TL;DR: A cyber incident response plan tells your firm who leads the response to an attack and what they do first. Only 25% of UK businesses have one. For law firms, it also needs to cover reporting duties, including the ICO’s 72-hour deadline and the SRA’s expectation of a prompt report. Rehearsing it with a free tool like the NCSC’s Exercise in a Box shows up gaps before a real attack does.
Why does a law firm need a cyber incident response plan?
A cyber incident response plan is a written guide your firm follows the moment something goes wrong. It names who makes the decisions and sets out the steps they follow, in order.
The government’s Cyber Security Breaches Survey 2025/26 found that only 25% of UK businesses have a formal incident response plan. That rises to 57% among medium-sized businesses but falls to 21% for micro businesses, a category that takes in many smaller practices.
A breach involving client files may need reporting to both the ICO and the SRA, and both expect to hear from you quickly.
What should happen in the first hour of a cyber incident?
Some of the worst damage in the first hour comes from well-meant mistakes. Someone wipes an infected laptop to get it working again, or warns colleagues by email from an account the attacker already controls. Writing the first steps down in advance means nobody has to make those calls on the spot.
Name who is in charge
One person needs the authority to make calls, with a named deputy if they are unavailable. In many firms this sits naturally with the COLP, who already carries responsibility for regulatory compliance.
Isolate affected systems without wiping them
Disconnect affected devices from the network, but leave them intact. Investigators and insurers will want to see logs and machines as they were. Rebuilding too early can make it impossible to establish what data was taken.
Keep your contact list somewhere offline
If your email or phone system is down, a contact list saved on the server is no use to anyone. Keep a printed copy with your IT provider’s emergency number and your insurer’s incident line.
Agree what staff and clients are told
Staff will notice something is wrong quickly. A short holding message agreed in advance keeps colleagues from speculating with clients over the phone.
Who do you need to notify after a data breach?
The ICO
Under UK GDPR, a reportable personal data breach must go to the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours. When DPP Law was attacked, it took 43 days to report. The firm had not treated losing access to personal data as a breach, and the ICO fined it £60,000.
The SRA
The SRA expects a prompt report if a cyberattack directly affects your firm or its clients. Where there has been a serious breach of its Standards and Regulations, Rule 3.9 of the Code of Conduct for Firms makes reporting an obligation. Its guidance on reporting cybercrime also expects a report where an attack could affect clients.
Your insurer
Cyber policies usually carry their own notification terms, and some give you access to a specialist response team. Check your policy wording now, since reporting late can complicate a claim.
Your clients
Where a breach is likely to result in a high risk to the people affected, UK GDPR requires you to tell them without undue delay. Your plan should say who drafts that message and who signs it off.
How do you test an incident response plan?
The NCSC offers Exercise in a Box, a free online tool that helps organisations practise their response to a cyberattack without needing specialist knowledge. Its scenarios cover threats including ransomware and phishing.
A tabletop exercise works particularly well for law firms. Partners and key staff talk through a realistic scenario, such as a fee earner’s email being taken over mid-completion. Gaps show up quickly, and a meeting room is a far better place to find them.
Review the plan after each exercise and whenever your systems change, such as a move to a new case management platform.
How can Labyrinth Technology help with incident response?
For firms on our managed security services, Labyrinth Technology monitors systems 24/7 and uses managed detection and response to contain threats before they cause damage.
Your plan still needs to cover decisions only your firm can make, like what clients are told and when to notify the ICO and SRA. Our cyber security consulting team also carries out vulnerability scanning and penetration testing, which helps close gaps before an attacker finds them.
Labyrinth Technology has supported law firms for over a decade, so we understand what the SRA and your clients expect from you after an incident. If you’d like help building or reviewing your plan, speak to our team.
