SRA Cybersecurity Requirements: What UK Law Firms Must Have in Place
The Solicitors Regulation Authority does not publish a checklist of required security controls — but that ambiguity is not your friend. Through its Thematic Reviews, enforcement actions, and the 2023 warning notice on cyber risks, the SRA has made clear that firms without documented, tested security programmes are in breach of their regulatory obligations. The question is not whether the SRA cares about cybersecurity. It is whether your firm can demonstrate it does too.
The SRA issued a formal warning notice on cyber risks in 2023 — the first of its kind for the profession.
What the SRA Standards and Regulations Actually Say
The SRA does not prescribe specific technical standards, but its Standards and Regulations create clear obligations that cybersecurity controls must satisfy:
- Principle 2: Act in a way that upholds public trust in the solicitors profession — a breach that harms clients damages that trust
- Principle 7: Act in the best interests of each client — which includes protecting their confidential information
- Code of Conduct 6.3: Firms must have systems and controls to ensure compliance with all regulatory obligations
- Code of Conduct 6.4: Firms must monitor the compliance of all managers and employees
- IB 7.3: Firms must have effective systems and controls in place to prevent inadvertent or reckless breaches of client confidentiality
- Rule 4.1 (Accounts Rules): Client money must be protected — including from cybercrime
What the SRA's 2023 Warning Notice Means for Your Firm
In April 2023, the SRA issued a warning notice reminding firms of their obligations when handling cyber attacks. The notice made clear: firms are expected to have documented cyber incident response plans, to report cyber incidents that may affect client confidentiality or client money to the SRA, and to co-operate fully with the SRA's investigation. Critically, the notice confirmed that failure to have adequate controls in place — not just the attack itself — can constitute a regulatory breach.
The Controls the SRA Expects to See
Based on the SRA's Thematic Reviews and enforcement decisions, regulators expect firms to have documented evidence of:
- A written information security policy, reviewed annually, approved by the firm's senior management
- Staff security awareness training — conducted at induction and at least annually thereafter
- A documented cyber incident response plan, tested in the last 12 months
- Multi-factor authentication (MFA) on all email accounts, client portals, and remote access systems
- Regular backups tested for restoration — not just taken
- Vendor/supplier due diligence for any third party handling client data
- A record of any cyber incidents reported to the SRA and the ICO
How Kyanite Blue Helps Firms Meet SRA Expectations
Our stack was selected for professional services firms where documentation and accountability matter as much as technical controls. Coro provides the endpoint protection and email security that defends your fee earners. Hadrian identifies exposed client portals and case management systems before attackers do. Panorays automates your third-party risk assessments. And Collective IP provides the managed security oversight that small and mid-size firms need without an in-house security team. Everything produces the audit trail the SRA expects to see.
Frequently Asked Questions
Does the SRA require firms to have Cyber Essentials certification?
The SRA does not mandate Cyber Essentials specifically, but many cyber insurers and larger clients now do. Cyber Essentials demonstrates the baseline controls the SRA expects — MFA, patching, firewall configuration, access controls — and is strongly recommended as a minimum for any SRA-regulated firm.
Must we report a cyber attack to the SRA?
You must report to the SRA any incident that has resulted in, or risks resulting in, a breach of client confidentiality, loss of client money, or significant operational disruption. You should also consider whether the ICO must be notified within 72 hours under GDPR. When in doubt, report.
What happens if the SRA investigates our firm after a cyber attack?
The SRA will examine whether you had adequate controls in place before the attack, whether you responded appropriately, and whether you reported the incident correctly. Firms that had documented controls and responded properly typically receive no sanction. Firms that had no controls and failed to report face formal regulatory action — including fines, conditions on practice, and in serious cases, intervention.
Get a free SRA compliance gap assessment
Kyanite Blue specialises in cybersecurity for iGaming operators. MGA-licensed operators across Malta trust our stack.
Get in touchReady to secure your iGaming operation?
MGA-licensed operators across Malta trust Kyanite Blue.