Sectors · Legal
Legal
Client confidentiality is the whole business, and law firms are squarely in attackers’ sights for payment diversion and conveyancing fraud.
The pressure
Confidentiality, or nothing.
A firm’s duty of confidentiality is absolute, and the SRA Standards and Regulations expect effective systems and controls over both client information and client money. A serious incident can be reportable to the SRA, and where personal data is involved it may be reportable to the ICO as well, on a short clock.
Payment diversion fraud is the sharpest version of the risk. An attacker sits in a mailbox, waits for a completion date, and sends the client new bank details in a message that reads exactly like the firm’s own. It is a long-standing SRA warning area, and it turns a conveyancing department’s ordinary Friday into a claim. Meanwhile corporate and institutional clients now send detailed security questionnaires, and Cyber Essentials has become a routine procurement and panel requirement.
Challenges we hear
The pressures specific to law firms.
- Protecting client confidentiality and legal privilege across every matter
- Payment diversion and conveyancing fraud aimed at completion funds
- Client supplier-security questionnaires that arrive without warning and expect evidence
- Cyber Essentials, and increasingly ISO 27001, appearing in panel and procurement requirements
- Ransomware that can halt a practice and its practice-management system
- Secure document and matter sharing with clients, counsel and experts
- Continuing to act for clients when systems are down, and proving the plan works
Rules that apply
The obligations and standards in play.
- SRA Standards and Regulations: confidentiality, client money, and effective systems and controls
- UK GDPR, including the 72-hour ICO window where a personal-data breach meets the reporting threshold
- Cyber Essentials and Cyber Essentials Plus, now a routine procurement and panel ask
- ISO 27001, most often requested in client supplier audits rather than by a regulator
- Law Society standards such as Lexcel and the Conveyancing Quality Scheme, where your firm holds them
Related
Where to start
Four steps that answer most client questionnaires.
- Confirm payment and bank-detail changes by phone, on a number already held on file
- Enforce multi-factor authentication for every fee earner, support user and remote login
- Certify to Cyber Essentials, then decide on ISO 27001 from what clients actually ask for
- Keep a standing evidence pack, so a new client questionnaire is a short tailoring job
How we help
Protection and proof, joined up.
- Email security and anti-impersonation controls to stop payment diversion before it reaches a client
- Identity and access hardening across fee earners, support staff and remote working
- ISO 27001 and Cyber Essentials, kept audit-ready rather than rebuilt each year
- A standing evidence pack, so the next client questionnaire is an afternoon rather than a fortnight
- Awareness training tuned to the scams the legal sector actually receives
FAQ
Questions buyers actually ask
- It is not an SRA requirement, but it has become a routine ask in panel appointments, procurement and client supplier questionnaires. Cyber Essentials Plus carries more weight because its controls are independently tested.
- Start with identity: multi-factor authentication on every account, conditional access that checks the device as well as the password, and managed, encrypted laptops. Keep matter documents in managed systems rather than personal email or local folders, and share with counsel, experts and clients through links that expire.
- How you keep acting for clients while systems are down, how you reach clients and counsel through a channel you trust, who decides whether the SRA and the ICO need to be told, and how evidence is preserved. Rehearse it with a short tabletop exercise before you need it.
- At least once a year, and after significant change such as a new practice management system or an office move: a penetration test of internet-facing systems, a phishing simulation for staff, and a test restore of backups. A Cyber Essentials Plus renewal adds an independent technical check each year.
- A serious incident can be reportable to the SRA. Where personal data is involved and the reporting threshold is met, it must also go to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Decide in advance who makes that call, so it is not improvised on the day.
A client asking for ISO 27001?
We’ll help you answer the supplier audit honestly, and put the controls behind the answer.
Book a call