Cyber security for law firms: the 2026 obligations and a 90-day plan for partners

It usually starts with a questionnaire. The cyber insurer wants to know whether multi-factor authentication is enforced on every account. A corporate client sends its supplier security assessment. Your conveyancing team asks what AUSTRAC now expects of them. Then a partner wants to know whether the firm would have to tell the OAIC if a laptop went missing.

Each request is reasonable on its own. Together, they’re asking the partners one question: can your firm prove it protects client information?

This guide to cyber security for law firms sets out the obligations Australian firms now carry in 2026, the handful of controls that answer almost all of them, and a 90-day plan the partners can own.

Cyber security is now a partner obligation, not an IT project

For years, law firm cybersecurity sat with IT. Buy the right tools, keep the servers patched and hope nothing happens. That model no longer holds.

In 2026, regulators, insurers, clients and the law societies are asking the same question in different words, and they want evidence, not assurance. At Essential Tech we see this every week as firms work through insurance renewals, client due diligence and tender requirements.

Cyber risk is business risk. For a law firm it also goes to the heart of practice: rule 9 of the Australian Solicitors’ Conduct Rules says a solicitor must not disclose confidential client information except as the rules allow. Every obligation below is, in the end, about protecting that confidence.

The gap is rarely a missing tool. More often it’s a firm with good tools and no single view of whether they actually work.

Why law firms are a target

Law firms combine three things attackers want: confidential information, money moving through trust accounts, and deadlines that create pressure to act quickly.

Business email compromise — fraud through compromised or impersonated email accounts was 15% of cybercrime reports from businesses in ASD’s 2024–25 threat report, with email compromise without a financial loss another 19%. For a firm handling settlements, one changed bank account number in a convincing email is enough.
Ransomware — ASD’s 2025–26 report names professional, scientific and technical services, the sector that includes legal services, as one of the three sectors most affected by ransomware, and the second most frequent non-government sector reporting incidents.
The cost — the average self-reported cost of a cybercrime to a business was $93,500 in 2025–26, up 16%. For medium businesses it was $141,300, up 45%.
Data breaches — legal, accounting and management services made 81 notifications to the OAIC in 2025, putting the sector among the five that notified most.

The legal profession’s own research points the same way. In the 2024 State of Cyber Security in Law study published through ALPMA, 21% of Australian and New Zealand firms surveyed had been targeted in the past year, and only 56% were confident their firm was doing enough.

The 2026 obligations, in one place

None of these is new on its own. What’s new is that they now overlap, and they all ask for evidence.

Obligation	Who it applies to	What it expects
Privacy Act and the Notifiable Data Breaches scheme	Firms covered by the Privacy Act (the small business exemption still applies under $3 million turnover)	Reasonable steps to protect personal information. Assess a suspected breach within 30 days, and notify affected clients and the OAIC if serious harm is likely.
AML/CTF Tranche 2	Firms providing designated services, such as real estate transactions, company and trust work, or managing client money for a transaction, since 1 July 2026	Enrolment with AUSTRAC, an AML/CTF program and compliance officer, customer due diligence, suspicious matter reporting, record keeping and staff training.
Ransomware payment reporting (Cyber Security Act 2024)	Businesses with annual turnover above $3 million, since 30 May 2025	A report to ASD within 72 hours of making a ransom payment, or of learning one was made on your behalf.
Automated decision transparency (Privacy Act)	Firms covered by the Privacy Act, from 10 December 2026	A privacy policy that explains when computer programs make or substantially inform significant decisions about people. Relevant as AI tools reach client work.
Law society and regulator guidance	Practices in each state	QLS supports SMB1001 and recommends members work towards Gold. The Law Society of NSW and Lawcover publish a cyber guide and checklist. Victoria’s Legal Services Board + Commissioner sets minimum cybersecurity expectations, with MFA, strong passwords and security updates as critical controls.
Insurers	Every firm with professional indemnity or cyber cover	Evidence of MFA, backups, patching and payment-verification procedures at renewal. LPLC’s advice to Victorian practitioners is simple: call before you pay.

Since 10 June 2025, individuals can also sue for serious invasions of privacy under a new statutory tort. And on 15 October 2026, ASD launched the ASD Essentials as the successor to the Essential Eight. The Essential Eight still applies until regulators change their requirements, so contracts and insurers that name it still mean it.

This article is general information, not legal advice. Speak to your legal adviser about your firm’s specific obligations.

