The short answer
Cyber Essentials for law firms is compulsory for criminal legal aid work: the Legal Aid Agency's 2025 Standard Crime Contract, which began on 1 October 2025, requires at least basic Cyber Essentials. For other firms it is not a legal requirement, but Lexcel v6.1 says practices should be accredited against it, and clients and insurers often ask. Certification starts at £320 + VAT.
On this page
- Do law firms need Cyber Essentials?
- What does the Legal Aid Agency require?
- Does Lexcel require Cyber Essentials?
- What does the SRA expect?
- Does Cyber Essentials stop conveyancing fraud?
- How do you scope Cyber Essentials for fee earners working remotely?
- Cyber Essentials for law firms: basic or Plus?
- Is Cyber Essentials enough for law firm insurers?
- What else should cyber security for solicitors cover?
- Why certify with Sovereign Secure?
- Ready to certify?
Cyber Essentials for law firms is compulsory in one case and expected in many others. If you hold a criminal legal aid contract, the Legal Aid Agency (LAA) requires at least basic Cyber Essentials under the 2025 Standard Crime Contract. If you are Lexcel accredited, the standard says you should be certified. For everyone else, the pressure comes from clients, panels and insurers, and from the threat the profession knows best: email fraud aimed at client money. Certification starts at £320 + VAT.
Do law firms need Cyber Essentials?
Only criminal legal aid providers must hold it, but several bodies expect it.
| Source | What it says about Cyber Essentials | Who it affects |
|---|---|---|
| LAA 2025 Standard Crime Contract | Providers must hold a valid basic certificate as a minimum | Criminal legal aid providers in England and Wales |
| Lexcel v6.1 (the Law Society) | Practices should be accredited against Cyber Essentials | Lexcel practices and applicants |
| SRA Code of Conduct for Firms | No certificate required, but firms must manage material risks and keep client affairs confidential | All SRA-regulated firms |
| Central government and NHS contracts (PPN 014) | Required, or equivalent controls, for contracts that handle personal data | Firms advising government departments or NHS bodies |
| Clients, panels and insurers | Security questionnaires that often ask whether you hold Cyber Essentials or Plus | Varies |
For how PPN 014 works, see is Cyber Essentials mandatory?
What does the Legal Aid Agency require?
For crime work, basic Cyber Essentials as a minimum. The LAA’s welcome pack for the 2025 Standard Crime Contract, which runs from 1 October 2025, cites clause 16.19 of the Standard Terms. You present a copy during the LAA’s verification process and to your contract manager on request at each annual review, and the certificate covers the whole organisation and must be renewed every 12 months.
The clause itself goes further:
| Clause 16.19 obligation | What it means in practice |
|---|---|
| Hold and maintain a valid certificate, or an equivalent agreed with the LAA, for the whole contract term | Renew before the expiry date so there is no gap in certification |
| Make sure your Approved Third Parties hold one too | The contract defines these as people doing non-legal work ancillary to the contract, such as experts and translators (not agents or counsel); ask for their certificates |
| Provide a copy at least four weeks before any applicable audit | Send it as part of your audit preparation, not on the day |
| Deliver evidence of renewal on each anniversary of your first certificate | Set your renewal date so the new certificate is issued before that anniversary |
The welcome pack goes further: staff working remotely must use a VPN or secure remote desktop, personal devices are only permitted if they meet Cyber Essentials standards, and all staff need annual training on digital security and phishing awareness. These sit alongside the LAA’s Provider Data Security Requirements (version 5, October 2025).
A draft version 2 of the Standard Terms takes effect on 26 October 2026, so check the current wording on GOV.UK. For civil legal aid, we have not found an equivalent published requirement as of October 2026, so check the current civil contract documents. Free help has also largely gone: the NCSC’s Funded Cyber Essentials Programme supported small legal aid firms and, from February 2025, barristers, but the NCSC’s 2025 annual review described it as in its third and final year.
Does Lexcel require Cyber Essentials?
It recommends it rather than mandating it. Section 3.2 of version 6.1 of the Law Society’s Lexcel practice management standard says practices must have an information management and security policy and should be accredited against Cyber Essentials. A current certificate is the clearest evidence for the technical side. If your next assessment is against a later edition, confirm the wording with your Lexcel assessor.
What does the SRA expect?
The SRA does not require Cyber Essentials, but its Code of Conduct for Firms makes cyber risk a regulatory matter: paragraph 2.5 requires firms to identify, monitor and manage all material risks, and paragraph 6.3 requires you to keep client affairs confidential. An incident that exposes client data can raise reporting questions under paragraphs 3.9 and 3.10, as well as a report to the ICO within 72 hours where people are at risk. Cyber Essentials does not discharge these duties, but it is independent evidence of your baseline controls.
Does Cyber Essentials stop conveyancing fraud?
