Lexcel and your IT: the gaps we keep finding in section 3

Most firms think of Lexcel as a practice-management standard: file reviews, client care letters, supervision. It is all of those things. But a good chunk of it is IT, and that's the part that tends to cause the most work in the run-up to a visit, because IT evidence goes out of date faster than anything else in the manual.

The standard is quite clear on how procedures are judged. In its own glossary, a procedure "can only be said to be complied with if the assessor can observe that the procedure contained in the practice's documentation is in effective operation." A well-written IT policy that describes how things worked three years ago doesn't pass that test. Below is what the standard asks for, where we usually find the gaps, and how we keep the evidence live rather than rewriting it the month before the assessor arrives.

What the standard actually asks for

The current version for firms in England and Wales is Lexcel v6.1. The IT requirements sit mainly in section 3, information management, and clause 3.2 is the heart of it. Practices must have an information management and security policy and should be accredited against Cyber Essentials. The policy must incorporate ten controls:

• a register of relevant information assets of both the practice and clients
• procedures for the protection and security of those assets
• procedures for the retention and disposal of information
• the use of firewalls
• procedures for the secure configuration of network devices
• procedures to manage user accounts
• procedures to detect and remove malicious software
• a register of all software used by the practice
• training for personnel on information security
• a plan for the updating and monitoring of software.

Around 3.2 sit the supporting policies: data protection under 3.1 (including a procedure to manage and report data breaches, and regular data protection training for all staff), then separate email, website, internet access and social media policies under 3.3 to 3.6. Clause 3.7 requires a register of every plan, policy and procedure in the standard, a named person responsible for each, and a procedure for reviewing them. The glossary adds that every policy, plan and procedure must be reviewed at least annually.

Two clauses outside section 3 that are really IT

These are the two that catch firms out, because nobody thinks of them as IT until the assessor asks.

Clause 1.3, business continuity. The plan must include an evaluation of the risks that could interrupt the business, ways to reduce or transfer them, the key people involved, and a procedure to test the plan annually. For most firms today, the realistic interruptions are IT ones: the case management system unavailable, a mailbox compromised, a laptop stolen with matter files on it, Microsoft 365 having a bad day. A continuity plan that only covers fire and flood is missing the likeliest scenarios.

Clause 5.2, outsourced activities. The policy must list all outsourced activities including the providers, set out how the firm checks the quality of outsourced work, and describe how it makes sure providers have taken appropriate precautions to protect information. Your IT support company is an outsourced activity. So is your hosted case management system, your cloud document storage, your e-signature service and your outsourced typing. Each of them needs to be on the list, and you need some evidence that you checked.

Why the IT side drifts

Lexcel accreditation runs for three years with annual visits in between. According to the Law Society's assessment guidance, the onsite re-accreditation concentrates on sections 5, 6 and 7 of the standard. That's sensible, because those are risk management, client care and file management, where most of the day-to-day risk sits. The side effect is that the section 3 policy written for the initial assessment can go a long time without anyone reading it closely.

Meanwhile the IT moves on. New cloud services get added, people leave, the firewall gets replaced, the firm moves to a new case management system. When we review a firm's section 3 evidence, the gaps we find in year three were usually opened in year one.

The six gaps we find most often

One, the software register is a list from the initial assessment. Clause 3.2(h) asks for a register of all software used by the practice. The one we usually find lists the case management system, Microsoft Office and the accounts package. What's missing is everything added since: the e-signature tool, the ID verification and AML search service, the dictation app, the client portal, the Teams apps someone installed. The quickest fix is to rebuild the register from two live sources: the subscriptions coming through your accounts, and the list of applications connected to your Microsoft 365 tenant. Between them they catch almost everything.

Two, the patching plan says "updates are installed automatically". That's a setting, not a plan. Clause 3.2(j) asks for a plan for updating and monitoring software, and the word "monitoring" matters. A plan says who is responsible, how often updates go on, how you know they worked, and what happens to the things that don't update themselves: the firewall, any server still in the office, the PDF and conveyancing tools that need a manual install. If you're working towards Cyber Essentials, align the plan to its 14-day rule for high and critical updates, which I covered in our recent renewal piece.

