Cyber Essentials and Microsoft 365 for law firms
Your regulator's duties, the Legal Aid Agency's Cyber Essentials requirement from October 2025, and email fraud against client money.
The rules, and where they come from
Law firms hold client money and confidential files, and over 80 percent of the cybercrime reported to the Solicitors Regulation Authority (SRA) in 2021 involved email (SRA Risk Outlook, 1 June 2022). The SRA requires firms to manage their material risks and protect client money and confidential information. The Law Society recommends cyber certification such as Cyber Essentials. Firms on Legal Aid Agency contracts that came into force from 1 October 2025, including the 2025 crime contract, must hold Cyber Essentials.
| What | Status | Source |
|---|---|---|
| "Identify, monitor and manage all material risks to your business" | Required for all SRA-regulated firms | SRA Code of Conduct for Firms, 2.5 |
| Keep clients' affairs confidential; safeguard money and assets entrusted to you | Required | SRA Code for Firms, 6.3 and 5.2 |
| Replace client money "improperly withdrawn" from client account "immediately" | Required for firms holding client money | SRA Accounts Rules, rule 6.1 |
| Cyber Essentials (or an equivalent standard), for the life of the contract | Required on LAA contracts coming into force on or after 1 October 2025 | LAA Data Security Requirements v5 |
| Cyber Essentials Plus | Recommended on the same LAA contracts | LAA Data Security Requirements v5 |
| Cyber certification: Cyber Essentials, Lexcel or ISO 27001 | Recommended for all firms | Law Society guidance, 20 May 2026 |
| Report a personal data breach to the ICO within 72 hours, where feasible, unless unlikely to risk people's rights | Required by law | UK GDPR Article 33 |
We found no SRA rule that names Cyber Essentials for firms outside legal aid. The duty is the outcome: manage the risk, keep client information confidential and protect client money.
The SRA's cyber security review found that email modification fraud was "the most common type of cyber incident reported to the SRA, accounting for 68 percent of all reports" it received, with conveyancing the most common target (SRA, 23 November 2020). In that review, over £4 million in client money had been stolen from 23 of the 40 firms the SRA visited, and the Accounts Rules then require the firm to replace improperly withdrawn client money immediately. The Law Society also notes that many cyber insurers have "minimum standards", such as multi-factor authentication, regular backups and an incident response plan (Law Society, 19 September 2025).
How we deliver it
Many of the controls against email takeover sit inside Microsoft 365. We set them and keep them set:
- MFA for everyone, with conditional access where your licence allows it, and SPF, DKIM and DMARC on your domain, so it is harder to send convincing fake emails in your name. The SRA's advice points firms to DMARC, which it notes the NCSC recommends.
- Managed, £35 per user a month: computers patched and monitored, Huntress Managed EDR watched 24/7, Defender for Business, security settings kept, Microsoft 365 backup of email, OneDrive, SharePoint and Teams, and unlimited remote fixes during support hours.
- Secure, £55: adds a 24/7 watch on Microsoft 365 sign-ins (Huntress Managed ITDR), phishing tests and security awareness training, laptops and phones managed with Intune on Business Premium, a monthly security report mapped to Cyber Essentials controls and the yearly Microsoft 365 audit. It is built for firms with compliance to show.
- Cyber Essentials, or Plus: on Managed or Secure we fill in the answers from the setup we manage and handle the renewal each year. Cyber Essentials is £995 a year for 10 to 19 people on a plan; every band is on the Cyber Essentials and Cyber Essentials Plus pages.
Not ready to switch? Start with the £395 Microsoft 365 audit for up to 25 users. It is credited in full if you move to Managed or Secure within 30 days.
Example at our prices
Example only, not a quote
A 12-person high-street firm on Microsoft 365 Business Premium, on our Secure plan, certifying to Cyber Essentials.
- Licences: 12 × £24.60 = £295.20 a month
- Secure support: 12 × £55 = £660 a month
- Together: £295.20 + £660 = £955.20 a month, or £11,462.40 a year
- Cyber Essentials, support-client price for 10 to 19 people: £995 a year
- Year one: £11,462.40 + £995 = £12,457.40, excluding VAT
With Cyber Essentials Plus instead (£2,595 for 10 to 19 people on a support plan), year one is £11,462.40 + £2,595 = £14,057.40. Onboarding is one month's support fee, £660, waived on a 12-month agreement.
Common questions
Does the SRA require Cyber Essentials?
We found no SRA rule naming Cyber Essentials. The SRA Code for Firms requires you to manage all material risks and keep client affairs confidential. The Law Society recommends considering Cyber Essentials, Lexcel or ISO 27001. Firms on LAA contracts that came into force from 1 October 2025 must hold Cyber Essentials.
Do legal aid firms need Cyber Essentials Plus?
The LAA's Data Security Requirements v5 make Cyber Essentials mandatory and Cyber Essentials Plus recommended. They apply to LAA contracts coming into force on or after 1 October 2025.
What should we do if a client is told to pay into a fraudster's account?
Act fast. The SRA's guidance is to report cyber incidents to it. If personal data was involved, UK GDPR may require a report to the ICO within 72 hours. If client account money was lost, the Accounts Rules require you to replace it immediately.