It reduces the risk but does not stop it alone. The classic attack is business email compromise: criminals take over or spoof an email account and send a client changed bank details before completion. Cyber Essentials makes mailbox takeover much harder; procedures, training and email configuration deal with the fakes.
| Defence | Covered by Cyber Essentials? | Where it comes from |
|---|---|---|
| MFA on Microsoft 365, case management and every other cloud service | Yes, and missing cloud MFA fails the assessment on its own | Cyber Essentials for Microsoft 365 |
| Critical and high-risk updates within 14 days, supported software only | Yes | Certification |
| Malware protection and restricted admin rights | Yes | Certification |
| Calling clients on a known number before acting on new bank details | No | Firm procedure |
| Staff who can spot phishing and payment-diversion emails | No | Training and phishing simulation |
| Email anti-spoofing (SPF, DKIM and DMARC) | No | The NCSC’s email security and anti-spoofing guidance |
How do you scope Cyber Essentials for fee earners working remotely?
Under the NCSC’s current requirements (v3.3), every corporate or personal device used for your business at home is in scope by default:
- Home routers are out of scope unless the firm supplied them, so each laptop needs its software firewall on or a corporate VPN.
- Personal laptops and phones are in scope if they reach firm email, documents or case management. Phones used only for calls, texts or an MFA app are out.
- Cloud services such as case management, document management, e-signature and practice accounts are in scope if they hold client data, and each needs MFA.
- Every legal entity in the certificate must be named under the Danzell question set, so include a service company if it employs staff or owns the IT.
- Accounts the firm owns are in scope even when your IT provider uses them. Agree with your assessor how self-employed consultants’ own devices are treated.
Self-employed barristers are separate businesses, so a chambers certificate does not automatically cover each member’s devices. Decide early whether chambers certifies its shared systems and staff, members certify individually, or both. Our Cyber Essentials scoping questionnaire helps you settle this before you pay.
Cyber Essentials for law firms: basic or Plus?
Basic Cyber Essentials meets the LAA minimum and Lexcel’s wording. Cyber Essentials Plus is the better choice when a client, panel or insurer wants tested evidence rather than a verified self-assessment.
| Aspect | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|
| How it is assessed | Question set answered by the firm, checked by a certification body | The same, plus an assessor’s hands-on tests of a sample of devices and cloud services |
| Meets the LAA crime contract minimum | Yes | Yes |
| Timing | Certificate within days once your answers pass | Audit within three months of the basic certificate |
| Price with us | From £320 + VAT | Quoted on your scope |
Is Cyber Essentials enough for law firm insurers?
It is a good start but rarely the whole answer. Professional indemnity and cyber insurance are separate products, and proposal forms often ask about MFA, patching, backups, training and payment verification. Cyber Essentials evidences the first two; backups are recommended by the NCSC but are not a Cyber Essentials requirement.
Eligible firms also receive IASME’s included Cyber Essentials insurance with a £25,000 limit, which IASME says would be inadequate for a serious incident. We are not an insurer, so speak to a regulated broker about the cover you need.
What else should cyber security for solicitors cover?
Cyber security for law firms goes beyond the certificate, because the attacks firms see most aim at people and client money rather than unpatched machines. The NCSC’s Cyber Threat Report: UK Legal Sector (June 2023) explains the threats practices face, including phishing, ransomware and business email compromise. Once Cyber Essentials is in place, most firms add four things:
| Area | Why it matters for a law firm | Where to start |
|---|---|---|
| Phishing and payment-diversion controls | Completion monies and client account payments are the target, and one changed bank detail can lose a client’s deposit | A call-back rule on known numbers, a standing warning to clients that you never change bank details by email, and phishing simulation to test it |
| Microsoft 365 hardening | Most firms run email and documents in Microsoft 365, where hidden mailbox rules and external forwarding let fraudsters watch a transaction | A Microsoft 365 security assessment of MFA, conditional access, mailbox auditing and forwarding settings |
| Penetration testing | Client portals, remote access and anything else reachable from the internet need a deeper test than the external scan in Cyber Essentials Plus | An external penetration test, plus a web application test of any client portal |
| Staff training | The LAA welcome pack asks for annual digital security and phishing awareness training, and fee earners are the people fraudsters email | Short sessions at least once a year, with simulations in between |
Firms that answer detailed security questionnaires from banks, insurers or corporate clients often move on to ISO 27001 next; our guide to what ISO 27001 is explains how it builds on Cyber Essentials.
Why certify with Sovereign Secure?
- We are the certification body, IASME-licensed, so the team that supports you also certifies you.
- Fast when a deadline is close: Gold submissions are assessed within one working day.
- Help before you submit: a pre-assessment check and a support call in every package.
- More than the certificate: phishing simulation, penetration testing and ISO 27001 consultancy.
- Established in 2012 (Companies House 08334453) and ISO 27001 certified.
Ready to certify?
Start your Cyber Essentials certification with us, or use the form below and choose “First time Cyber Essentials (CE)”. Tell us whether you hold a legal aid contract or Lexcel, and when your contract or assessment date falls. You can also call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
