Technology plays an important role in how law firms protect confidential information, maintain business continuity and manage regulatory and operational risk.
Every email, document, remote connection and cloud application forms part of a firm’s wider risk profile. With cyber threats evolving, data-protection responsibilities remaining significant and artificial intelligence becoming more widely adopted, IT governance is increasingly important for law firms.
The SRA does not prescribe a single technical IT checklist for law firms. However, firms need to safeguard client information, manage risk and meet their professional, legal and data-protection responsibilities.
This SRA IT compliance checklist for law firms provides a practical framework for reviewing the technology, cyber security and governance measures that can help support those responsibilities and identify areas that may require attention.
Why IT Matters With SRA Compliance
Law firms need to protect confidential information, manage operational risk and maintain effective governance, with technology supporting each of these areas.
Technology underpins each of these responsibilities, from securing client communications to ensuring business continuity during a cyber incident or system failure.
Rather than treating compliance as a separate regulatory exercise, firms should view IT as a critical part of organisational risk management.
A well-managed IT environment not only supports compliance but also improves productivity, protects reputation and strengthens client confidence.
1. Cyber Security Checklist
Cyber attacks remain a significant risk for law firms due to the confidential commercial, financial and personal information they handle. Effective cyber security for law firms therefore requires multiple layers of protection rather than reliance on a single product or technology.
Core controls should include endpoint protection, email security, appropriately configured firewalls, continuous monitoring and prompt security patching. Regular vulnerability assessments and penetration testing can help identify weaknesses before they are exploited.
Firms should also maintain a documented cyber incident response plan covering responsibilities, escalation, communication, containment, investigation and recovery.
Recognised schemes such as Cyber Essentials or Cyber Essentials Plus can provide a useful framework for baseline cyber security controls. Cyber Essentials is the UK Government-backed scheme designed to help organisations protect against common cyber threats.
2. Access Control Checklist
Protecting confidential client information starts with ensuring only authorised users can access it.
Check that:
- Multi-factor authentication is enabled for Microsoft 365, remote access and other critical systems.
- Role-based permissions are applied across systems.
- Administrative accounts receive additional protection.
- Joiner, mover and leaver processes are documented.
- User permissions are reviewed regularly.
- Dormant accounts are removed promptly.
- Conditional Access policies protect Microsoft 365.
- Mobile devices are centrally managed.
3. Data Protection Checklist
Client confidentiality sits at the heart of legal practice. Protecting information requires far more than simply preventing unauthorised access; firms must ensure data is managed securely throughout its lifecycle.
Sensitive information should be encrypted both while stored and when transmitted. Secure document management systems should provide version control, audit trails and appropriate access controls, while clearly defined retention policies ensure information is retained only for as long as necessary. Secure disposal procedures should exist for both physical devices and digital data, preventing confidential information from being inadvertently exposed.
Modern information governance platforms such as Microsoft Purview can also help firms classify sensitive information, apply retention policies and reduce the risk of inappropriate sharing. Regular reviews of user permissions and audit logs provide additional assurance that confidential information remains appropriately protected.
4. Backup And Business Continuity Checklist
Every law firm should assume that systems will eventually fail. The question is how quickly they can recover.
Review whether you have:
- Automated daily backups.
- Backup testing completed regularly.
- Off-site or cloud backup storage.
- A documented disaster recovery plan.
- Defined Recovery Time Objectives (RTOs).
- Defined Recovery Point Objectives (RPOs).
- Regular disaster recovery testing.
Discover more about the considerations of business continuity and disaster recovery in our video.
5. Microsoft 365 Security Checklist
Microsoft 365 has become the foundation of daily operations for many law firms, making it one of the most important areas to secure. Because email, documents, identity management and collaboration all reside within the platform, a compromised Microsoft 365 account can have significant operational consequences.
Security should begin with multi-factor authentication for every user and extend through Microsoft Entra ID Conditional Access policies that verify users based on identity, location and device. Microsoft Defender for Office 365 provides enhanced protection against phishing emails, malicious attachments and other common threats, while secure SharePoint and OneDrive sharing policies help prevent confidential documents from being accessed by unauthorised individuals.
Firms should also disable legacy authentication methods wherever possible and regularly review their Microsoft Secure Score to identify opportunities for continual improvement. Keeping Microsoft 365 security aligned with Microsoft’s latest recommendations helps organisations remain resilient as threats evolve.
6. Governance And Compliance Checklist
Technology alone will never achieve compliance. Effective governance depends upon documented policies, clear responsibilities and an informed workforce that understands its role in protecting client information.
Check that your firm:
- Maintains up-to-date information security and acceptable-use policies that reflect current working practices.
- Clearly defines responsibility for IT security, cyber risk and technology governance.
- Provides regular cyber security awareness training, rather than relying solely on induction sessions.
- Uses phishing simulations or other appropriate exercises to reinforce good security practices.
