Lender panels, the Law Society’s Conveyancing Quality Scheme (CQS) and Lexcel increasingly expect conveyancing solicitors to show real IT security: multi-factor authentication, managed endpoint protection, tested backups, a written information-security policy, staff training, and often Cyber Essentials. Meeting them is part of managed IT that usually costs about £45 to £100 per user per month, and it is becoming a condition of doing the work, not a nice-to-have.
For a Bishop’s Stortford practice, the point is simple: lenders, the CQS and your insurer all want evidence that client money and data are protected. Here is what they look for and how to be ready.
What lender panels expect
The UK Finance Mortgage Lenders’ Handbook and individual lender panels expect you to protect client funds and data, verify bank details safely, and report breaches. In practice that means strong email security and anti-fraud controls, multi-factor authentication, and processes that resist completion-payment redirection.
What CQS and Lexcel expect
CQS and Lexcel accreditation increasingly ask for documented information security: a policy, risk management, access control, backups, business continuity, and staff training that actually happens. They want to see that the controls exist and are maintained, not just claimed.
The controls that satisfy them
Most requirements are met by a solid managed-IT foundation:
- Multi-factor authentication on every account
- Managed endpoint protection and application allowlisting
- Managed email security and verified payment processes
- Encrypted, tested backups and a written recovery plan
- Regular staff awareness training and phishing tests
- A written information-security policy and asset list
Cyber Essentials as the baseline
Cyber Essentials is the simplest way to prove the basics are genuinely in place, and it is recognised by lenders, insurers and clients. It gives your practice a clear standard to work to and a certificate you can point to when a panel or client asks.
Evidence you can show
Being accredited is easier when the evidence already exists. A good IT partner keeps your policies, training records, backup tests and security reports up to date, so an audit or panel question becomes a quick answer rather than a scramble.
A real example: security that stands up to scrutiny
We help conveyancing practices reach and keep Cyber Essentials and maintain the documented controls lenders and the SRA expect, so when a panel or insurer asks how client data is protected, the answer is ready and evidenced rather than improvised.
What to ask a provider
A specialist for conveyancing solicitors should be able to answer:
- Have you helped conveyancing practices meet lender-panel, CQS and Lexcel IT requirements before?
- Can you get us to Cyber Essentials and keep us there?
- Do you maintain our security policies, training records and backup tests for audits?
- How do you protect us from completion-payment fraud?
- Is the price clear and per user, with these controls included?
Where to start
If you are not sure how you would answer a panel or auditor today, start with a short review: confirm multi-factor authentication is on everywhere, check that backups are tested, write down your information-security policy, and work towards Cyber Essentials. That covers most of what lenders, CQS and Lexcel ask for, and gives you the evidence to prove it rather than scrambling when the question arrives.
Why it is not a one-off
Meeting these requirements once is not enough; lenders, the CQS and Lexcel expect the controls to be maintained, reviewed and evidenced over time. Software needs patching, staff change and need re-training, backups need testing, and policies need updating as the practice grows. This is exactly where a managed service earns its place: rather than a scramble before each audit or panel renewal, the protections are kept current all year, the records build up automatically, and you can answer a security question with confidence. For a busy conveyancing practice that ongoing assurance, and not having to think about it, is worth far more than the monthly cost, and it turns accreditation from a stressful project into business as usual.
Why the cheapest option costs more
It is tempting to treat security as a box-ticking cost, but failing a lender panel, losing accreditation, or suffering a breach you cannot evidence costs far more than maintaining the controls properly. The right question is not the lowest price, but what it costs you to lose panel membership or a client’s trust, and who keeps you compliant and able to prove it.
Why conveyancing solicitors choose First Stop IT
First Stop IT has supported businesses since 2002, including conveyancing solicitors and high-street practices, and we know the software you run every day: LEAP, Oyez forms, eSigner, BigHand, Sage Payroll, PTP and Xero, alongside Microsoft 365. We support conveyancing solicitors in Harlow, Bishop’s Stortford, Sawbridgeworth, London and across Essex and Hertfordshire. Our credentials include:
- Cyber Essentials Certified
- IASME Cyber Assurance (Gold)
- NCSC Assured Service Provider (Cyber Advisor for Cyber Essentials)
- Microsoft Partner
- Crown Commercial Service Supplier (G-Cloud)
- Quality Principles Certified
We look after more than 2,000 endpoints across 50 companies, we have been named a Top 50 UK MSP for three years running, and we support organisations with 10 to 100 employees across Essex, Hertfordshire and London, including Harlow and Bishop’s Stortford.
Book a free IT and cyber security review
Want this handled properly for your practice? Book a free IT and cyber security review with First Stop IT.