Question 1

What are the SRA's current cyber security requirements for law firms?

Accepted Answer

The SRA expects law firms to have proportionate measures in place to protect client money, client data and the integrity of legal processes. This includes documented cyber risk assessments, access controls, staff training, incident response plans and evidence of regular review. The SRA's 2023 cyber security thematic review found that many firms lacked basic documented controls — and the bar has risen since.

Question 2

Does my law firm need cyber insurance?

Accepted Answer

Cyber insurance is not mandated by the SRA, but your PI insurer may require evidence of adequate cyber controls as a condition of coverage, and standalone cyber policies are increasingly expected as part of a firm's risk management framework. More importantly, without adequate controls your existing PI policy may not respond to a cyber-related claim.

Question 3

What voids a cyber insurance claim for a law firm?

Accepted Answer

The most common grounds for claim denial or reduction include: failure to apply security patches within a reasonable timeframe, use of unsupported software, absence of multi-factor authentication on remote access and email, inadequate backup and recovery procedures, and failure to disclose a known vulnerability at policy inception. Technical warranties in your policy are enforceable — they are not advisory.

Question 4

What is a technical warranty in a cyber insurance policy?

Accepted Answer

A technical warranty is a contractual commitment made to your insurer at inception that specific controls are in place — for example, that MFA is enabled on all external-facing systems, or that endpoints are running current antivirus. If a claim arises and the warranted control was not in place at the time of the incident, the insurer is entitled to void that element of the claim. Many firms sign these warranties without verifying whether their infrastructure actually meets them.

Question 5

How does the SRA expect a law firm to respond to a data breach?

Accepted Answer

Where personal data is involved, firms must notify the ICO within 72 hours of becoming aware of a breach if it poses a risk to individuals. The SRA expects firms to have documented incident response procedures and to notify affected clients where appropriate. Firms should also consider whether the breach triggers obligations under their PI policy, cyber policy or both.

Question 6

What infrastructure controls reduce PII exposure risk for a law firm?

Accepted Answer

Key controls include role-based access so staff can only access the client data relevant to their matter, encryption at rest and in transit for all client files, monitored and logged access to case management systems, regular privilege reviews, and secure decommissioning of devices containing client data. These controls also directly support SRA Principle 7 (acting in clients' best interests) and your GDPR obligations.

Question 7

How often should a law firm conduct a cyber risk assessment?

Accepted Answer

Best practice and most insurer expectations require a formal review at least annually and whenever there is a material change — a new cloud system, a merger, significant headcount growth or a change in working pattern such as hybrid working. The SRA expects proportionate ongoing attention, not a one-time exercise.

Question 8

What is the SRA's position on cloud-hosted case management systems?

Accepted Answer

The SRA does not prohibit cloud-hosted case management, but firms remain responsible for ensuring client data is adequately protected regardless of where it is hosted. This means conducting due diligence on the supplier's security posture, ensuring data residency is in the UK or an adequate jurisdiction, and maintaining the ability to retrieve and migrate client data if the supplier fails.

Question 9

Does client money held by a firm require specific cyber controls?

Accepted Answer

Yes. Client account integrity is an SRA Accounts Rules obligation. Cyber controls specifically relevant to client money include: segregated access to financial systems, dual authorisation for significant transfers, monitoring for unusual payment patterns, and ensuring your bank's fraud controls are compatible with your working practices. A cyber incident that results in misdirected client funds is a Accounts Rules breach as well as a cyber incident.

Question 10

What happens if a law firm fails an SRA cyber review?

Accepted Answer

The SRA's approach is proportionate but escalating. Initial findings typically result in a requirement to produce a remediation plan and evidence of improvement within a defined timeframe. Persistent failures or incidents caused by inadequate controls can result in regulatory action, fines, conditions on practising certificates, or referral to the Solicitors Disciplinary Tribunal in serious cases.

Your firm’s compliance
is now a technology obligation.

Regulatory Standing

Insurance Validity

Practice Continuity

Understand the Compliance Landscape

SRA Technical Warranty Gap

Cyber Insurance Integrity Audit

2025 UK Cyber Attack Review

Is your practice
actually protected?

Your firm’s complianceis now a technology obligation.