Cyber Essentials for Law Firms

Why law firms and chambers get certified

Law firms hold privileged, confidential client information and move client money, which makes them both a prime target and a subject of intense client scrutiny. Clients, regulatory duties and insurers increasingly expect Cyber Essentials as evidence of the basics.

Client security audits. Corporate clients audit their law firms' security, and Cyber Essentials, often Plus, is a common requirement to stay on panels.
Confidentiality duties. Protecting client confidentiality is a regulatory obligation; certification evidences the technical baseline.
Client money and fraud. Conveyancing and client-account fraud are rampant; the controls Cyber Essentials checks are exactly the ones attackers exploit.
Lexcel and PII. Cyber Essentials complements Lexcel and is increasingly expected by professional-indemnity insurers.

The security benefit is real and worth having. But the honest reason most law firms and chambers certify is commercial: work, funding or clients increasingly depend on it.

Prepared properly, passed first time

We scope it with you, tell you plainly what needs to change, and prepare a clean submission so you pass first time rather than paying to resubmit. You are guided by a Certification Body for both Cyber Essentials and Cyber Assurance, a team that knows exactly what the assessment checks, not an account manager and not a junior with a checklist.

Cyber Essentials and Cyber Essentials Plus

Cyber Essentials is a verified self-assessment against five technical controls, certified annually. Cyber Essentials Plus covers the same five controls but adds an independent, hands-on technical audit of your systems: the level a growing number of buyers now specify. We will tell you which one your buyers actually require, rather than pushing the higher tier by default.

What it covers

Five controls that block the great majority of commodity attacks: firewalls, secure configuration, security update management, user access control, and malware protection. Straightforward for most organisations, provided someone tells you honestly what needs changing before you submit.

How it works

Certification is delivered remotely first, which suits most businesses. We agree the scope with you, we help you get the controls in order and support you through the assessment on the IASME portal. Where Cyber Essentials Plus applies, the technical audit is scheduled around you. Turnaround is days rather than weeks when your controls are already in order.

Where it fits

For most law firms and chambers Cyber Essentials is the right first step. Where clients or funders want evidence of more than the baseline, Cyber Assurance is the next rung and stands in for ISO 27001 at SME cost. If you hold anything genuinely sensitive, test it with a proper penetration test.

Ready to buy?

Transparent, fixed pricing based on your organisation size. By default we give you access to the IASME portal to complete your Cyber Essentials assessment yourself, and once you submit it we aim to assess within one business day. You can preview the Cyber Essentials self-assessment questions to see where you stand first. There is no call or consultation as standard; we simply send you the questionnaire to complete. Your submission is reviewed by a qualified, certified assessor, never fed into AI. Need it faster? Add urgent turnaround below. Want us to review your setup against the controls before you apply? That is a gap analysis, quoted separately: ask for one using the contact button under the form.

An appointed IASME Certification Body: your certificate comes directly from us. Verify our credentials on the BlockMark registry, and find us listed on the IASME website.

Business name

Business size

Telephone

Optional add-on

Tick it if you need it.

Urgent turnaroundMoved to the front of the queue and assessed same day where your submission arrives before midday. +£100

Total: select your size + VAT

Want a gap analysis, a different way to pay, or a question answered first?

Gap analysis. We review your setup against the controls you will be assessed on before you apply and tell you exactly what needs fixing, so nothing is a surprise when you submit. It is quoted against your setup rather than sold as a fixed add-on, so ask us and we will price it.

Anything else. Paying by card here is the quickest route, not the only one. Tell us how you would rather pay and we will sort it. Same if you want a question answered before you buy, or a quote for on-site Cyber Essentials or IASME Cyber Assurance Level 1.

Common questions

Clients are asking about our security before instructing us - does Cyber Essentials cover it?

It covers the technical baseline they are checking for and answers most of a standard client security questionnaire. Larger corporate clients increasingly require Cyber Essentials Plus specifically to keep firms on their panels.

Do we need Cyber Essentials or Cyber Essentials Plus?

Whatever your buyer specifies. Many requirements accept Cyber Essentials; larger clients, primes and some public bodies require the audited Plus. We check the actual wording rather than pushing the higher tier by default.

How quickly can we be certified?

If your controls are already in order, Cyber Essentials can often be turned around within days. If they are not, we tell you exactly what to fix first. See our urgent certification page if you are against a deadline.

How do you actually help us get certified?

We scope it with you, tell you plainly what needs to change, help you close the gaps, and, as a Certification Body for both schemes, certify you first time rather than resubmitting.