Cyber Essentials for law firms and accountants: what clients, lenders and insurers expect

Law firms and accountancy practices hold exactly what criminals want: client money, identity documents, bank details, and the email threads that move all three. That's why clients, lenders, insurers and public-sector buyers increasingly ask a practice to show it has the basics in place, and Cyber Essentials is the most common way to show it. It's a UK government-backed scheme that checks five technical controls, it costs from a few hundred pounds, and a small practice can usually get it done in weeks rather than months.

This guide explains who is likely to ask, what the five controls mean in a typical practice, and the order to do the work in. It isn't legal or regulatory advice: check what your regulator, clients and contracts actually require.

Why practices get asked

The pressure comes from several directions at once, and it rarely arrives as a single rule.

• Clients. Larger corporate clients, and anyone with their own supply-chain checks, send security questionnaires to their professional advisers. A Cyber Essentials certificate answers a lot of those questions in one line, and the NCSC notes that a growing number of organisations require suppliers to be certified to bid for work.
• Public-sector work. Cyber Essentials is required for many central government and public-sector contracts. If you act for, or tender to, public bodies, expect to be asked.
• Lenders and panels. Firms that act for lenders, or sit on panels, are often asked how they protect client money and data as part of panel or due-diligence questionnaires. The questions vary by lender, so check each one's current requirements rather than assuming.
• Insurers. Cyber and professional indemnity proposal forms commonly ask about the same things Cyber Essentials covers: multi-factor authentication, patching, malware protection and who has admin rights. Having the answers ready (and true) makes renewal easier.
• Your regulator. Regulators expect firms to manage cyber risk, though they generally don't mandate a single scheme. Check any specific contract terms too: for example, if you do legal aid work, read the Legal Aid Agency's current contract and data security requirements for what they say about Cyber Essentials.

What the regulators and professional bodies have said

For solicitors, the SRA's 2020 cyber security thematic review is worth reading in full. The SRA visited 40 firms in 2019, all of which had reported a cybercrime. Among its findings:

• in 23 cases, more than £4m of client money was taken, though most was recovered through insurance or the firm's own funds;
• staff knowledge and behaviour were the biggest weakness, and eight firms had never given staff specific cyber security training;
• fifteen firms kept their disaster recovery plans on the same systems an attack could take down;
• only five of the firms held Cyber Essentials Plus, and those firms generally had stronger policies and controls.

For accountants, ICAEW publishes a 10-step cyber security guide and checklist covering responsibility, networks, patching, access, malware, remote working, cloud files, breach planning, staff training and records. ICAEW says that following it leaves organisations well placed to adopt Cyber Essentials.

For both, a personal data breach that's likely to pose a risk to people's rights and freedoms must be reported to the ICO, where feasible within 72 hours. Solicitors may also have a separate duty to report serious breaches to the SRA. Knowing who decides, and how, before it happens is part of being ready.

Cyber Essentials and Cyber Essentials Plus

Cyber Essentials is backed by the National Cyber Security Centre (NCSC). IASME is the NCSC's Cyber Essentials delivery partner: it runs the scheme, publishes the question set and readiness tool, and licenses the certification bodies that assess you and issue certificates.

Most small practices start with Cyber Essentials. If a client, lender or contract asks for Plus, you'll usually need Cyber Essentials in place first, and Plus then tests that your answers hold up on real devices.

The NCSC also says that UK organisations with turnover under £20m that certify their whole organisation are automatically entitled to cyber liability insurance arranged by IASME. Check the current terms and how it sits alongside the insurance you already have.

The five controls in a small practice

Cyber Essentials covers five technical areas. Here's what each tends to mean in a law firm or accountancy practice.

1. Firewalls. Your office router and every laptop have a firewall switched on, with the default admin password changed and remote admin turned off unless you need it. Home workers' laptops count too.
2. Secure configuration. No default or shared passwords, unused software and accounts removed, and auto-run turned off. Devices lock automatically, and the practice management and accounting systems are set up the way you'd expect.
3. User access control. Everyone has their own account; admin rights are kept to the few people who need them, and used only for admin work. Multi-factor authentication is on for cloud services, especially email, document management, practice management and online banking. Leavers lose access on their last day.
4. Malware protection. Anti-malware is running and up to date on every device in scope, or you restrict which applications can run.
5. Security update management. Operating systems and applications are supported and updated, with critical and high-risk updates applied within 14 days. Software that no longer gets updates (an old PC running a legacy accounts package, for example) has to be replaced or taken out of scope.

The question set is updated from time to time, so always work from the current version on the IASME website.

Where practices usually get stuck

• Unsupported software. A legacy case management or tax package that only runs on an old operating system is the classic blocker. Plan its replacement early.
• Personal devices. If staff read work email on their own phones, those devices are in scope. Either bring them up to standard or change how people access work data.
• Cloud services left out. Microsoft 365 or Google Workspace, your document management system and your practice management software all count. MFA on each is the single biggest win.
• Shared and admin accounts. A shared "reception" login or a partner who uses an admin account day to day will fail the access control questions.
• Treating it as one-off. The certificate shows your position on the day you were assessed. Patching, leavers and access reviews have to keep happening for next year's renewal to be easy.

A practical order to do it in

1. Decide the scope. Usually the whole practice. Whole-organisation scope is simpler to explain to clients and lenders, and it's what the included insurance asks for.
2. List your devices and cloud services. Laptops, desktops, phones, servers, routers, and every cloud system that holds client data, with who owns each.
3. Read the current question set from IASME and answer it honestly in draft, noting every "no" or "not sure".
4. Fix the gaps. Typically: turn on MFA everywhere, remove admin rights, replace unsupported software, and set devices to update automatically.
5. Gather the evidence behind each answer (screenshots, settings, device lists) so the next renewal, or the next client questionnaire, takes minutes.
6. Submit through a certification body, and book Plus testing if you need it.
7. Put the year on rails. Recurring checks for patching, leavers and admin accounts, so the controls stay true between renewals.

When Cyber Essentials isn't enough

Cyber Essentials covers technical basics. It doesn't ask about your suppliers, incident response, staff training, or how you decide which risks to accept. Some larger clients and tenders ask for ISO 27001 instead, which covers all of that as a management system. If that might be coming, read Cyber Essentials vs ISO 27001: the work overlaps a lot, so doing Cyber Essentials well gives you a head start.

How ClearIMS helps

ClearIMS has a Cyber Essentials plan at £39 a month (no VAT charged), with unlimited users. You work through the Cyber Essentials (and Plus) questions with owners, due dates and linked evidence, and it tracks what's missing or out of date and any Plus remediation. If ISO 27001 comes up later, you upgrade to the full plan and the evidence and owners carry across to the matching ISO 27001 controls, so you don't start again. ClearIMS doesn't submit your assessment: your certificate comes from a Cyber Essentials certification body.

We make the software. Your certification is yours, awarded by your certification body.

There's no free trial on this plan, so book a 20-minute call and we'll walk you through it.