Cyber security checklist for law firms

By Jonathan Ashley, co-founder of etiCloud. (Updated 4 April 2025)

1. Achieve Cyber Essentials accreditation from the National Cyber Security Centre. It’s an accessible first line of defence and a great place to start if your security is lacking.
2. Take a detailed look at where data enters and leaves your firm and put cyber security solutions in place in these areas (see 4-9, below). This enables more accurate detection in a cyber attack situation, to work out which systems must remain closed down.
3. Analyse whether you can separate data and systems, to limit the impact of any breach. There are risks and benefits to integrated systems, so understand the implications.
4. As a basic level of cyber protection use anti-virus, anti-malware software and firewalls.
5. Implement Multi-Factor Authentication (MFA) for every single user. (See Multifactor Authentication is a critical layer of cyber security.)
6. Add Inline Email Security to your cyber security toolkit. This application blocks malicious emails or files before they enter a user’s mailbox, scanning every email and providing a high level of protection for every user.
7. Use a strong, unique password for every different website you use and change them ideally on a monthly basis.
8. Consider Web Filtering. This technology prevents users from accessing certain websites or URLs and prevents the user’s browser loading any pages from such sites.
9. If your software is not already hosted in the cloud, seriously consider it. A large element of your firm’s cyber security can be handled by the managed service provider – to whatever standard your budget allows.
10. Be cautious when procuring and using third-party software and services, as these can also be entry points for a cyber attack. Consider including cyber security requirements in vendor contracts.

"The Law Society recommends that all law firms achieve Cyber Essentials accreditation if they wish to apply for the Lexcel legal practice quality mark."
James Doswell, risk management consultant, Travelers

11. Keep up-to-date with what latest technology is available and its cost-benefit, usually in liaison with your managed service provider.
12. Document all your systems and suppliers, so full information is readily available and you know who to contact in an emergency.
13. Diarise regular security reviews and tests and stick to them. It only takes one late patch or software update to potentially allow an attacker to enter your system.
14. Invest in regular cyber security training – starting with their induction training – as employees are usually the number one point of vulnerability. Familiarise them with your firm’s security protocols and data protection policies.
15. Include that training in the induction process for every new employee.
16. Regularly test that training, or people will relax their guard. For example, see if anyone (including senior management) replies to dummy phishing emails.
17. Consider holding ‘insight sessions’, to learn from the experiences of others. For example, the well documented Allen & Overy attack 15 months ago: how would your team respond?
18. Consider cyber insurance, as professional indemnity insurance is not designed to cover cyber attacks (although it can provide cover in particular situations).
19. Draft, agree, and regularly test and update a breach response plan to deal with the aftermath of cyber security attack. It must include reporting any breaches of personal data to the relevant regulators and any individual directly affected.
20. You can outsource your firm’s cyber security, but your senior management team still has responsibility for it: responsibility for the return on investment and for the level of risk your firm is accepting by not investing more time and money into cyber security.

See also:

• Cyber security for law firms FAQs
• Anatomy of a law firm cyber attack
• Webinar recording: Risk protection including cyber security (February 2023)
• NSC Cyber Threat Report: UK Legal Sector (June 2023, 24 pages)