UK legal systems · SRA context: England and Wales
Planning a penetration test
for legal systems.
Prepare an assessment around the documents, applications and workflows your organisation relies on. Use this guide to identify confidentiality concerns, gather the right information and define the evidence you need.
Start with your context
Identify what applies
to your organisation.
| Your situation | Why it matters | What to establish |
|---|---|---|
| An SRA-regulated practice | Protecting matter information and assessing the systems used in your practice. | The Code for Firms requires confidentiality for current and former clients’ affairs, subject to its exceptions. Identify the workflows and people handling that information. |
| An internal legal function | Assessing legal workflows within a wider organisation. | Identify your lawyers’ applicable duties, your organisation’s policies and its data-processing responsibilities. The Code for Firms does not automatically apply to the entire organisation. |
| A legal software supplier | Assessing the software you provide and the commitments you make. | Professional duties do not automatically regulate every vendor. If a firm has requested evidence, record the actual contract or assessment requirement alongside your own security priorities. |
SRA references here concern England and Wales. Confirm the relevant professional rules for work elsewhere in the UK. Applicable UK data-protection obligations are a separate consideration.
Make the scope concrete
Prepare the information
your assessment needs.
| Area | What to prepare | What this helps define |
|---|---|---|
| Documents and matter workflows | List upload, processing, search, sharing and export features; describe the information involved and the intended matter boundaries. | A scope covering the paths by which information enters, moves through and leaves the system. |
| Users and connected systems | Identify staff, external users, administrators, APIs and integrations. Prepare representative accounts and describe who owns each component. | Agreed role and workflow coverage, including third-party components that need permission or a test substitute. |
| Application and deployment | Share the application version, architecture and relevant web server, CDN, cache and hosting components. | Coverage of input handling, business logic, data protection and supporting configuration as well as access controls. |
| AI features, if present | Describe connected information sources, permitted actions and the rules for using sensitive information with models. | A scope for the AI-enabled workflow and its application controls. The SRA AI warning also calls for appropriate contractual, technical and organisational safeguards. |
| Handling and reporting | Identify information restrictions, approved access and storage, report recipients, retention and remediation owners. | A defined handling arrangement and evidence your technical and governance teams can use. |
Useful outputs
Ask for evidence
you can act on.
Your MurtaSec report includes an executive summary, a summary of findings and detailed findings with descriptions, reproduction steps, remediation steps and references. For AI-enabled systems, distinguish technical control testing from the legal accuracy of generated content. The ICO’s security guidance supports evaluating security measures regularly; it does not prescribe one universal annual pentest for every organisation.
Common questions
Resolve the decisions
before testing starts.
Do we need to provide real matter files?
Start with representative invented documents and test accounts where they meet the agreed objectives. If real information is necessary, settle permission, minimisation and handling arrangements before access; do not include files in an initial enquiry.
What if we use third-party legal software?
Identify the components you control and the provider’s testing conditions. Your subscription or administration access does not automatically authorise testing the provider’s infrastructure. Agree permission or a suitable test environment first.
Does the report establish legal compliance or privilege?
It provides technical evidence for the agreed scope. It does not determine every legal obligation, certify compliance or preserve privilege by itself; your legal and governance owners make those judgements in context.
Sources & related guidance
Check the source
for your requirement.
Reviewed 25 September 2026. SRA material applies to the relevant regulated lawyers and firms; confirm the scope of your own obligations. This guide provides technical preparation advice.
Let’s plan
your assessment.
Tell us about the system you need assessed, the questions you want answered and any specific requirements. We can help you shape a practical scope.