Understanding Lexcel and the Specialist Quality Mark (SQM): How Cyber Essentials Can Benefit Your Practice

If you work within the legal sector, it is quite likely that you have encountered Lexcel or the SQM, as accreditation to one of these standards is mandatory for holding a legal aid contract with the Legal Aid Agency. Such a contract is needed if your practice wants to offer legal aid services.

Introduced by the Law Society of England and Wales, Lexcel is the legal practice quality mark for client care, compliance and practice management.  It covers the following areas:

• Information management
• Risk management
• Client care
• People management
• Structure and strategy
• Financial management
• File and case management.

Meanwhile, the SQM is a quality assurance standard maintained by the Legal Aid Agency.  The SQM contains the following sections:

• Access to Service
• Seamless Service
• Running the Organisation
• People Management
• Running the Service
• Meeting Clients’ Needs
• Commitment to Quality.

The Standard also provides guidance and defines requirements on information handling.

In their respective guidance documents, both Lexcel and the SQM recommend that practices obtain certification to Cyber Essentials to improve their information security management, and as a means of meeting the Standards’ requirements.

The Cyber Essentials scheme was developed as a part of the UK Government’s National Cyber Security Strategy.  It aims to protect your practice against a range of internet-based cyber attacks by providing a framework of technical controls across 5 basic control areas:

• Firewalls
• Secure configuration
• Security update management
• User access control
• Malware protection.

By achieving Cyber Essentials certification, your practice is effectively protecting itself against 80% of the most common cyber attacks.  The Cyber Essentials Supply Chain Brochure even notes that Cyber Essentials-certified organisations are 92% less likely to make an insurance claim for a cyber incident than those without.

‍

Achieving Cyber Essentials allows your practice to demonstrate its commitment to security and is often required as part of governmental contracts.  76% of CE users report that holding Cyber Essentials certification helps reduce the due diligence burden placed upon them, thereby saving time and resources.

If your practice would benefit from additional validation of its security measures, it can obtain certification to Cyber Essentials Plus, the scheme’s audited qualification.  The requirements of Cyber Essentials and Cyber Essentials Plus are the same, so you will not need to implement any additional measures in order to achieve the additional certification.  However, Cyber Essentials Plus involves a technical audit, conducted by a qualified external assessor, to verify your effective implementation of the Cyber Essentials controls, thereby providing an extra layer of assurance to prospective clients and other key stakeholders.

‍

To achieve Cyber Essentials certification, you will need to complete a self-assessment questionnaire (SAQ). Certification bodies, such as URM, can provide you with access to a portal where will need to answer a number of questions about your IT infrastructure.  A board member will also need to provide a signed declaration that all answers provided in the Cyber Essentials assessment are accurate.

Following submission, the SAQ will be reviewed by your chosen certification body, with most certification bodies aiming to complete the review and return your results within 3 working days.  If successful, you will hold a valid certification, and will need to recertify on an annual basis.  If you are unsuccessful, you will be provided with a further 2 working days to address any gaps (e.g., amending simple issues with policies or your network), following which you can resubmit your updated SAQ, free of charge.

If your practice decides to seek Cyber Essentials Plus certification, you will need to complete the technical audit within 3 months of certifying to Cyber Essentials.  You can only achieve Cyber Essentials Plus if you have already certified to Cyber Essentials.  The technical audit will need to be conducted by an accredited certification body, and involves internal and external vulnerability scans and tests of your malware protection on a sample of your practice’s devices.  If no gaps are identified during the audit, certification will be awarded.