The chambers-as-partnership scoping problem
Unlike a law firm, a barristers' chambers does not itself employ the lawyers. Each barrister is self-employed, pays chambers a rent or percentage, and remains personally responsible for their own practice. The practical IT consequence is that chambers operates a shared infrastructure - a case-management system, a diary, a clerks' room, a shared print estate, possibly a DX and email platform - while each barrister runs their own devices, their own laptop, sometimes their own dictation stack. The Cyber Essentials scoping question is therefore: what counts as chambers' in-scope estate, and what is out of scope because it belongs to the individual tenant?
Our default recommendation is that chambers' Cyber Essentials scope covers the shared administrative infrastructure (clerks' workstations, the case-management server or SaaS instance, chambers-issued email accounts, the shared print/file environment) and explicitly excludes each barrister's personal device. Where a barrister receives chambers-issued equipment, that equipment is in scope. This scoping decision is documented and declared at submission.
Criminal chambers: CJSM and the Digital Case System
Criminal chambers face specific infrastructure obligations. Criminal Justice Secure eMail (CJSM) is required for communication with the CPS and the courts. The Digital Case System (DCS) provides remote access to prosecution material. Chambers hosting their own CJSM connector or offering DCS access on chambers-issued equipment need to ensure that those channels are running on v3.3-compliant endpoints, with mandatory MFA enforced on every account that accesses the court bundles.
Cyber Essentials Plus is the variant that criminal sets usually need. The Plus vulnerability scan of internet-facing infrastructure and the sampled endpoint audit directly address the evidence instructing solicitors (and the Legal Aid Agency on serious-crime work) now request before funding a paper.
Commercial and civil sets
Commercial chambers around the Temple and Lincoln's Inn receive DDQs from the City firms they accept instructions from. Magic Circle and silver-circle firms increasingly include Cyber Essentials as an explicit line item in their supplier standards, alongside ISO 27001 alignment and cyber insurance confirmation. For a set receiving instructions from a Magic Circle firm on a cross-border dispute with sensitive client data, Cyber Essentials is no longer optional.
Fig Group applies the same flat-fee pricing to chambers as to every other London client. We are a ten-minute walk from Holborn, fifteen from the Temple, and we host in-person scoping sessions at our office when the shared clerks' room and the IT provider both need to be in the room.