Your PII renewal, a cyber attack and the bottom line

What PII covers, and what it does not

The professional indemnity insurance every SRA-regulated firm must hold covers claims by clients and third parties. If a cyber attack on your systems leads to a client suing you, that claim falls within the cover. But the minimum terms exclude the firm's own losses from a cyber attack: investigating and responding to the incident, restoring data and systems, any ransom, and the business lost while you cannot work.

Those costs fall on the firm, unless it has separate cyber insurance that covers them. Many firms only discover the gap after an incident.

What a breach can really cost

• Response and recovery: forensic investigators, specialist lawyers, rebuilding systems and restoring data.
• Lost time: days or weeks of fee earners unable to work, completions delayed, bills not raised and cash not collected.
• Client money: if client money is stolen, the firm must replace the shortfall promptly under the SRA Accounts Rules, whatever the insurers eventually decide.
• Claims and excesses: clients' losses claimed against the PII policy, each with an excess the firm pays.
• Regulators: reporting to the SRA, and to the ICO within 72 hours where personal data is affected, with the possibility of investigation and fines.
• The next renewal: higher premiums and excesses, tighter terms, or fewer insurers willing to quote.
• Reputation: clients and referrers who quietly go elsewhere.

The numbers are real. When the SRA reviewed 40 firms that had been targeted by cyber criminals, more than £4m of client money had been stolen from 23 of them; most was repaid by insurers, but 18 firms paid £400,000 between them from their own funds. One listed UK law firm put the cost of a ransomware attack at around £5m against business interruption cover capped at £2m, and entered administration the following year, with the attack widely seen as a contributing factor.

Your answers have to be true

Proposal forms increasingly ask about multi-factor authentication, supported software, backups, staff training and how payments are verified. Under the Insurance Act 2015, the firm must make a fair presentation of the risk. If a box is ticked that turns out not to reflect reality, cover can be reduced or refused at the moment it is needed most. Treat every answer as something you may have to prove.

Where your systems come in

Much of what insurers ask about lives in, or depends on, your practice management system and the services around it:

• multi-factor authentication for every user, including your supplier's staff and connected apps;
• backups you have actually restored from, and a copy of key information if the system is unavailable;
• controls on client account payments, and bank details confirmed through a secure portal rather than email;
• audit trails showing who did what, and when;
• suppliers whose security, locations and incident history you know.

Before your next renewal

1. Read your cover: check what your PII and any cyber policy cover, the limits, the excesses, and especially business interruption and incident response.
2. Evidence every answer: for each question on the proposal form, know where the proof is: reports, logs, test results and supplier documents.
3. Close the obvious gaps: multi-factor authentication everywhere, supported software, regular training, and verified payment details.
4. Test recovery: restore something that matters, and check you could keep working if a key system was down for two weeks.
5. Know your suppliers: where your data is, who can reach it, and how quickly they would tell you about an incident.
6. Have a plan: who does what in the first hours of an incident, including who calls the insurer, the SRA and the ICO.

We help firms prepare a security review, understand how AI and their systems affect their security and their client data, and build the evidence behind their renewal answers, independently of any vendor or insurer.