Cyber Essentials for solicitors and law firms

For criminal legal aid firms it's now a contract requirement. For everyone else, client money and confidential files make law firms a prime target.

The Legal Aid Agency requirement

From 1 October 2025, firms holding or applying for a Criminal Legal Aid contract in England and Wales must hold a valid Cyber Essentials certificate. It came after a serious cyber attack on the Legal Aid Agency's own systems in April 2025.

• It's built into the LAA's Provider Data Security Requirements (version 5, October 2025).
• The same document recommends Cyber Essentials Plus.
• The certificate lasts 12 months, so put the renewal date in the diary. A lapsed certificate puts the contract at risk.

Always check the current LAA contract documents for the exact wording that applies to you.

The bigger risk: payment fraud

Conveyancing and other client-money work is a favourite target for email interception: criminals get into a mailbox, wait for a completion, then send "updated" bank details. Practical defences:

• Multi-factor login on every mailbox.
• Tell clients at the start that your bank details will never change by email, and ask them to call you on a known number before sending money.
• Verify any change of bank details by phone, on both sides of a transaction.
• Watch for unexpected mailbox forwarding rules, which attackers use to stay hidden.

Getting certified

Most small firms use Microsoft 365, a case management system and a handful of laptops, which keeps Cyber Essentials manageable. The usual sticking points are old software, personal phones reading work email, and staff with admin rights.