The same handful of controls answers almost all of it

Read the obligations side by side and a pattern appears. The insurer, the OAIC, AUSTRAC and the law societies are asking about the same small set of controls:

Phishing-resistant MFA on every account — including admin accounts and the practice management system. It’s the first question on most insurance questionnaires.
Email protection and a call-back rule for payments — impersonation filtering, warnings on external email, and a documented rule that bank details are only ever confirmed by phone on a known number.
Patching and supported software — security updates applied on a schedule, and nothing running that the vendor no longer supports.
Restricted admin access — separate admin accounts, approved and reviewed, that can’t browse the web or read email.
Tested backups — kept separate from the systems they protect, with a restore tested so you know how long recovery really takes.
Logging and an incident response plan — so you can work out what happened within the OAIC’s 30-day assessment window, and meet the 72-hour ransomware reporting deadline if it applies.
Access control and retention for client records — including identity documents and due diligence records you now keep for AUSTRAC.
Staff awareness and an AI policy — training on the scams aimed at law firms, and clear rules for using AI tools on client matters.

These are the controls at the core of both the Essential Eight and SMB1001. That’s the point: one framework, implemented properly, gives you the evidence for every questionnaire.

Which framework should a law firm use?

For most firms, SMB1001 is the right spine. It’s tiered, it produces a certificate you can show clients and insurers, and it’s the standard QLS recommends, at Gold. Use an Essential Eight assessment when a government client or tender asks for a maturity level. Keep an eye on the ASD Essentials, but don’t pause work you’ve started: ASD itself advises against slowing uplift programs already under way.

A 90-day plan partners can own

Understanding the obligations is one thing. Turning them into evidence the partners can stand behind is another. This is the plan I’d follow in your seat.

Days 1–30: know where you stand

Name one partner accountable for cyber risk, and agree how often the partners will see a report.
List where client information lives: practice management, Microsoft 365, document management, trust accounting and any file-sharing tools.
Confirm with your legal adviser which AML/CTF designated services your firm provides.
Run a gap assessment against SMB1001 Gold or the Essential Eight.
Read your cyber and PI policies for notification conditions and required controls.

Days 31–60: close the gaps that matter most

Enforce MFA on every account, starting with email, remote access and admin accounts.
Document the payment call-back rule and train everyone who touches trust money.
Test a restore from backup and record how long it took.
Remove standing admin rights that aren’t needed.
Write a one-page incident response plan with names and numbers: your IT provider, your insurer, your legal adviser, and ASD’s hotline.

Days 61–90: turn it into evidence

Run a one-hour tabletop exercise: a fee earner’s mailbox is compromised the day before a settlement. Who does what?
Produce a one-page report for the partners on where the firm stands and what’s next.
Answer your next insurer or client questionnaire from that evidence, not from memory.
Set the certification target and date, and a quarterly review to keep the evidence current.

Five questions to ask your IT provider

Is MFA enforced on every account, including admin and service accounts, and is it phishing-resistant?
When did you last restore our data from backup, and how long did it take?
If we were breached tonight, who would you call first, and who helps us decide whether to notify the OAIC?
Which framework are you measuring us against, and where do we stand today?
Can you give the partners a one-page report on our cyber position every quarter?

If the answers are vague, that’s your starting point.

If it happens: the first 24 hours

Contain, don’t wipe — isolate affected devices and accounts, and keep the evidence your insurer and investigators will need.
Call your insurer early — most cyber policies have notification conditions and incident response panels.
Report to ASD — at cyber.gov.au/report, or on the Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371), which takes calls 24/7.
Start the 30-day clock — assess whether it’s an eligible data breach under the NDB scheme, and get legal advice on notification.
Verify every payment instruction by phone — attackers often follow a compromise with fake requests to change bank details.

Frequently asked questions

Do small law firms need to worry about the Privacy Act?

Firms under $3 million turnover may be exempt from the Privacy Act, but the duty of confidentiality to clients still applies, and insurers and clients still ask for the same controls. Check your position with your legal adviser, especially if your firm now has AML/CTF obligations.

Is SMB1001 or the Essential Eight better for a law firm?

SMB1001 suits most firms because it gives you a certificate, and QLS recommends Gold. The Essential Eight is the better choice when a government client or tender asks for a specific maturity level.

What does AML/CTF Tranche 2 have to do with cyber security?

Firms providing designated services now hold identity documents and due diligence records that must be kept securely and retained. Weak access controls or a breach of those records creates both an AUSTRAC and a privacy problem.

Who should own cyber security in a law firm?

A partner. Your IT provider runs the controls, but the decisions about risk, investment and what you tell clients belong to the partners.

Related guides

The firms that win the next client tender won’t be the ones with the most security tools. They’ll be the ones that can show their work.

If you’d like an independent view of where your firm stands, my team and I would welcome a conversation. Book a Cyber & Compliance Maturity Assessment, or see how we support law firms.

Sources

Share this article

About the author

Michael Coward

CEO, Essential Tech

Michael leads Essential Tech, helping law firms and professional services firms protect what they’ve built and build what’s next.

Meet the team →

Not sure where your firm stands?

A Cyber & Compliance Maturity Assessment shows your gaps, your priorities and the evidence clients and insurers will ask for.