IT provider with what she already knows, which means the engineer starts from a position rather than from scratch.

09:15. The IT provider confirms the vendor’s hosted platform is down and it is affecting multiple firms. Nothing can be fixed locally. Focus shifts entirely to working around it.

09:20. The continuity plan is opened. Three things happen at once. The head of conveyancing pulls today’s completions from the exported diary held outside the system. Time recording moves to paper, with a note that it must be entered retrospectively. The reception team is briefed on what to tell clients, in one agreed sentence rather than seven improvised ones.

09:40. Second update to staff, on time. Still down, still no cause, next update at 10:30. Being on time matters more than having news.

11:15. Service is restored by the vendor. The IT provider verifies that the data is intact and that the last transactions before the outage are present, rather than assuming.

11:30. Staff are told they are back, and told specifically what to check and what to re-enter.

Afternoon. The practice manager writes up the log while it is fresh. Because no client data was lost or exposed, no ICO notification is required, but the assessment is documented so the reasoning is recoverable if anyone asks later.

The following week. The firm asks the vendor for a written incident report and reviews two things: whether the diary export should run more frequently than weekly, and whether the reception script was actually good enough.

Two and a half hours down. No missed deadline. No client who felt uninformed.

Now consider the same outage at a firm with no named owner, no exported diary, no agreed message and no log. Same two and a half hours of downtime, an entirely different day.

What has to be true in advance

None of the above is possible to invent on the morning. Six things need to exist beforehand, and they belong in a written plan. If you do not have one yet, our free business continuity plan template walks you through most of them in a few minutes.

A named incident owner, and a deputy. Someone has to decide. If it is not agreed in advance it defaults to whoever is loudest, which is rarely the right person.

A way to reach today’s deadlines without the system. A regular export of the diary and key dates, stored somewhere that does not depend on the system being up. This is unglamorous and it is the single highest value item on this list.

Backups you have actually restored. Not backups that report success. A backup is a theory until someone has restored it. Test restores should happen on a schedule and the results should be written down.

A known recovery time, and a known recovery point. How long it takes to get back, and how much work you lose. Most firms have never asked and are surprised by both answers. If your system is vendor-hosted, these are the vendor’s numbers and you should have them in writing.

A second route to the internet. Failover connectivity is inexpensive relative to a day of lost trading, and it removes an entire category of outage.

An agreed message. One paragraph for staff, one for clients. Written when nobody is panicking.

The question to ask your provider

Whether your system is hosted by the vendor or running on your own server, one question separates a real answer from a comfortable one.

“If our case management system was unavailable at nine tomorrow morning, walk me through exactly what happens, who does what, and when we would expect to be working again.”

If the answer is confident, specific, and includes who calls whom, you are in reasonable shape. If it is a reassurance about the quality of the backups, you have found a gap.

The follow-up is just as useful: “When did we last test that?”

Where ATS fits

ATS supports law firms using both vendor-hosted and on-premise case management systems, including environments built around platforms such as LEAP, Clio and Actionstep. In practice, most of what determines how a bad morning goes is not the case management system itself but the environment around it, and that is where our role usually sits: Microsoft 365, user access, networking and connectivity, security, backups and day-to-day support.

The work that matters here is the boring work. Knowing your recovery time before you need it, testing restores rather than trusting reports, keeping deadlines reachable when the system is not, and having the plan agreed before the morning it is needed.

If you are not confident what would happen at nine tomorrow morning, our free IT and cyber benchmark is a straightforward place to find out. You can also read more about IT support for solicitors and backup and disaster recovery.

Frequently asked questions

What should a law firm do first when the case management system goes down?

Establish scope before cause. Find out whether it affects one user, one office or everyone, and whether the system is reachable from outside the building. Then confirm who is running the incident, send one clear message to staff, and only then begin fixing or escalating. Separately, someone should identify the deadlines falling due today while the technical work happens.

How long should it take to recover a case management system?

It depends entirely on the setup and on whether recovery has been tested. The important thing is that the firm knows its recovery time and recovery point in advance rather than discovering them during an incident. If the system is hosted by the software vendor, those figures should be obtained from the vendor in writing.

Do we have to report a case management outage to the SRA?

Not automatically. An outage alone is not necessarily reportable. A serious breach of the SRA’s Standards and Regulations must be reported under Rule 3.9 of the Code of Conduct, and separately a reportable personal data breach must reach the ICO within 72 hours of the firm becoming aware. Those are two different duties with two different thresholds, which is why keeping a log from the first minute matters.

Is a cloud-hosted case management system safer than an on-premise one?

