Legal Tech Compliance Checklist

The Solicitors Regulation Authority (SRA) requires firms to have adequate systems for managing risks, including cyber security risks.

Key SRA Principles Affecting IT:

• Principle 2: Act with integrity - includes protecting client data
• Principle 6: Behave in a way that maintains public trust
• Code of Conduct 3.4: Effective governance and risk management

What This Means Practically:

• You must have documented IT policies
• Staff must be trained on data protection
• You need incident response procedures
• Regular risk assessments are required
• Client data must be protected in transit and at rest

Evidence You Should Maintain:

• IT security policy (reviewed annually)
• Staff training records
• Incident log (even if no incidents)
• Business continuity plan
• Supplier due diligence records

Email is the biggest vulnerability in most law firms. Conveyancing fraud losses exceeded £100 million in 2024, with most attacks starting with email compromise.

The Attack Pattern:

1. Attacker compromises a solicitor's email (phishing or password theft)
2. They monitor conversations, especially regarding completions
3. At the critical moment, they send new bank details "from" the solicitor
4. Client transfers funds to criminal accounts
5. Money is gone within hours

Essential Email Controls:

• Multi-Factor Authentication on all accounts (stops 99% of account takeovers)
• Email encryption for sensitive correspondence
• Warning banners on external emails
• Link scanning (checks URLs in real-time)
• Attachment sandboxing (opens files safely before delivery)

When to Use Encryption:

• Client account details
• Confidential case information
• Settlement agreements
• Anything you wouldn't want intercepted

Microsoft 365 Business Premium includes all these features.

Your Document Management System (DMS) is the backbone of your practice. Whether you use Leap, Clio, iManage, or a simpler solution, these principles apply.

Access Control:

• Implement matter-based permissions (staff only see their matters)
• Separate permissions for partners, associates, and support staff
• Log all document access (who opened what, when)
• Automatic lock-out after inactivity

Version Control:

• Never rely on "Final_v2_FINAL.docx" naming
• Use proper version history (built into most DMS)
• Lock documents during editing to prevent conflicts
• Require check-out for critical documents

Backup & Disaster Recovery:

• Daily backups minimum (hourly for active matters)
• Offsite/cloud backup copy
• Test restores quarterly (can you actually recover files?)
• Document retention policy (how long do you keep closed matters?)

Partners and fee-earners work everywhere - courts, client sites, trains, home. Their mobile devices contain client data and email access.

The Risk:

A lost or stolen phone with email access is a data breach. If that phone has saved passwords and no screen lock, it's a disaster.

Mobile Device Management (MDM) Controls:

• Require PIN/biometric to unlock device
• Encrypt all device storage
• Remote wipe capability (if lost/stolen)
• Separate "container" for work apps
• Prevent copy/paste from work to personal apps

BYOD (Bring Your Own Device) Policy:

If partners use personal phones:

• Require MDM enrolment
• Work data stays in managed apps only
• IT can wipe ONLY work data (not personal photos)
• Clear policy on what happens when they leave the firm

Microsoft Intune provides all these capabilities.