- Reviews technology and cyber risk assessments periodically and following significant organisational or technology changes.
- Reviews policies when new systems, working practices or technologies are introduced.
- Maintains appropriate records of security reviews, risk assessments, identified issues and remedial actions.
Good governance is not simply about having policies in place. Firms should be able to demonstrate how technology risks have been identified, reviewed and addressed over time. Maintaining appropriate evidence of assessments, decisions and improvements can help show that cyber and technology risks are being actively managed rather than simply reacted to.
7. Operational Resilience Checklist
The SRA expects firms to manage operational risks that could affect clients.
Assess whether your IT operation includes:
- 24/7 infrastructure monitoring
- Proactive maintenance
- Regular patch management
- Network monitoring
- Resilient internet connectivity
- Monitoring of legal applications
- Clearly defined IT support service levels
Operational resilience is ultimately about ensuring legal professionals can continue delivering services regardless of technical disruption.
By identifying issues before they become outages, maintaining critical infrastructure proactively and establishing clear recovery procedures, firms reduce downtime, improve client service and demonstrate that operational risk is being effectively managed.
As regulatory expectations continue to evolve, resilient IT operations are becoming just as important as strong cyber security.
8. Device Security Checklist
With hybrid working now commonplace, endpoint security is essential.
Check that:
- All laptops are encrypted.
- Unsupported operating systems have been removed.
- Asset registers are maintained.
- Automatic updates are enabled.
- USB device controls are implemented where appropriate.
- Wireless networks are securely configured.
- Guest Wi-Fi is separated from internal systems.
9. Third-Party Risk Checklist
Few law firms operate entirely independently of external technology providers. Cloud platforms, software vendors, managed service providers and specialist legal applications all play an important role in delivering modern legal services. However, responsibility for protecting client information remains with the firm itself.
When assessing an IT or cloud supplier, consider:
- Security controls and relevant certifications.
- Data-protection arrangements.
- Contractual security responsibilities.
- Access to your systems and information.
- Incident-notification procedures.
- Backup and business-continuity arrangements.
- Data processing agreements where personal information is involved.
Supplier assessment should continue throughout the relationship. Periodic reviews help firms determine whether providers continue to meet their security, operational and data-protection requirements as technology and risks evolve.
10. Artificial Intelligence (AI) Governance Checklist
Artificial intelligence is rapidly transforming legal services by helping professionals summarise documents, assist with research and improve productivity. However, the SRA has made it clear that firms remain fully responsible for the quality, confidentiality and regulatory compliance of any work produced with AI assistance.
Before introducing AI into everyday practice, firms should establish a formal governance framework. This should include an approved AI usage policy, clearly defined responsibilities for oversight and appropriate risk assessments before new AI tools are deployed. Staff should receive training on both the opportunities and limitations of AI, understanding when it is appropriate to use and, equally importantly, when human judgement must take precedence.
Confidential or privileged client information should never be entered into public AI services without appropriate safeguards. AI suppliers should undergo the same level of security and compliance assessment expected of any other technology provider. Any legal advice, client correspondence or documentation generated with AI assistance should be independently reviewed before use, ensuring accuracy, confidentiality and professional standards are maintained.
Used responsibly, AI can significantly improve efficiency across legal practices. However, effective governance is essential to ensure innovation enhances compliance rather than creating additional regulatory risk.
Final SRA IT Compliance Review
Once you’ve worked through each section, ask yourself the following questions:
- Are we confident confidential client information is appropriately protected?
- Are access to systems and sensitive information appropriately controlled?
- Could we respond effectively to a serious cyber incident?
- Could we recover critical systems and information within an acceptable timeframe?
- Are employees following secure technology practices?
- Are our technology suppliers appropriately assessed?
- Can we demonstrate how technology risks and controls are being managed?
- Are we governing the use of AI responsibly?
If any of these questions are difficult to answer confidently, it may indicate gaps in your current IT strategy or governance framework.
SRA IT Compliance Is an Ongoing Process
SRA compliance should not be viewed as a one-off project. Cyber threats, technology and working practices continue to evolve, so law firms should regularly review their IT environment and the risks associated with it.
Regularly assessing technology, reviewing emerging risks and strengthening controls can help firms protect client confidentiality, maintain operational resilience and support their wider professional and regulatory responsibilities.
Technology should ultimately enable legal professionals to work securely, efficiently and confidently, supported by appropriate governance and risk management.
Akita helps law firms strengthen cyber security, modernise Microsoft 365, improve operational resilience and develop technology strategies that support their wider compliance responsibilities, enabling legal professionals to work securely and focus on delivering services to their clients.
Need Help Applying This Checklist?
Managing compliance requires more than a one-off checklist. Akita provides IT support for law firms, helping practices put secure, reliable technology and appropriate IT governance into practice.
See how we delivered secure IT support for Griffin Law.
Contact Us