Neither is inherently safer. Vendor hosting removes hardware failure and usually improves resilience, but it also removes your ability to fix the problem and makes you dependent on the vendor’s communication. On-premise gives you control and makes recovery your responsibility. Both need a tested plan.

How often should backups be tested?

Regularly, and to a schedule with the results recorded. A backup that has never been restored is an assumption. Database corruption in particular can be copied into backups for a long time before anyone notices, which is why a test restore matters more than a successful backup report.

What is the most common cause of legal software downtime?

Rarely anything exotic. Hosting provider outages, server or storage failure, database corruption after an interrupted update, loss of connectivity where there is no failover, and updates applied without a rollback plan. Ransomware is less common than the coverage suggests but far more serious, and brings reporting duties with it.

A solicitor acting on a property sale was deceived into transferring more than £290,000 to fraudsters. Emails between the firm and its client had been intercepted somewhere between exchange and completion. A last-minute request arrived to change the destination bank account, followed by a reconfirmation email. The funds went the next working day.

The bank raised concerns nearly two weeks later. The solicitor reported it to the police and the SRA three months after that. The Solicitors Disciplinary Tribunal found the solicitor “should have known the circumstances were suspicious and worthy of proper investigation to prevent fraud”, and described the failure to insist on additional verification as particularly troubling. The penalty was a £10,000 fine plus £16,000 in costs.

That case is worth sitting with, because nothing exotic happened. No ransomware, no dramatic breach. Someone read the firm’s email and waited for the right moment.

What payment diversion fraud actually is

Payment diversion fraud, still widely known as Friday afternoon fraud, is when criminals impersonate a solicitor or a bank to persuade someone to send money to the wrong account. The Law Society’s guidance is blunt about the mechanism: emails can be intercepted or diverted, and fraudsters frequently work from a compromised mailbox.

The reason it works on conveyancing rather than other legal work is timing. Completion has a fixed date, large sums move on a deadline, and everyone involved is under pressure to get it done before the weekend. A fraudster reading the mailbox knows exactly when to send the account change, because they have been watching the thread.

The part most firms miss

The email account is usually compromised weeks before anything happens. Nobody notices, because the attacker does not send anything or change the password. They read.

The technical signature is almost always the same: once inside a mailbox, the attacker creates inbox rules that quietly move or delete replies containing words like “invoice”, “bank”, “account” or “payment”. That way the genuine client’s confused reply never reaches the fee-earner, and the fraudulent thread carries on undisturbed on both sides.

If nobody is monitoring for new forwarding or inbox rules on your Microsoft 365 tenant, that activity is invisible until the money has gone.

The warning signs in that case

• The request came from an email address that was slightly different from the genuine one
• The bank details changed at the last minute
• Nobody picked up the phone to the client to confirm it
• It landed under time pressure, ahead of a Monday completion

Each of those on its own is survivable. Together they are the pattern, and the pattern repeats.

What actually stops it

Process controls

The Law Society’s advice to clients is the same advice firms should be enforcing internally. Give bank details at the start of the matter, in person or over the phone. Make clear that your details will not change. As the guidance puts it, law firms rarely change their bank details, so any announcement that they have should be treated as suspicious until proven otherwise.

If a change request arrives, verify it by calling a number you already hold, never a number contained in the email asking for the change. Never release funds until you are satisfied. A small test payment first is a reasonable belt-and-braces step on a large transfer.

The single most effective rule is the simplest: bank details are never changed on the basis of an email. Write it into your file-opening letter, tell every client at the outset, and make it a disciplinary matter internally rather than a guideline.

Technical controls

Process fails when people are busy. These reduce the chance a mailbox is readable in the first place, and shorten the time it takes to spot one that is.

• Multi-factor authentication on every account, with no exceptions for partners. Compromise almost always starts with a password.
• Conditional Access policies so a login from an unexpected country or an unmanaged device is challenged or blocked.
• Alerting on new inbox and forwarding rules. This is the one most firms do not have, and it is the control that catches this specific attack.
• Email authentication (SPF, DKIM and DMARC) configured properly, so spoofing your domain is harder. You can check yours with our free DMARC checker.
• Impersonation protection that flags lookalike domains and display-name spoofing, which is what “an email address slightly different from the genuine one” means in practice.
• Audit logging retained and readable, so that if something does happen you can establish what was accessed and whose data was involved.

Most of these are already available in the Microsoft 365 licences firms are paying for. They are simply not switched on.

If it happens anyway

Speed matters more than anything else, and the case above shows what delay costs.

