Cyber Resilience · Law firms
Microsoft 365 security for law firms
Fixed-price Microsoft 365 security for solicitors' practices. We close the gaps that let fraudsters into a fee earner's mailbox, put the Microsoft 365 side of Cyber Essentials in place, and give you a written record for when the LAA, an insurer or a client asks.
"Please note we have moved banks. Completion monies should now be sent to the new account below. Our phones are down today, so please reply by email to confirm."
Why law firms are targeted
A law firm holds two things criminals want: client money on the move, and confidential information about people and deals. Conveyancing offers both, on a timetable anyone can read from the email thread.
The pattern is well known. Someone gets into a fee earner's mailbox, usually with a password collected by a fake Microsoft sign-in page. They read the matter correspondence quietly and wait. Close to completion they send the client, or the other side, new bank details from a real address in the middle of a real conversation. The SRA's Risk Outlook report on information security and cybercrime says conveyancing remains a frequent target, and that over 80 percent of the cybercrime reports it received in 2021 involved email.
A mailbox takeover is also a confidentiality breach. One account can hold years of privileged correspondence, ID documents, and medical or financial records. If personal data is put at risk you may have to report it to the ICO, where feasible within 72 hours.
None of this needs a clever attacker. It needs a password with no second factor, a forwarding rule nobody checks, or an old account that still signs in.
What the SRA, the LAA and your clients expect
No rule tells you how to configure Microsoft 365. But several bodies expect you to protect client data, and some will ask for proof.
The SRA
The SRA Code of Conduct for Firms asks for effective governance, systems and controls (paragraph 2.1), that you identify, monitor and manage all material risks to your business (2.5), and that you keep clients' affairs confidential (6.3). An unprotected mailbox is a material risk.
The Legal Aid Agency
Version 5 of the LAA's Provider Data Security Requirements (1 October 2025) adds Requirement 19a, which is mandatory: hold Cyber Essentials certification for the life of the contract, or an equivalent standard. It applies to contracts coming into force on or after 1 October 2025. Cyber Essentials Plus is recommended (19b). The 2025 Standard Crime Contract application guide asks applicants for a valid certificate.
Lexcel
If you hold Lexcel or are working towards it, expect questions about how you manage and protect information. Check the current edition of the standard for exactly what your assessor will look for.
Insurers and clients
When an insurer or a corporate client sends a security questionnaire, the questions are usually the basics: is MFA on for everyone, are devices managed, is your domain protected against spoofing. You want to answer yes, with evidence.
What we fix, control by control
On Self-Service we configure these and leave them in report-only for your IT person to switch on. On Managed we enforce them and keep them right.
Where this leaves you on Cyber Essentials
Cyber Essentials checks five areas: firewalls, secure configuration, user access control, malware protection and security updates. The uplift covers the Microsoft 365 side of that, which for most firms is the bulk of the work: accounts, email and managed devices.
Your office router, any on-premises server and software updates on every device are also in scope, and we'll tell you what else needs doing. Managed Plus includes Cyber Essentials and Cyber Essentials Plus alignment. The certificate itself is issued by an IASME certification body. Our Cyber Essentials guide covers fees and timings.
Fixed price, before we start.
One fixed price for the uplift, whichever area of law you practise. If you need Cyber Essentials for a legal aid contract, tell us your deadline on the call.
A full assessment and configuration of your Microsoft 365, controls set to report-only, handed over for your own IT person to run.
We enforce the controls and keep them right, with business-hours incident response and plain-English reporting. Where most firms start.
Everything in Managed, plus 24/7 monitoring, incident response at any hour, and Cyber Essentials alignment.
Prices for a typical 10-user organisation. Managed and Managed Plus run on a 12-month term. Larger firms get exact figures after the consultation. Compare the options control by control →
A real breach, and what we rebuilt.
A UK company trusted with sensitive client data came to us after a phishing attack reached their clients. In just under two months we rebuilt their Microsoft 365 security from the ground up.
&DEV is itself certified to Cyber Essentials Plus across the whole organisation, independently audited, valid until 2 October 2027.
Conditional Access, phishing-resistant MFA for admins and risk-based sign-in blocks, so a stolen password alone no longer opens client files.
Admin accounts under PIM with approval workflows and monitored break-glass accounts, so admin rights are granted only when needed, and logged.
Every device hardened in Intune with Defender for Endpoint, and SPF, DKIM and DMARC enforced, so only trusted devices connect and nobody can spoof the company.
Defender watching for anomalies and OAuth abuse: around 96 controls in all, to a Cyber Essentials Plus-aligned baseline.
Questions law firms ask us
01 Is Cyber Essentials mandatory for law firms?
Not for every firm. The SRA's Code of Conduct for Firms doesn't name it. The Legal Aid Agency does for legal aid providers: Requirement 19a of its Provider Data Security Requirements (version 5, October 2025) makes Cyber Essentials certification, or an equivalent standard, mandatory for the life of the contract, for contracts coming into force on or after 1 October 2025. Outside legal aid, insurers and clients may ask for it, and it's a sensible baseline either way.
02 Does Microsoft 365 Business Premium cover it?
Business Premium includes most of the tools you need: Conditional Access, Intune device management, Defender for Business and Defender for Office 365. But almost none of the important protections are switched on by default. Having the licence isn't the same as having the controls. The uplift turns on and configures what you're already paying for.
03 How long does it take?
The consultation is 30 minutes. The Self-Service setup is typically complete within one to two weeks, scheduled around your fee earners so nobody is locked out mid-matter. If you then need Cyber Essentials, allow time for the assessment on top.
04 Do you work alongside our IT provider?
Yes. General IT support keeps you working day to day. It rarely means someone has deliberately secured your Microsoft 365 against a targeted attack. We're happy to work with your existing provider, and on Self-Service we hand the controls over to them to run.
Book a 30-minute consultation.
A straightforward call with an engineer, not a salesperson. We'll talk through where firms like yours are most exposed and how the uplift would work for you. No system access, no obligation.
