Managed IT and cyber security for regulated firms in London
Managed IT and cyber security for regulated firms in London
The SRA expects law firms to have effective systems and controls, to keep client information confidential, to protect client money and to report promptly. A cyber attack that has had, or could have, an impact on clients should be reported to the SRA even if it does not amount to a serious breach. Most losses still come from email compromise and payment diversion, so multi-factor authentication, secure email, a strict rule for verifying bank details and well-trained staff do most of the work.
The SRA does not publish a technical cyber security standard. Its rules are outcomes-focused, and several apply directly to cyber risk:
The SRA has also said it expects firms to have business continuity plans, recommends Cyber Essentials and points firms to National Cyber Security Centre (NCSC) guidance.
In its January 2024 update on reporting cybercrime, the SRA set out a simple test:
Reports go through the form on the SRA website or by email with “Cybercrime incident” in the subject. The same incident may also need reporting to the ICO, to Report Fraud and to your insurer. Our incident playbook lists who to tell and when.
Most cyber losses at law firms are not sophisticated hacks. They follow a familiar pattern:
Variations include spoofed look-alike domains, fake emails from the firm to clients, and impersonation of the other side’s solicitor. Conveyancing is the most targeted area because of the sums involved, but probate, litigation settlements and family matters are all at risk.
| Control | Why it matters for a law firm |
|---|---|
| Multi-factor authentication | Stops most mailbox takeovers. Apply it to Microsoft 365, case management, remote access and banking, with phishing-resistant methods for partners and accounts staff. |
| Bank detail verification | A written rule that bank details are only ever confirmed by phone, using a number from the file, never from the email. Tell clients at onboarding that you will never change your bank details by email. |
| Email security | DMARC, SPF and DKIM on your domain, look-alike domain monitoring, external email warnings and alerts when someone creates a mail forwarding rule. |
| Secure client communication | A client portal or encrypted email for documents and payment instructions, so bank details are not sent in ordinary email. |
| Device and access management | Managed, encrypted laptops and phones, leavers removed the same day and access to matters limited to those who need it. |
| Training | Short, regular phishing and payment fraud training for fee earners, secretaries and accounts teams, with real examples. |
| Backup and continuity | Backups of Microsoft 365 and case management kept separately and tested, so ransomware does not stop completions. |
Accreditations such as Lexcel include information security requirements, and Cyber Essentials gives you an independent check of the technical basics. See our IT support for law firms page for how we set this up.
Speed matters more than anything. Call your bank’s fraud line immediately and ask it to contact the receiving bank; funds can sometimes be frozen if you act within hours. Then secure the compromised mailbox (reset the password, revoke sessions, remove forwarding rules), preserve evidence, tell your insurer, report to Report Fraud and consider your duties to the SRA and the ICO. Tell the client honestly and promptly, and record your decisions.