1. Contact the bank immediately and ask them to request that the receiving bank freezes the funds.
2. Report to Report Fraud, which replaced Action Fraud in December 2025.
3. Report to the SRA. A serious breach of the SRA’s Standards and Regulations must be reported under Rule 3.9 of the Code of Conduct.
4. Assess whether personal data was involved. A reportable personal data breach must reach the ICO within 72 hours of you becoming aware of it.
5. Check whether other matters are affected. If a mailbox was compromised, this transaction is unlikely to be the only one the attacker was reading.

That last point is the one firms forget in the panic. The question is not only “how do we recover this payment”, it is “what else did they see”.

ATS Connection provides IT support for solicitors and law firms, including Microsoft 365 hardening and monitoring for the mailbox activity behind this kind of fraud. If you are working out where you stand more broadly, our guide to SRA IT requirements and our explanation of whether the SRA requires Cyber Essentials are the sensible next reads. For the same scam aimed at any business paying suppliers, see our guide to invoice fraud and business email compromise.

Frequently asked questions

What is Friday afternoon fraud?

Friday afternoon fraud is a form of payment diversion fraud targeting conveyancing. Criminals intercept or monitor email between a firm and its client, then send a last-minute request to change the bank account funds should be sent to, timed to land under deadline pressure before a weekend or a Monday completion.

How do fraudsters get into a law firm’s email?

Most commonly through a stolen or guessed password on an account without multi-factor authentication. Once inside, attackers typically read quietly for weeks and create inbox rules that hide replies mentioning payments or bank details, so neither side notices the conversation has been hijacked.

Can a solicitor be fined for falling victim to this?

Yes. In a case reported by the Law Society, a solicitor who transferred more than £290,000 to fraudsters after a last-minute bank change was fined £10,000 with £16,000 in costs. The tribunal found the circumstances were suspicious enough that they warranted proper investigation before the funds moved.

What is the single most effective control?

A firm-wide rule that bank details are never changed on the basis of an email, verified by a phone call to a number already on file rather than one supplied in the message. Technically, multi-factor authentication on every account combined with alerting on new inbox and forwarding rules catches the underlying compromise.

Who do we report payment diversion fraud to?

Contact your bank immediately to try to freeze the funds, report it to Report Fraud (which replaced Action Fraud), report a serious breach to the SRA under Rule 3.9 of the Code of Conduct, and notify the ICO within 72 hours if personal data was involved.

No. The SRA does not require law firms to hold Cyber Essentials certification, and there is no rule that says you must.

What the SRA does require is that you take appropriate steps to protect client data against loss, damage or unauthorised access. That obligation is outcome-based rather than prescriptive: the regulator tells you what must be true, not which certificate to buy. Cyber Essentials is simply the most common way UK firms demonstrate they have met it.

The Law Society recommends Cyber Essentials as one of three routes to demonstrating cyber competence, alongside Lexcel and ISO 27001. It is government-backed and overseen by the National Cyber Security Centre, which is why it carries weight with clients, insurers and panel managers even though no regulator mandates it.

So the honest position is this: not required, widely expected.

What the SRA actually asks of you

Three obligations matter here, and none of them mentions a certificate. We cover these in more detail in our guide to SRA IT requirements for solicitors.

Protect client data. You must take appropriate steps to protect client information against loss, damage or unauthorised access. “Appropriate” scales with your firm. A three-partner practice handling conveyancing is not held to the same technical standard as a 200-fee-earner commercial firm, but both are expected to have thought about it and be able to show their reasoning.

Report serious breaches. A serious breach of the SRA’s Standards and Regulations must be reported to the SRA under Rule 3.9 of the Code of Conduct. Firms sometimes assume this only applies to money. It does not.

Report personal data breaches within 72 hours. Under UK GDPR, a reportable personal data breach must reach the ICO within 72 hours of you first finding out. Seventy-two hours is not long if nobody has agreed in advance who makes that call, who gathers the facts, and who writes the notification.

Where firms get caught out is not usually the technology. It is that nobody can answer “what happened, when, and to whose data” quickly enough to make a decision inside the window.

Where Cyber Essentials fits

Cyber Essentials is a certification against five technical controls. It is deliberately narrow: it does not cover policies, training, or governance. It checks that the basics are actually in place. Our Cyber Essentials certification guide walks through the process in full.

The five controls are:

1. Boundary firewalls and internet gateways. What sits between your network and the internet, and how it is configured.
2. Secure configuration. Devices and software set up deliberately, with defaults changed and anything unnecessary removed.
3. Access control. Who can reach what, administrator rights kept to those who genuinely need them, and accounts removed when people leave.
4. Malware protection. Endpoint protection in place and actually running everywhere, not just on the machines someone remembered.
5. Patch management. Operating systems and applications kept up to date within defined timescales.

