LEGAL SECTOR / RESOURCE BRIEFING
Cybersecurity questionnaire
for law firms
Before you share the brief, understand how it will be protected.
A practical starting point for reviewing the information security arrangements of the chambers you instruct.
CLIENT CONFIDENTIALITY
From the first instruction.
THE ESSENTIALS
Start with a shared resource.
Use the Bar Council and Law Society questionnaire as a consistent basis for discussion.
Know what the answers cover.
Establish which systems and services are provided centrally by chambers.
Act on what is missing.
Follow up unclear answers and record decisions proportionate to the instruction.
01 / THE BUSINESS QUESTION
What happens to client information after it leaves your firm?
An instruction can involve confidential documents, sensitive personal information and a deadline that cannot easily move. Your firm needs a clear view of how that information will be handled by the chambers you instruct.
The questionnaire gives that conversation a common starting point. It can help move the discussion beyond a broad assurance that “security is in place” towards the arrangements that matter for the work at hand.
A completed form is a starting point.
The review is what makes it useful.
CYBERSOLACE PERSPECTIVE
02 / THE QUESTIONNAIRE
Use the shared questionnaire
to review chambers’ security.
Developed jointly by the Bar Council and the Law Society, the resource is designed for solicitors’ firms reviewing the central IT services provided by chambers.
Fillable PDF · best completed on a desktop or laptop.
RESOURCE NOTES
Version 2
Published May 2024
35 questions
Central chambers systems and services
Six-month review
The Bar Council recommends keeping answers current.
03 / READ FOR THE RISKS
Look beyond a page of “yes” answers.
Read the questions in the context of your instruction. These are useful lenses for the discussion, rather than a replacement for the official questionnaire.
CONTINUITY
Can the work continue?
Read the answers on backups, recovery and incident handling together. Ask what a disruption would mean for access to the documents and services your matter depends on.
INFORMATION
Who can reach the files?
Consider accounts, access permissions, remote connections and the devices used to reach central systems. Make sure the stated scope matches the way information will actually be shared.
ACCOUNTABILITY
Who keeps arrangements working?
Look at responsibility, staff awareness and supplier oversight. A named owner and a clear explanation are more useful than an answer that nobody can substantiate.
04 / PUT IT TO WORK
Turn the response into a review.
Treat the questionnaire as part of a proportionate assessment of the relationship. A short record of the questions, evidence and follow-up is easier to maintain than a file of unanswered forms.
01
Clarify the scope.
Identify the central services covered by the response and any important exclusions. Confirm where the information needed for your instruction will sit.
02
Resolve the uncertainty.
Where an answer is unclear, ask for an explanation or relevant evidence. Keep any matter-specific supplementary questions separate from the standard form.
03
Record the next step.
Note the issue, who will address it and when it should be revisited. If an uncertainty matters to the instruction, agree how it will be handled before relying on the arrangement.
Keep the response current.
The Bar Council recommends checking answers every six months. Review sooner if a material change affects the services you rely on, and agree a secure way to exchange the completed response.
AN IMPORTANT DISTINCTION
Information to assess.
Not a certificate of security.
The official questionnaire says its answers do not necessarily imply compliance with ISO 27001, NIST or Cyber Essentials. Keep any certification evidence and your assessment of the particular instruction distinct.
Handle the response confidentially.
The official questionnaire restricts onward sharing of completed answers without chambers’ express written consent. Agree how responses will be stored and who needs access.
Clarify individual responsibilities.
The accompanying voluntary cyber and information security affirmation addresses the roles of barristers and instructing solicitors. The Bar Council describes it as a reminder of responsibilities, rather than a legally binding agreement.
05 / KEEP THE WIDER VIEW
The questionnaire is one part of your firm’s approach.
Your own account security, staff awareness, payment checks, backups and incident arrangements still need attention. Review them against the risks of your practice and the services on which it relies.
If an incident occurs, assess the circumstances and the reporting duties that apply. Use the SRA’s practical cybercrime guidance and the ICO’s personal data breach guidance rather than treating completion of a questionnaire as an answer to a reporting question.
Need help reviewing the answers?
CyberSolace can help you turn security questions into a proportionate assessment and practical next steps.
OFFICIAL SOURCES
Bar Council: questionnaire guidance · Version 2 questionnaire (PDF) · Voluntary affirmation (PDF) · SRA: cybercrime advice · ICO: personal data breach reporting
Originally published 28 August 2024. This briefing and its resource links were reviewed on 20 October 2026.