Three, leavers who haven't fully left. Clause 3.2(f) asks for procedures to manage user accounts. The procedure usually exists. The evidence that it's followed often doesn't. We regularly find a fee earner who left months ago with an active mailbox, a shared reception login nobody owns, or a former trainee whose account still has access to the document store. The evidence an assessor wants is a dated joiners and leavers record, and a periodic review showing someone checked that the list of active accounts matches the staff list.

Four, an information asset register that only covers the case management system. Clause 3.2(a) asks for a register of information assets of both the practice and its clients. Client information doesn't only live in the case management system. It lives in email, in personal OneDrive folders, in scanned ID documents saved to a desktop, in a shared mailbox for completions. The register should describe where client information actually is, not where the policy says it should be.

Five, a continuity plan that has never been tested. Clause 1.3(d) requires an annual test. A test doesn't need to be dramatic. A two-hour walk-through of "the case management system is down for a day, what do we do?" counts, as does restoring a closed matter folder from backup and timing how long it takes. Write down what happened, what went wrong, and what you changed. That note is the evidence.

Six, an outsourcing policy with no checking. Clause 5.2 lists your IT provider, but the firm has no record of having asked how that provider protects your information. Ask them. Do they hold Cyber Essentials themselves? How do their engineers sign in to your systems, with named accounts and MFA, or with a shared admin password? Where do they keep your passwords? What happens to your data if you leave them? A good provider will answer in writing without fuss. Keep the answers with your 5.2 evidence and refresh them each year.

Training is the near-miss that sits alongside all six. Clause 3.1(e) asks for regular data protection training for all staff and 3.2(i) asks for information security training. Most firms do the training. Fewer can produce a dated record of who attended and what it covered, and that record is what the assessor will look for.

Cyber Essentials: "should", not "must"

Lexcel says practices should be accredited against Cyber Essentials, so it isn't a mandatory requirement and its absence isn't a non-compliance on its own. In practice it's the easiest way to evidence a large part of clause 3.2. Firewalls, secure configuration, user account management, malware protection and software updates are five of the ten 3.2 controls, and they map almost exactly onto the five Cyber Essentials controls. A current certificate, with the questionnaire behind it, does a lot of the 3.2 evidence work for you, and it's increasingly what professional indemnity insurers ask about anyway.

How we keep it current for the firms we look after

The aim is that nothing in section 3 is written the month before the visit. For the legal practices we support, the routine is:

• Every quarter: the software register and the active user list are refreshed from the live systems, and any differences from the staff list are chased.
• Every 90 days: a SecureState review re-scores the firm's controls and produces a one-page report that drops straight into the section 3 evidence file.
• Every year: the information management and security policy is reviewed and dated by its named owner, the continuity plan is tested with a written note of the result, and we provide an updated pack of our own answers for the firm's 5.2 outsourcing evidence.

None of this is complicated. It's just the difference between a policy that describes the firm and a policy that describes the firm as it was. If you'd like to see what a move done properly looks like, we wrote up a Trafford law firm's move to fully cloud-based working.

FAQ

Does Lexcel require Cyber Essentials?

No. Clause 3.2 of Lexcel v6.1 says practices must have an information management and security policy and should be accredited against Cyber Essentials. It's a strong recommendation rather than a requirement, but a current certificate is the simplest way to evidence most of the technical controls 3.2 asks for.

What IT controls does Lexcel clause 3.2 require?

Ten: a register of information assets, procedures to protect them, retention and disposal procedures, use of firewalls, secure configuration of network devices, user account management, malware detection and removal, a register of all software, information security training, and a plan for updating and monitoring software.

Does our IT provider count as an outsourced activity under Lexcel?

Yes. Clause 5.2 requires details of all outsourced activities including the providers, procedures to check the quality of their work, and procedures to make sure they have taken appropriate precautions to protect information. That includes your IT support company and any hosted or cloud systems holding client data.

How often does the IT policy need reviewing for Lexcel?

The Lexcel glossary says every policy, plan and procedure must have a named person responsible and be reviewed at least annually. Clause 3.7 also requires a register of them and a review procedure. A dated, signed annual review is the evidence an assessor expects.

What counts as testing the business continuity plan?

Clause 1.3 asks for a procedure to test the plan annually. A tabletop walk-through of a realistic IT outage, or a timed restore of a closed matter from backup, both count, as long as you record what happened and what you changed as a result.