None of that is exotic. That is rather the point. Cyber Essentials exists because the majority of successful attacks exploit failures in these five areas rather than anything sophisticated.

Cyber Essentials or Cyber Essentials Plus?

Cyber Essentials is a self-assessment. You complete an online questionnaire, it is reviewed, and you certify. There is no independent testing of your systems.

Cyber Essentials Plus covers the same five controls, but an accredited assessor independently tests your systems to verify the answers.

For most law firms, standard Cyber Essentials is the sensible starting point. Move to Plus when a client, insurer or panel requires it, or when you want assurance that what you believe is in place actually is. Both need renewing annually.

Certification is priced in bands based on organisation size, so a small practice pays considerably less than a large one. We break the current figures down in our guide to Cyber Essentials cost. The larger cost for most firms is not the certificate itself. It is the remediation work needed to pass it.

Why law firms fail their first assessment

Across the practices we take through this, the same handful of issues come up.

Unsupported software still in use. A legacy application that only runs on an old operating system, kept alive because replacing it is disruptive. This fails the assessment outright and is a genuine risk regardless.

Administrator rights handed out too widely. Often historical, often to people who no longer need them, sometimes to accounts belonging to people who have left.

Leavers not fully removed. The Windows account is disabled but the Microsoft 365 licence, the case management login and the shared mailbox access are still live.

Patching that is assumed rather than verified. Nobody can produce evidence that updates are being applied within the required timescales, because nothing is reporting on it.

Personal devices in scope and nobody realised. Fee-earners reading matter email on their own phones brings those devices into scope. If they are not managed, that is a problem for the assessment and for the firm.

Most of these are fixable in weeks rather than months, but they are much easier to fix before you start the assessment than during it.

The insurance angle

Cyber insurance can supplement your professional indemnity cover rather than replace it, and insurers may offer reduced PII premiums where a firm can demonstrate its security measures.

This is worth raising with your broker before renewal rather than after. Firms often discover at renewal that they could have evidenced controls they already had, had anyone asked them for it in time.

What to do next

If you are starting from nothing, the order that works is:

1. Find out what is actually in scope. Devices, cloud services, personal phones with work email, home working setups. Most firms are surprised by the answer.
2. Fix the five controls properly before you fill in any assessment. Certifying a poorly configured environment is a paperwork exercise, not a security improvement.
3. Certify, then treat the annual renewal as a genuine review rather than a form-filling job.
4. Write down who does what if something goes wrong, because the 72-hour clock does not care how good your firewall is. Our guide to what happens when your case management system goes down sets out the first hour in practical terms.

Cyber Essentials will not make your firm secure on its own. What it does is force the basics to be true and give you something defensible to show a client, an insurer or the SRA.

ATS Connection is Cyber Essentials certified and provides IT support for solicitors and law firms, including readiness work and supported Cyber Essentials certification for firms going through it for the first time.

Frequently asked questions

Does the SRA require law firms to have Cyber Essentials?

No. The SRA does not mandate Cyber Essentials. It requires firms to take appropriate steps to protect client data against loss, damage or unauthorised access. Cyber Essentials is one recognised way of demonstrating that, and is recommended by the Law Society alongside Lexcel and ISO 27001.

Is Cyber Essentials worth it for a small law firm?

For most firms, yes. Certification is banded by organisation size so smaller practices pay less, and it forces the five basic technical controls to be genuinely in place rather than assumed. It also gives you something concrete to show clients, panel managers and insurers.

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Cyber Essentials is a self-assessment reviewed by a certification body. Cyber Essentials Plus covers the same five controls but adds independent technical testing by an accredited assessor. Plus is usually driven by a client or insurer requirement.

How long does Cyber Essentials certification last?

Certification is renewed annually. Firms that treat renewal as a genuine review rather than a form-filling exercise tend to find problems before an assessor or an attacker does.

Do we have to report a cyber incident to the SRA?

A serious breach of the SRA’s Standards and Regulations must be reported under Rule 3.9 of the Code of Conduct. Separately, a reportable personal data breach must be notified to the ICO within 72 hours of the firm becoming aware of it. Those are two different duties with two different thresholds.

Will Cyber Essentials reduce our professional indemnity premium?

It may help. Cyber insurance supplements PII rather than replacing it, and insurers may offer reduced premiums where a firm can evidence its security measures. Raise it with your broker before renewal rather than after.