The Cyber Resilience Pledge and Law Firms

The Pledge, and what it means for law firms

Corporate clients signing the Pledge are auditing their supplier panels — and law firms handling their confidential data are exactly the suppliers being asked to certify. The Cyber Resilience Pledge, launched by the government in July 2026, asks signatories to require Cyber Essentials across their supply chains — auditing which suppliers hold it and requiring it, risk-based, from those who don’t. For law firms, that turns Cyber Essentials into a practical condition of winning and keeping the work.

Why this matters — not just for government suppliers

It’s easy to read ‘government pledge’ and assume it’s someone else’s problem. It isn’t. The third commitment asks signatories to require Cyber Essentials across their supply chains — and the signatories are major private-sector companies, not just departments. As each one audits its suppliers and rolls the requirement out, Cyber Essentials becomes a condition of staying in the chain for law firms, whether or not you ever bid for a public contract.

This is the same direction of travel as the public-sector procurement rules (PPN 014) and the reason clients are already asking for Cyber Essentials. The Pledge accelerates it. The businesses that get ahead of it keep the work; the ones that wait get the awkward email asking for a certificate they don’t have.

Our position: we’re certified, and we certify

We don’t just help others meet this bar — we hold it ourselves. Solusec is a Cyber Essentials and IASME Cyber Assurance Certification Body, with certified assessors for both schemes. We practise what we preach, which means we know the assessment from both sides: what actually needs to change, and how to get you through it quickly rather than leaving you to wrestle a questionnaire alone.

So whichever side of the Pledge you’re on, we can help. If you supply an organisation that has signed — or is quietly adopting the same supply-chain approach — we get you Cyber Essentials certified, often in days. If you’re the larger organisation making the commitment, we can help you audit Cyber Essentials coverage across your suppliers and take the risk-based approach the Pledge asks for.

The right certification for law firms

For most law firms, Cyber Essentials is the answer the Pledge is driving demand for, and we’ll get you there fast. Where a client asks for the audited level we also support Cyber Essentials Plus. And if your work involves more than the basics — a product, an application, sensitive data — our sector guide for law firms covers the wider picture.

Talk to us about your organisation

Tell us what you are dealing with and we will tell you honestly what you need. We work with organisations in your sector regularly, so the conversation starts from what is normal for you rather than from a generic checklist.

Full name *

Email *

Organisation *

Phone (optional)

What do you need? *

Send enquiry →

Your details are handled by a real person, never fed into AI.

Common questions

What the pledge means for law firms

The Cyber Resilience Pledge is a public commitment rather than a certification, and for law firms that distinction matters. You hold privileged client material, transaction data, and client money in the case of firms holding a client account, so the people you answer to, whether that is SRA expectations, client information security questionnaires from corporate clients, and professional indemnity conditions, will eventually want evidence rather than intent. The pledge is a good way to start that conversation; it is not a substitute for finishing it.

Conveyancing fraud remains the clearest example: an attacker sits quietly in a mailbox, waits for completion, and redirects funds at the moment nobody is going to question a change of account details. Detection matters more than perimeter here.

Where it usually leads

For most law firms the honest sequence is: take the pledge, use it to get internal agreement that this is a priority, then certify. Cyber Essentials is the natural destination because it is the standard your customers, insurers and funders already recognise. See what Cyber Essentials actually requires, or the five controls checklist if you want to see how close you already are.